Is Backpack (BP) Safe? Smart Contract Security Analysis

Security Checklist

1/5 checks passed

Contract VerifiedFail

Ownership RenouncedUnknown

No Mint FunctionUnknown

Liquidity LockedFail

Not a ProxyPass

Audit History

2 audits on record

Jul 23100

Every audit run adds a dated snapshot — history is append-only and cannot be edited.

Audit Summary

This audit identifies critical risks due to active Mint and Freeze authorities, both held by `GySFHFS5ZiN4Z5YnyPZcjjxpYcGvD7qHZYVjE9QzMHVH`, allowing for unlimited token minting and account freezing. Additionally, token metadata is mutable, enabling post-launch changes to branding. Holder distribution data was unavailable from chain-native RPC for a complete assessment of concentration risk.

Final Recommendation: Before engaging with this token, holders should verify on-chain that the Mint Authority has been permanently revoked to ensure the token supply is fixed. Similarly, confirm the Freeze Authority is nullified to prevent any potential confiscation of funds. It is also advisable to monitor the token's metadata for any unexpected alterations to its name, symbol, or image.

Category Ratings

TechnicalHigh

2/10

The token is implemented using the classic `spl-token` program (v3). A critical concern is the active Mint Authority, `GySFHFS5ZiN4Z5YnyPZcjjxpYcGvD7qHZYVjE9QzMHVH`, which allows for arbitrary increases in the token supply. Similarly, the Freeze Authority, also `GySFHFS5ZiN4Z5YnyPZcjjxpYcGvD7qHZYVjE

GovernanceHigh

1/10

The token exhibits healthy market activity with a total DEX liquidity of $2,161,273 and a 24-hour volume of $813,689. The Volume/Liquidity Ratio is 0.38, indicating normal trading patterns, and the pair has been active for 109 days, suggesting a relatively established market presence. However, chain

UpgradesHigh

3/10

The Mint Authority and Freeze Authority remain active, allowing for potential future changes to the token's supply and the state of holder accounts. Additionally, the token's metadata is mutable, meaning its name, symbol, or image can be altered post-launch. There are no active Token-2022

What Raised This Score

7 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 70% (98.6% total → 98.6% effective; 98.6% in EOAs, 0.0% in contracts — extreme)
Liquidity NOT locked (owner can withdraw — rug-pull risk)
2 Critical finding(s) from audit
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Findings

3 total

2 Critical 1 Low

C-01CriticalUnresolved

Mint Authority Not Revoked

The mint authority is GySFHFS5ZiN4Z5YnyPZcjjxpYcGvD7qHZYVjE9QzMHVH. The holder of this key can mint unlimited new tokens, diluting all current holders to zero value. (Fact: Mint Authority: GySFHFS5ZiN4Z5YnyPZcjjxpYcGvD7qHZYVjE9QzMHVH)

Recommendation: Verify on-chain that the mint authority is set to null before treating supply as fixed.

C-02CriticalUnresolved

Freeze Authority Not Revoked

The freeze authority is GySFHFS5ZiN4Z5YnyPZcjjxpYcGvD7qHZYVjE9QzMHVH. The holder can freeze any holder's account, blocking transfers and effectively confiscating funds. (Fact: Freeze Authority: GySFHFS5ZiN4Z5YnyPZcjjxpYcGvD7qHZYVjE9QzMHVH)

Recommendation: Avoid tokens whose freeze authority is not revoked unless the issuer is a regulated stablecoin operator.

L-01LowUnresolved

Mutable Metadata

Token name, symbol, or image can be changed post-launch. (Fact: metadata_mutable: True)

Recommendation: Verify metadata against off-chain expectations before trusting branding.

Frequently Asked Questions

Is Backpack a scam?

Backpack (BP) shows critical risk factors. The contract is unverified, lacking transparency for investors. A staggering 99.0% of supply is held by the top 10 wallets, indicating extreme centralization risk. Crucially, liquidity is not locked, posing a clear withdrawal risk. While ownership is renounced and new tokens cannot be minted, these combined factors contribute to its 'High Risk' assessment.

Is Backpack safe to buy?

No, Backpack (BP) is not safe to buy, indicated by its High Risk score of 58/100. Core issues include its unverified contract, which lacks transparency for investors. A critical 99.0% of the supply is controlled by the top 10 holders, posing extreme centralization risk. Crucially, liquidity is not locked, meaning it can be withdrawn. These factors make it highly speculative and risky.

Has Backpack been audited?

No, the Backpack (BP) contract is unverified. Its deployed code isn't publicly matched against source code. Therefore, an independent security audit cannot be publicly confirmed. This lack of transparency prevents investors from assessing the contract's safety, significantly contributing to its high-risk profile.

Is Backpack Safe? BP