Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Dimo Safe?

DIMOPolygon
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Nov 1, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical5/10Governance1/10Upgrades1/10Checks passed3 of 7Findings1 Critical · 3 Medium · 4 Info8
SummaryAI Copilot

The Dimo token is an upgradeable ERC-20 implementation utilizing the UUPS proxy pattern.

Read the full analysis
What raised the score
  • Owner can pause all transfers
  • Mintable supply — no cap found, dilution unbounded
  • Upgradeable proxy — the admin can replace the logic
  • Ownership status UNKNOWN
  • Liquidity not locked
  • Liquidity < $50k
  • Top-10 concentration > 20%
  • Code: Unprotected Implementation Initialization
Exact factors
  • Owner can pause all transfers
  • Mintable supply — no cap found, dilution unbounded
  • Upgradeable proxy — the admin can replace the logic
  • Ownership status UNKNOWN (owner could not be resolved)
  • Liquidity NOT locked (100% of the pool; this pool is 90% of DEX liquidity) — held by independent providers — market-depth risk
  • Liquidity < $50k ($35,383 across 27 pairs — thin market)
  • Top-10 concentration > 20% (55.0% total → 22.0% effective; 0.0% in EOAs, 55.0% in contracts)
  • Code: Unprotected Implementation Initialization (Critical, static analysis)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Nov 13 of 7 checks passed
Contract verifiedVerified
OwnershipUnknown
MintMintable
Liquidity lockNot locked
UpgradeabilityUpgradeable
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Nov 1, 202680,213 holders
55.0%Contracts45.0%Everyone else
55.0%Contracts45.0%Everyone else
ContractsEveryone elseBubble area = share of supply
55.0%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking55.0%
  • Everyone else80,203 holders45.0%
Effective concentrationwhat the score reads22.0%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Nov 1, 2026

Liquidity

as of audit · Nov 1$35.4K across 27 pairs
Show 4 more pairs

The 17 remaining pairs hold $12 between them and are not listed. The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$31.8KShare of depth90.0%
Top-1 Unlocked Holder46.4%
Top-3 Unlocked76.1%
Unlocked LP held by
0x4bc2…b3040xebf4…a4f60xbcfe…dff70x3245…1d110x0360…ea680x009d…049b0x1983…aac20x75ae…7f0e0x865f…86dc0xe956…5511

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Critical3 Medium4 Info
Critical

Unprotected Implementation Initialization

The implementation contract lacks an initialization guard, allowing any user to call the initialize function and potentially take control of the logic contract.CD-01

Issue

The implementation contract lacks an initialization guard, allowing any user to call the initialize function and potentially take control of the logic contract.

Fix

Add a constructor that calls _disableInitializers() to prevent the implementation contract from being initialized.

Status

Unresolved

Medium

Centralized Minting Authority

Privileged addresses with the MINTER_ROLE or DEPOSITOR_ROLE can mint an unlimited number of tokens, which can dilute the value of existing holdings.CP-01

Issue

Privileged addresses with the MINTER_ROLE or DEPOSITOR_ROLE can mint an unlimited number of tokens, which can dilute the value of existing holdings.

Fix

Restrict minting capabilities to a time-locked governance contract or a multi-sig wallet.

Status

Unresolved

Medium

Centralized Pause Control

Addresses with the PAUSER_ROLE can pause all token transfers, effectively freezing user liquidity at will.CP-04

Issue

Addresses with the PAUSER_ROLE can pause all token transfers, effectively freezing user liquidity at will.

Fix

Implement a multi-sig requirement for pausing or remove the pause functionality if not strictly required for emergency response.

Status

Unresolved

Medium

Liquidity not locked

0.0% of the pool's LP is burned or time-locked. 96.0% is held, unlocked, by 10 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 90% of the token's DEX liquidity; the other pools were not assessed.QA-LIQUIDITY

Issue

0.0% of the pool's LP is burned or time-locked. 96.0% is held, unlocked, by 10 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 90% of the token's DEX liquidity; the other pools were not assessed.

Fix

Check the lock's end date and beneficiary on the locker's own page before relying on it.

Status

Acknowledged

Info

Who holds the supply

The ten largest holders own 55.0% of supply. What remains: 0.0% in wallets, 55.0% in other contracts. 80,213 holders in total.QA-HOLDERS

Issue

The ten largest holders own 55.0% of supply. What remains: 0.0% in wallets, 55.0% in other contracts. 80,213 holders in total.

Fix

Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

Status

Acknowledged

Info

Identity verified by independent sources

Listed on CoinGecko as DIMO (DIMO), market cap $10M, rank #1225. 80,213 holders. Verified by: CoinGecko.QA-IDENTITY

Issue

Listed on CoinGecko as DIMO (DIMO), market cap $10M, rank #1225. 80,213 holders. Verified by: CoinGecko.

Fix

Match the contract address against the project's official channels before trading.

Status

Acknowledged

Info

The market for this token

Liquidity $35K (DexScreener, all pools). 24h trading volume $1.7M (CoinGecko, all markets, daily snapshot). 24h trading volume $39K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.786 on 2023-12-18; the price is now 96.9463% below it.QA-MARKET

Issue

Liquidity $35K (DexScreener, all pools). 24h trading volume $1.7M (CoinGecko, all markets, daily snapshot). 24h trading volume $39K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.786 on 2023-12-18; the price is now 96.9463% below it.

Fix

Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

Status

Acknowledged

Info

Asset class: Governance token

A token whose main use is voting on a protocol's decisions (delegation and vote checkpoints in its code). The class itself adds no points; the contract and market facts decide the score. Basis: vote delegation in its code. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $35K of DEX liquidity across 27 pools. Launch: 1419 days of market history.QA-PROFILE

Issue

A token whose main use is voting on a protocol's decisions (delegation and vote checkpoints in its code). The class itself adds no points; the contract and market facts decide the score. Basis: vote delegation in its code. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $35K of DEX liquidity across 27 pools. Launch: 1419 days of market history.

Fix

Check how much of the voting supply insiders hold and what governance can change.

Status

Acknowledged

Analysis

AI Copilotas of audit · Nov 1
Executive SummaryWhat the contract is and what the review found

The Dimo token is an upgradeable ERC-20 implementation utilizing the UUPS proxy pattern. While the contract leverages standard OpenZeppelin libraries for security, it contains a critical vulnerability regarding the initialization of the implementation contract and significant centralization risks via privileged roles. 7.1 Architecture: UUPS Proxy. 7.2 Code Security: Critical initialization flaw. 7.3 Access Control: High centralization. 7.4 Economic: Minting capabilities. 7.5 Governance: Voting enabled. 7.6 External: Standard ERC-20. 7.7 Upgrades: UUPS enabled. 7.8 Operations: Pausable.

Technical5/10Medium risk

The codebase utilizes well-vetted OpenZeppelin libraries for core functionality. The implementation of UUPS proxy patterns is standard, though the lack of initialization protection on the implementation contract is a significant oversight. The contract correctly implements ERC-20, ERC-20Permit, and ERC-20Votes standards.

Governance1/10High risk

The token economy is heavily centralized, with privileged roles capable of minting tokens and pausing transfers. These roles allow for arbitrary supply inflation and total liquidity freezing. Governance is supported via ERC-20Votes, allowing for on-chain voting if integrated with a DAO framework.

Upgrades1/10High risk

The contract uses the UUPS upgradeable pattern, which is generally safer than Transparent proxies. However, the implementation contract is not initialized, allowing an attacker to potentially take control of the logic contract. Future upgrades should be managed through a secure multi-sig or DAO.

Final RecommendationWhat to do about this score

Immediately initialize the implementation contract to prevent unauthorized takeover.

Transition privileged roles (MINTER, PAUSER) to a multi-signature wallet or a decentralized governance contract to mitigate centralization risks.

Contract & Record

1 audit on record
TypeERC1967Proxy
NetworkPolygon
Token age3y
Contract0xe261…61db
Deployer0x55f5…2ffd
Proxy Upgrade Controls
Proxy TypeEip1967 Uups
ImplementationVerified source
Upgrades (30d)0 · stable
Badge for your website
Dimo security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Nov 1, 202672High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
ChatApex AICAAI · Polygon73HighROUTINE COINROU · Polygon74HigheUSDPolygon69HighElevateFiEFI · Polygon75HighFortaFORT · Polygon68HighVikasa NetworkVIK · Polygon76High

Would You Like a More Detailed Audit of Dimo?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Add your links and get it Verified