Is Alaya Governance Token (AGT) Safe? Smart Contract Security Analysis

Security Findings

1 Low2 Info

Low

Absence of Emergency Pause/Blacklist Functionality

L-01The ERC20 contract does not include any administrative functions for emergency control, such as pausing transfers or blacklisting malicious addresses. While this enhances decentralization by removing single points of control, it also means there is no mechanism to mitigate severe exploits, respond to regulatory demands, or freeze funds in case of theft (7.3 Access Control, 7.8 Operations).

IssueThe ERC20 contract does not include any administrative functions for emergency control, such as pausing transfers or blacklisting malicious addresses. While this enhances decentralization by removing single points of control, it also means there is no mechanism to mitigate severe exploits, respond to regulatory demands, or freeze funds in case of theft (7.3 Access Control, 7.8 Operations).

FixEvaluate the project's risk tolerance and operational needs. If emergency intervention capabilities are desired, consider integrating OpenZeppelin's `Pausable` or `AccessControl` contracts. If not, ensure the project's off-chain incident response plan accounts for the immutable nature of the token's operations.

StatusUnresolved

Info

Centralized Initial Supply Distribution

I-01The constructor of the ERC20 contract mints the entire initial supply of 5,000,000,000 * 10^18 tokens directly to `msg.sender`. This design choice results in a highly centralized initial distribution, where the deployer address holds the entire token supply at launch. While a common pattern for initial token deployment, it implies significant control by a single entity over the token's early circulation (7.4 Economic).

IssueThe constructor of the ERC20 contract mints the entire initial supply of 5,000,000,000 * 10^18 tokens directly to `msg.sender`. This design choice results in a highly centralized initial distribution, where the deployer address holds the entire token supply at launch. While a common pattern for initial token deployment, it implies significant control by a single entity over the token's early circulation (7.4 Economic).

FixAcknowledge and accept this centralized distribution as a design decision. If decentralization is a long-term goal, consider a phased distribution strategy or a multi-signature wallet for managing the initial supply.

StatusUnresolved

Info

Immutability of Token Parameters

I-02The token's name, symbol, decimals (fixed at 18), and initial total supply are set immutably within the constructor. These parameters cannot be modified after deployment. This ensures consistency and predictability for users and integrated protocols (7.1 Architecture).

IssueThe token's name, symbol, decimals (fixed at 18), and initial total supply are set immutably within the constructor. These parameters cannot be modified after deployment. This ensures consistency and predictability for users and integrated protocols (7.1 Architecture).

FixNo action required. This is a standard and often desired characteristic for ERC20 tokens, providing clarity and preventing unexpected changes to fundamental token properties.

StatusUnresolved

Category Ratings

TechnicalLow10/10

The technical architecture is robust, built upon the latest OpenZeppelin ERC20 implementation (v5.1.0), which includes modern features like ERC-6093 custom errors and correct `unchecked` arithmetic. The contract adheres to the ERC20 standard, providing basic token functionalities (7.1 Architecture, 7.2 Code Security). The code is well-structured and follows best practices. There are no complex custom logic or external integrations that introduce significant technical attack vectors (7.6 External).

GovernanceHigh1/10

The economic model is that of a standard ERC20 token, with a fixed initial supply minted entirely to the deployer (7.4 Economic). This centralizes initial control over the token supply. There are no explicit governance mechanisms or complex economic incentives defined within the contract itself (7.5 Governance). The token's utility and broader economic implications would depend on its integration into a larger ecosystem.

UpgradesMedium6/10

The contract is implemented as a standard, non-upgradeable ERC20 token. There are no proxy patterns (e.g., UUPS, Transparent) or beacon proxies used, meaning the contract's logic cannot be modified post-deployment (7.7 Upgrades). This design choice eliminates upgrade-related risks but also removes the flexibility to fix bugs or add features in the future.

Security Checklist

3/5 checks passed

Contract VerifiedPass

Ownership Renounced?

No Mint FunctionPass

Liquidity LockedFail

Not a ProxyPass

Holder Composition

56.2% in top 10

53.3% in wallets2.9% in contracts

Effective Concentration54.5%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$1.33M across 10 pairs

Pancakeswap v3WBNBanalysed$1.33M UniswapUSDT$520 Pancakeswap v2Subject 3$18 Pancakeswap v2DPJF$11 Pancakeswap v2HODL3Q$4 Pancakeswap v3USDT$3

Show 4 more pairsShow less

Pancakeswap v2YXL$3 Pancakeswap v2DPJF$1 Pancakeswap v3USD1$1 Pancakeswap v2USDT$0

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%

Top-3 Unlocked100.0%

Key Addresses

3 addresses

Deployer

0x4dcf…e3af

Unlocked LP Held By

0x8815…288b0x6b94…b028

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

6 factors

Ownership status UNKNOWN (owner could not be resolved)
Top-10 concentration > 50% (56.2% total → 54.5% effective; 53.3% in EOAs, 2.9% in contracts — heavy)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 100.0% (independent LP — depth risk)
LP top3 unlocked holders = 100.0% (independent LP — depth risk)
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Final Recommendation

AI Copilot

The AlayaGovernanceToken contract is a solid implementation of the ERC20 standard, benefiting from the security and reliability of OpenZeppelin Contracts.…

Read the verdictHide

It is recommended to thoroughly review the implications of the centralized initial token distribution and the absence of emergency controls, ensuring these design choices align with the project's long-term vision and risk tolerance. For future developments, consider implementing a multi-signature wallet for the deployer address if it retains significant control, and conduct comprehensive testing of any external integrations involving this token.

Contract

TypeAlayaGovernanceToken

Audit History

1 audit on record

Aug 1131

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Is Alaya Governance Token Safe?

Security Findings

Absence of Emergency Pause/Blacklist Functionality

Centralized Initial Supply Distribution

Immutability of Token Parameters

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of Alaya Governance Token?