Is AltLayer Token (ALT) Safe? Smart Contract Security Analysis

Security Findings

1 High3 Med3 Info

High

Who holds the supply

QA-HOLDERSThe ten largest holders own 91.2% of supply. What remains: 10.8% in wallets, 80.4% in other contracts. The deployer/owner wallet itself holds 26.3%. A holder that also controls the contract can sell into its own liquidity. 73,347 holders in total.

IssueThe ten largest holders own 91.2% of supply. What remains: 10.8% in wallets, 80.4% in other contracts. The deployer/owner wallet itself holds 26.3%. A holder that also controls the contract can sell into its own liquidity. 73,347 holders in total.

FixWatch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

StatusAcknowledged

Medium

Owner Can Create New Tokens

CP-01The contract owner has the ability to create new AltLayer tokens using the `mint(address,uint256)` function. This means the total supply of tokens can be increased at any time, which could dilute the value of existing tokens held by other users.

IssueThe contract owner has the ability to create new AltLayer tokens using the `mint(address,uint256)` function. This means the total supply of tokens can be increased at any time, which could dilute the value of existing tokens held by other users.

FixToken holders should be aware that the owner retains the power to mint new tokens. It is recommended that the owner's key be secured with a robust multi-signature setup and that a clear policy for minting, if any, is communicated to the community.

StatusUnresolved

Medium

Owner Can Stop All Token Transfers

CP-04The contract owner can halt all token transfers by calling the `pause()` function, and resume them with `unpause()`. This capability, while potentially useful in emergencies (e.g., to stop an exploit), gives the owner significant control over the token's liquidity and usability, as they can prevent users from moving their tokens.

IssueThe contract owner can halt all token transfers by calling the `pause()` function, and resume them with `unpause()`. This capability, while potentially useful in emergencies (e.g., to stop an exploit), gives the owner significant control over the token's liquidity and usability, as they can prevent users from moving their tokens.

FixToken holders should understand that the owner can temporarily freeze all token movements. It is crucial that the owner's key is highly secured, ideally with a multi-signature wallet, and that the community is informed about the circumstances under which pausing might occur.

StatusUnresolved

Medium

Liquidity not locked

QA-LIQUIDITY0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a wallet, 0x7966…e764 — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.

Issue0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a wallet, 0x7966…e764 — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.

FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.

StatusAcknowledged

Info

Identity verified by independent sources

QA-IDENTITYListed on CoinGecko as AltLayer (ALT), market cap $61M, rank #420. Traded on Binance, Coinbase. 73,347 holders. Verified by: CoinGecko, exchange listings.

IssueListed on CoinGecko as AltLayer (ALT), market cap $61M, rank #420. Traded on Binance, Coinbase. 73,347 holders. Verified by: CoinGecko, exchange listings.

FixMatch the contract address against the project's official channels before trading.

StatusAcknowledged

Info

The market for this token

QA-MARKETLiquidity $100K (DexScreener, all pools). 24h trading volume $8.3M (CoinGecko, all markets, daily snapshot). 24h trading volume $36K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.677 on 2024-03-28; the price is now 98.7708% below it.

IssueLiquidity $100K (DexScreener, all pools). 24h trading volume $8.3M (CoinGecko, all markets, daily snapshot). 24h trading volume $36K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.677 on 2024-03-28; the price is now 98.7708% below it.

FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

StatusAcknowledged

Info

Asset class: Governance token

QA-PROFILEA token whose main use is voting on a protocol's decisions (delegation and vote checkpoints in its code). The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Governance. Tokenomics — Supply: mintable with no on-chain cap found. Control: a 2-of-3 multisig. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $100K of DEX liquidity across 3 pools. Launch: 989 days of market history.

IssueA token whose main use is voting on a protocol's decisions (delegation and vote checkpoints in its code). The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Governance. Tokenomics — Supply: mintable with no on-chain cap found. Control: a 2-of-3 multisig. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $100K of DEX liquidity across 3 pools. Launch: 989 days of market history.

FixCheck how much of the voting supply insiders hold and what governance can change.

StatusAcknowledged

Category Ratings

TechnicalLow8/10

The AltLayerToken contract implements a standard ERC-20 token with additional features like pausing, capping, burning, and permit functionality (7.1 Architecture). The code base inherits from well-audited OpenZeppelin contracts, contributing to its robustness (7.2 Code Security). However, the contract owner retains significant control, including the ability to pause all token transfers via `pause()` and `unpause()` functions, and to mint new tokens using `mint(address,uint252)` (7.3 Access Control). These centralized controls introduce a medium technical risk.

GovernanceHigh2/10

Economically, the owner's ability to mint new tokens directly impacts the token supply, potentially leading to dilution for existing holders (7.4 Economic). The power to pause transfers can disrupt market liquidity and prevent users from accessing their funds, which could have significant economic consequences (7.4 Economic). While these controls might be intended for emergency response, they represent a centralized governance model where a single entity holds substantial power over the token's economic behavior (7.5 Governance).

UpgradesMedium4/10

The AltLayerToken contract is not designed as an upgradeable proxy (7.7 Upgrades). This means its logic cannot be changed after deployment, providing immutability and predictability for token holders. While this eliminates upgrade-related risks, any future feature additions or bug fixes would require a new contract deployment and a token migration process.

Security Checklist

2/5 checks passed

Contract VerifiedPass

Ownership RenouncedFail

No Mint FunctionFail

Liquidity LockedFail

Not a ProxyPass

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

91.2% in top 10

10.8% in wallets80.4% in contracts

Effective Concentration42.9%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$99.8K across 3 pairs

Uniswap v2USDTanalysed$98.6K Uniswap v3WETH$1.2K 0x2D72…C792WETH$47

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%

Top-3 Unlocked100.0%

Key Addresses

3 addresses

Deployer

0xc7db…8dee

Unlocked LP Held By

0x7966…e7640x2515…fbc0

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

4 factors

Owner can pause all transfers
Mintable supply — no cap found, dilution unbounded
Liquidity NOT locked (100% of the pool; this pool is 99% of DEX liquidity) — held by independent providers — market-depth risk
Top-10 concentration > 30% (91.2% total → 42.9% effective; 10.8% in EOAs, 80.4% in contracts; deployer/owner holds 26.3%)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Not Signed In

Is AltLayer Token Safe?

Security Findings

Who holds the supply

Owner Can Create New Tokens

Owner Can Stop All Token Transfers

Liquidity not locked

Identity verified by independent sources

The market for this token

Asset class: Governance token

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of AltLayer Token?