Is Avici Safe? Smart Contract Security Analysis

Security Findings

1 Crit1 Low

Critical

Mint Authority Not Revoked

C-01The mint authority is DGgYoU…622G. The holder of this key can mint unlimited new tokens, diluting all current holders to zero value.

IssueThe mint authority is . The holder of this key can mint unlimited new tokens, diluting all current holders to zero value.

FixVerify on-chain that the mint authority is set to null before treating supply as fixed.

StatusUnresolved

Low

Mutable Metadata

L-01Token name, symbol, or image can be changed post-launch, as indicated by `metadata_mutable: True`.

IssueToken name, symbol, or image can be changed post-launch, as indicated by `metadata_mutable: True`.

FixVerify metadata against off-chain expectations before trusting branding.

StatusUnresolved

Category Ratings

TechnicalMedium4/10

The Avici token is an SPL token operating under the `spl-token` program (v3). A significant technical risk is the active mint authority, held by , which enables the creation of new tokens at any time. Conversely, the freeze authority has been revoked, meaning no holder accounts can be frozen. The token has a total supply of 12,899,509.461254 with 6 decimals and does not utilize any Token-2022 extensions such as permanent delegates, transfer hooks, or default frozen account states, as indicated by `balance_mutable: False`, `freezable: False`, and `default_account_state_frozen: False` flags.

GovernanceHigh1/10

The token exhibits relatively healthy DEX market conditions with a liquidity of $1,457,920 USD and a 24-hour volume of $459,103 USD. The Volume/Liquidity Ratio is 0.31, which is normal and does not suggest wash trading. The DEX pair has been active for 315 days, indicating an established market presence. Holder concentration shows the top 10 token accounts collectively hold 42.88% of the supply, which is below the threshold for high concentration but still represents a notable portion.

UpgradesMedium4/10

The primary upgradeability concern is the active mint authority at , which retains the power to increase the token supply. In contrast, the freeze authority has been permanently revoked, preventing any future freezing of token accounts. The token's metadata is mutable (`metadata_mutable: True`), allowing for changes to its name, symbol, or image after launch. As this is a classic SPL token, it does not feature Token-2022 specific upgradeability flags like `transfer_fee_upgradable` or `transfer_hook_upgradable`.

Security Checklist

1/4 checks passed

Contract VerifiedFail

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Liquidity Depth

$1.67M across 20 pairs

MetadaoUSDCanalysed$1.29M Meteora DYN2USDC$315.3K Meteora DLMMUSDC$37.4K Meteora DLMMUSDC$15.0K Meteora DLMMSOLO$14.8K Raydium CLMMDOBBY$384

Show 4 more pairsShow less

Meteora DLMMSOL$250 Meteora DYN2USDC$170 Meteora DYN2USDC$169 Meteora DYN2USDC$166

The 10 remaining pairs hold $235 between them and are not listed.

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

7 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 30% (45.5% total → 45.5% effective; 45.5% in EOAs, 0.0% in contracts — moderate)
Liquidity NOT locked (owner can withdraw — rug-pull risk)
1 Critical finding(s) from audit
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is Avici Safe?