Is Chinese Digital Oil Fund (CDOF) Safe? Smart Contract Security Analysis

Security Findings

1 Info

Info

No code-level findings — an SPL mint exposes no auditable program source

I-01This token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on holder concentration, which are read directly from chain state and from third-party risk registries.

IssueThis token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on holder concentration, which are read directly from chain state and from third-party risk registries.

FixRead the risk score breakdown below as the substance of this audit. For a code-level review, the token would need an accompanying verified program.

StatusAcknowledged

Category Ratings

TechnicalMedium6/10

The Chinese Digital Oil Fund (CDOF) token is implemented using the classic `spl-token` program. Both the mint authority and freeze authority have been revoked, preventing further token minting or freezing of holder accounts. The token does not utilize advanced Token-2022 extensions such as balance mutability, default account freezing, or transfer hooks, as indicated by `balance_mutable: False`, `default_account_state_frozen: False`, and `transfer_hook_upgradable: False`.

GovernanceHigh2/10

The token exhibits moderate liquidity with $39,012 in total DEX liquidity, suggesting that large trades may experience some slippage. The 24-hour volume to liquidity ratio is 0.07, which is within normal parameters and does not indicate wash trading. The DEX pair has been active for 45 days, providing a reasonable track record. Holder concentration data was unavailable, preventing an assessment of supply distribution risk.

UpgradesMedium5/10

The token's core parameters are immutable, as both the mint authority and freeze authority have been permanently revoked. Metadata, including name and symbol, is also immutable, confirmed by `metadata_mutable: False`. The token uses the classic `spl-token` program and does not have upgradable features associated with Token-2022 extensions, such as upgradable transfer fees or transfer hooks.

Security Checklist

1/4 checks passed

Contract VerifiedFail

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

Liquidity Depth

$25.3K

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

7 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 20% (27.8% total → 27.8% effective; 27.8% in EOAs, 0.0% in contracts — mild)
Liquidity NOT locked (owner can withdraw — rug-pull risk)
Liquidity < $50k ($25,281 across 1 pairs — thin market)
Token age < 30 days (still settling)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is Chinese Digital Oil Fund Safe?