Is Derive (DRV) Safe? Smart Contract Security Analysis

Security Checklist

2/5 checks passed

Contract VerifiedPass

Ownership RenouncedFail

No Mint FunctionPass

Liquidity LockedFail

Not a ProxyFail

Audit History

2 audits on record

Jul 2347

Every audit run adds a dated snapshot — history is append-only and cannot be edited.

Audit Summary

The audit focused on the `TransparentUpgradeableProxy` contract. While the proxy itself is a standard, well-audited OpenZeppelin component, the overall system presents critical risks due to the unverified source code of its implementation contract and the unknown ownership structure of the `ProxyAdmin` contract that controls upgrades. These factors introduce significant technical, governance, and upgradeability concerns.

Final Recommendation: It is critical to verify the source code of the implementation contract (0x4909ad99441ea5311b90a94650c394cea4a881b8) to allow for a comprehensive security audit of its logic and functionality. Additionally, the ownership of the `ProxyAdmin` contract (0xaa7b17c2539437efa236fed262a5815358ae2cc3) should be publicly disclosed and ideally managed by a robust multi-signature wallet or a time-locked governance mechanism to mitigate centralization risks and enhance upgrade security.

Category Ratings

TechnicalMedium

6/10

The audited `TransparentUpgradeableProxy` contract (7.1 Architecture, 7.2 Code Security) utilizes the robust and well-audited OpenZeppelin transparent proxy pattern, effectively mitigating selector clashes. Its `_admin` variable is immutable, enhancing the proxy's internal security. However, a

GovernanceHigh

2/10

The governance and economic security (7.4 Economic, 7.5 Governance) of the system are severely impacted by the lack of transparency regarding the implementation contract and the `ProxyAdmin`'s ownership. The `ProxyAdmin` controls all upgrade capabilities, and without knowing if its owner is a r

UpgradesHigh

1/10

The system employs the Transparent Proxy pattern (7.7 Upgrades) for upgradeability, a standard and secure mechanism when properly managed. However, the upgrade process carries significant risks due to two primary factors. Firstly, the implementation contract is not source verified, meaning any futur

Proxy Upgrade Controls

Proxy TypeEip1967 Transparent

AdminOther-Contract

ImplementationVerified source

Upgrades (30d)0 · stable

LP Distribution

Top-1 Unlocked Holder100.0%

Top-3 Unlocked100.0%

What Raised This Score

9 factors

Ownership NOT renounced — strong Multisig (3-of-5)
Proxy contract (upgradeable — admin can replace logic)
Admin is unclassified contract
Top-10 concentration > 30% (88.1% total → 44.9% effective; 16.1% in EOAs, 72.0% in contracts — moderate)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 62% of DEX liquidity)
LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 62% of DEX liquidity)
1 Critical finding(s) from audit
1 High finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Findings

4 total

1 Critical 1 High 2 Info

C-01CriticalUnresolved

Unverified Implementation Contract Source Code

The proxy contract (0xb1d1eae60eea9525032a6dcb4c1ce336a1de71be) points to an implementation contract (0x4909ad99441ea5311b90a94650c394cea4a881b8) whose source code is not publicly verified on the blockchain explorer. This prevents any security analysis of the actual business logic, potential vulnerabilities (e.g., reentrancy, access control flaws, integer overflows), and economic implications of the system. Users and auditors cannot ascertain the contract's behavior or safety.

Recommendation: Immediately verify the source code of the implementation contract (0x4909ad99441ea5311b90a94650c394cea4a881b8) on the blockchain explorer. Once verified, a full audit of the implementation's logic should be conducted to identify and mitigate any vulnerabilities.

H-01HighUnresolved

Unknown/Unverified Ownership of ProxyAdmin Contract

The `TransparentUpgradeableProxy` deploys and relies on a `ProxyAdmin` contract (0xaa7b17c2539437efa236fed262a5815358ae2cc3) to manage upgrades. The ownership structure of this `ProxyAdmin` contract is not publicly verifiable or disclosed. If the owner is a single Externally Owned Account (EOA), it represents a single point of failure, making the entire system vulnerable to compromise if that EOA's private key is lost or stolen. This also centralizes control over all future upgrades.

Recommendation: Publicly disclose the ownership details of the `ProxyAdmin` contract. It is strongly recommended that the `ProxyAdmin`'s ownership be transferred to a robust multi-signature wallet (e.g., Gnosis Safe) with a sufficient threshold, or a time-locked governance contract, to enhance security, decentralize control, and provide a delay for critical operations.

I-01InformationalUnresolved

Use of Transparent Proxy Pattern

The contract utilizes the Transparent Proxy Pattern, a well-established and audited upgradeability pattern from OpenZeppelin. This pattern effectively prevents selector clashes between the proxy and the implementation contract for non-admin calls, ensuring predictable behavior and reducing potential attack vectors.

Recommendation: No specific recommendation. Continue to follow best practices for managing the `ProxyAdmin` and its ownership.

I-02InformationalUnresolved

Immutable Admin Address in Proxy

The `_admin` variable in the `TransparentUpgradeableProxy` contract is declared as `immutable`. This design choice ensures that the proxy's direct link to its `ProxyAdmin` cannot be changed after deployment, preventing unauthorized modifications to the admin address at the proxy level. This enhances the internal security and predictability of the proxy contract itself.

Recommendation: No specific recommendation. This is a good security practice for the proxy contract.

Is Derive Safe? DRV