Quantum Audit Logo

Is Backpack Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

Backpack BP
BPxxfR…jPCy
Solana Not verifiedLast checked 2d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Critical Risk
Executive SummaryAI Copilot

This audit identifies critical risks due to active Mint and Freeze authorities, both held by `GySFHFS5ZiN4Z5YnyPZcjjxpYcGvD7qHZYVjE9QzMHVH`, allowing for unlimited token minting and account freezing. Additionally, token metadata is mutable, enabling post-launch changes to branding. Holder distribution data was unavailable from chain-native RPC for a complete assessment of concentration risk.

2 Critical1 Low
Volume 24h
$857.0K
Liquidity
$1.97M
Price
$0.4324
Token Age
2mo
Top 10 Holders
98.7%

Security Findings

2 Crit1 Low
Critical

Mint Authority Not Revoked

C-01The mint authority is GySFHF…MHVH. The holder of this key can mint unlimited new tokens, diluting all current holders to zero value. (Fact: Mint Authority: GySFHF…MHVH)
IssueThe mint authority is . The holder of this key can mint unlimited new tokens, diluting all current holders to zero value. (Fact: Mint Authority: )
FixVerify on-chain that the mint authority is set to null before treating supply as fixed.
StatusUnresolved
Critical

Freeze Authority Not Revoked

C-02The freeze authority is GySFHF…MHVH. The holder can freeze any holder's account, blocking transfers and effectively confiscating funds. (Fact: Freeze Authority: GySFHF…MHVH)
IssueThe freeze authority is . The holder can freeze any holder's account, blocking transfers and effectively confiscating funds. (Fact: Freeze Authority: )
FixAvoid tokens whose freeze authority is not revoked unless the issuer is a regulated stablecoin operator.
StatusUnresolved
Low

Mutable Metadata

L-01Token name, symbol, or image can be changed post-launch. (Fact: metadata_mutable: True)
IssueToken name, symbol, or image can be changed post-launch. (Fact: metadata_mutable: True)
FixVerify metadata against off-chain expectations before trusting branding.
StatusUnresolved

Category Ratings

TechnicalHigh2/10

The token is implemented using the classic `spl-token` program (v3). A critical concern is the active Mint Authority, , which allows for arbitrary increases in the token supply. Similarly, the Freeze Authority, also , retains the power to freeze any holder's tokens. The token has a supply of 999,999,845,429,209,969 with 9 decimals and does not utilize Token-2022 extensions like permanent delegates or transfer hooks. The `balance_mutable` and `default_account_state_frozen` flags are both false.

GovernanceHigh1/10

The token exhibits healthy market activity with a total DEX liquidity of $2,161,273 and a 24-hour volume of $813,689. The Volume/Liquidity Ratio is 0.38, indicating normal trading patterns, and the pair has been active for 109 days, suggesting a relatively established market presence. However, chain-native RPC data for holder concentration was unavailable, preventing a definitive assessment of supply distribution risk.

UpgradesHigh3/10

The Mint Authority and Freeze Authority remain active, allowing for potential future changes to the token's supply and the state of holder accounts. Additionally, the token's metadata is mutable, meaning its name, symbol, or image can be altered post-launch. There are no active Token-2022 specific upgradeable extensions such as transfer fee upgradability or transfer hook upgradability.

Security Checklist

1/4 checks passed
Contract VerifiedFail
No Mint Function?
Liquidity LockedFail
Not a ProxyPass

Liquidity Depth

$2.02M across 13 pairs
Meteora DLMMUSDCanalysed$1.97M97.6%Meteora DLMMSOL$38.4K1.9%Meteora DLMMUSDC$5.8K0.3%Raydium CLMMUSDC$2.1K0.1%Meteora DLMMUSDC$7020.0%Raydium CLMMSOL$3150.0%
Show 4 more pairsShow less
Orca wpSOL$2430.0%Meteora DYN2WSK$1830.0%Orca wpUSDC$1670.0%Meteora DYN2JTO$780.0%

The 3 remaining pairs hold $39 between them and are not listed.

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

7 factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mint capability UNKNOWN (implementation ABI unreadable)
  • Contract source NOT verified
  • Top-10 concentration > 70% (98.7% total → 98.7% effective; 98.7% in EOAs, 0.0% in contracts — extreme)
  • Liquidity NOT locked (owner can withdraw — rug-pull risk)
  • 2 Critical finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Frequently Asked Questions

Is Backpack a scam?

Backpack (BP) shows critical risk factors. The contract is unverified, lacking transparency for investors. A staggering 99.0% of supply is held by the top 10 wallets, indicating extreme centralization risk. Crucially, liquidity is not locked, posing a clear withdrawal risk. While ownership is renounced and new tokens cannot be minted, these combined factors contribute to its 'High Risk' assessment.

Is Backpack safe to buy?

No, Backpack (BP) is not safe to buy, indicated by its High Risk score of 58/100. Core issues include its unverified contract, which lacks transparency for investors. A critical 99.0% of the supply is controlled by the top 10 holders, posing extreme centralization risk. Crucially, liquidity is not locked, meaning it can be withdrawn. These factors make it highly speculative and risky.

Has Backpack been audited?

No, the Backpack (BP) contract is unverified. Its deployed code isn't publicly matched against source code. Therefore, an independent security audit cannot be publicly confirmed. This lack of transparency prevents investors from assessing the contract's safety, significantly contributing to its high-risk profile.

Related Audits

6 more on the record
Cash Cat (CASHCAT)Critical RiskNO ONE CARES (KIM)Critical RiskMoon Doge Coin (MOONDOGECOIN)Critical RiskNVIDIA xStock (NVDAX)Critical RiskZazuCritical RiskCircle xStock (CRCLX)Critical Risk

Would You Like a More Detailed Audit of Backpack?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit