Is Dexe Safe? Smart Contract Security Analysis

Security Checklist

1/5 checks passed

Contract VerifiedPass

Ownership RenouncedFail

No Mint FunctionFail

Liquidity LockedFail

Not a ProxyFail

Audit History

2 audits on record

Jul 2251Jul 2376

Every audit run adds a dated snapshot — history is append-only and cannot be edited.

Audit Summary

This audit report covers the provided OpenZeppelin utility libraries (`StorageSlot` and `Address`) and general observations regarding the Beacon proxy structure for the BridgeToken protocol. The core business logic for the `BridgeToken` and its `TokenImplementation` was not provided, limiting the scope of this audit. A key concern identified is the unverified administration of the Beacon contract, which controls the upgrade path for all associated proxies.

Final Recommendation: It is critical to ensure that the Beacon contract's administrator is secured with robust access control mechanisms, ideally a multi-signature wallet or a time-locked governance contract. Provide the full source code for the `BridgeToken` and its `TokenImplementation` contracts, along with the Beacon contract, for a comprehensive security audit. This will allow for a thorough review of the core business logic, access control, economic model, and the complete upgradeability architecture.

Category Ratings

TechnicalMedium

6/10

The provided code consists of OpenZeppelin's `StorageSlot` and `Address` libraries (7.2 Code Security). These libraries are widely used, well-audited, and adhere to high security standards, providing robust utilities for storage management and safe address interactions. No direct vulnerabilitie

GovernanceHigh

1/10

The economic and governance aspects of the `BridgeToken`'s core functionality could not be assessed due to the absence of its source code (7.4 Economic, 7.5 Governance). However, the identified Beacon proxy pattern introduces a critical governance component: the Beacon contract's administr

UpgradesHigh

1/10

The protocol utilizes a Beacon proxy pattern, allowing for efficient upgrades of multiple proxy instances through a single Beacon contract (7.7 Upgrades). While this pattern is robust, the security of the Beacon contract's administrator is paramount, as this entity controls which implementation

Proxy Upgrade Controls

Proxy TypeBeacon

ImplementationVerified source

LP Distribution

Top-1 Unlocked Holder98.0%

Top-3 Unlocked100.0%

What Raised This Score

11 factors

Ownership NOT renounced — owner is a contract (governance/executor, not an EOA)
Mintable supply — no cap found, dilution unbounded
Proxy contract (upgradeable — admin can replace logic)
Complex proxy pattern (BEACON)
Top-10 concentration > 30% (96.0% total → 44.7% effective; 10.6% in EOAs, 85.4% in contracts — moderate)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
Liquidity < $10k ($3,970 across 6 pairs — easily drained)
LP top1 unlocked holder = 98.0% (independent LP — depth risk, pool = 98% of DEX liquidity)
LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 98% of DEX liquidity)
1 Medium finding(s) from audit
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Findings

4 total

1 Medium 1 Low 2 Info

M-01MediumUnresolved

Unverified Beacon Admin Control

The audit notes indicate that the administrator for the Beacon contract (0xb6f6d86a8f9879a9c87f643768d9efc38c1da6e7), which dictates the implementation address for all associated proxies, could not be classified. For a Beacon proxy system, the security of the Beacon's admin is paramount. An unmanaged, single-point-of-failure, or compromised Beacon admin could lead to unauthorized upgrades, potentially deploying malicious contract logic and compromising user funds or protocol integrity.

Recommendation: Provide the source code for the Beacon contract and clarify its administrative control mechanisms. It is strongly recommended that the Beacon's admin be secured by a robust multi-signature wallet (e.g., Gnosis Safe) or a time-locked governance contract to prevent single points of failure and provide a delay for critical changes.

L-01LowUnresolved

Core Contract Logic Not Provided for Audit

The primary business logic for the `BridgeToken` (proxy) and its `TokenImplementation` (implementation) contracts was not provided for review. This audit is therefore limited to the provided OpenZeppelin libraries and general observations about the proxy structure. A comprehensive security assessment of the protocol's specific functionalities, access control, economic model, and potential vulnerabilities (e.g., reentrancy, integer overflows) cannot be performed without the full source code.

Recommendation: Provide the complete source code for all contracts comprising the BridgeToken protocol, including the `BridgeToken` proxy, `TokenImplementation`, and the Beacon contract, for a full and thorough security audit. This will enable a detailed analysis of the entire system's security posture.

I-01InformationalUnresolved

Standard Library Usage

The provided contract code utilizes well-audited and widely adopted OpenZeppelin libraries (`StorageSlot.sol` and `Address.sol`). These libraries are known for their high quality, security, and adherence to best practices in smart contract development. Their inclusion contributes positively to the overall code reliability.

Recommendation: Continue to leverage well-vetted and community-audited libraries like OpenZeppelin to reduce the risk of introducing common vulnerabilities. Ensure that the specific versions used are up-to-date and free from known exploits.

I-02InformationalUnresolved

Beacon Proxy Pattern Identified

The contract at 0x6e88056e8376ae7709496ba64d37fa2f8015ce3e is identified as a Beacon proxy, delegating its logic to an implementation contract (0x7f8c5e730121657e17e452c5a1ba3fa1ef96f22a) via a Beacon contract (0xb6f6d86a8f9879a9c87f643768d9efc38c1da6e7). This pattern allows multiple proxies to share and upgrade their implementation logic through a single Beacon, promoting efficiency and consistency.

Recommendation: Ensure that the Beacon proxy pattern is fully understood and correctly implemented across all associated contracts. Pay close attention to the security of the Beacon contract itself, as it is a central point of control for upgrades.

Is Dexe Safe? DEXE