On-chain security analysis — is it a scam or legit?
SolanaThis audit identifies critical risks due to active Mint and Freeze authorities, both held by GySFHFS5ZiN4Z5YnyPZcjjxpYcGvD7qHZYVjE9QzMHVH, allowing for unlimited token minting and account freezing.
Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Holder balances as recorded by the audit of Sep 22, 2026
The 12 remaining pairs hold $913 between them and are not listed. The risk score reads depth across every pair.
Whether the LP tokens are locked could not be determined.
The mint authority is . The holder of this key can mint unlimited new tokens, diluting all current holders to zero value. (Fact: Mint Authority: )
Verify on-chain that the mint authority is set to null before treating supply as fixed.
Unresolved
The freeze authority is . The holder can freeze any holder's account, blocking transfers and effectively confiscating funds. (Fact: Freeze Authority: )
Avoid tokens whose freeze authority is not revoked unless the issuer is a regulated stablecoin operator.
Unresolved
Token name, symbol, or image can be changed post-launch. (Fact: metadata_mutable: True)
Verify metadata against off-chain expectations before trusting branding.
Unresolved
This audit identifies critical risks due to active Mint and Freeze authorities, both held by GySFHFS5ZiN4Z5YnyPZcjjxpYcGvD7qHZYVjE9QzMHVH, allowing for unlimited token minting and account freezing. Additionally, token metadata is mutable, enabling post-launch changes to branding. Holder distribution data was unavailable from chain-native RPC for a complete assessment of concentration risk.
The token is implemented using the classic spl-token program (v3). A critical concern is the active Mint Authority, , which allows for arbitrary increases in the token supply. Similarly, the Freeze Authority, also , retains the power to freeze any holder's tokens. The token has a supply of 999,999,845,429,209,969 with 9 decimals and does not utilize Token-2022 extensions like permanent delegates or transfer hooks. The balance_mutable and default_account_state_frozen flags are both false.
The token exhibits healthy market activity with a total DEX liquidity of $2,161,273 and a 24-hour volume of $813,689. The Volume/Liquidity Ratio is 0.38, indicating normal trading patterns, and the pair has been active for 109 days, suggesting a relatively established market presence. However, chain-native RPC data for holder concentration was unavailable, preventing a definitive assessment of supply distribution risk.
The Mint Authority and Freeze Authority remain active, allowing for potential future changes to the token's supply and the state of holder accounts. Additionally, the token's metadata is mutable, meaning its name, symbol, or image can be altered post-launch. There are no active Token-2022 specific upgradeable extensions such as transfer fee upgradability or transfer hook upgradability.
Before engaging with this token, holders should verify on-chain that the Mint Authority has been permanently revoked to ensure the token supply is fixed.
Similarly, confirm the Freeze Authority is nullified to prevent any potential confiscation of funds. It is also advisable to monitor the token's metadata for any unexpected alterations to its name, symbol, or image.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Backpack (BP) shows critical risk factors. The contract is unverified, lacking transparency for investors. A staggering 99.0% of supply is held by the top 10 wallets, indicating extreme centralization risk. Crucially, liquidity is not locked, posing a clear withdrawal risk. While ownership is renounced and new tokens cannot be minted, these combined factors contribute to its 'High Risk' assessment.
No, Backpack (BP) is not safe to buy, indicated by its High Risk score of 58/100. Core issues include its unverified contract, which lacks transparency for investors. A critical 99.0% of the supply is controlled by the top 10 holders, posing extreme centralization risk. Crucially, liquidity is not locked, meaning it can be withdrawn. These factors make it highly speculative and risky.
No, the Backpack (BP) contract is unverified. Its deployed code isn't publicly matched against source code. Therefore, an independent security audit cannot be publicly confirmed. This lack of transparency prevents investors from assessing the contract's safety, significantly contributing to its high-risk profile.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
