Is doginme Safe? Smart Contract Security Analysis

Security Findings

1 Low1 Info

Low

Lack of Emergency Control Mechanisms

L-01The `ERC20` implementation does not include common emergency control mechanisms such as pausability or blacklisting. In the event of a critical vulnerability, exploit, or regulatory requirement, there is no built-in way to halt transfers or freeze malicious accounts (7.8 Operations). While this design choice promotes immutability and censorship resistance, it limits the project's ability to respond to unforeseen circumstances or mitigate severe exploits.

IssueThe `ERC20` implementation does not include common emergency control mechanisms such as pausability or blacklisting. In the event of a critical vulnerability, exploit, or regulatory requirement, there is no built-in way to halt transfers or freeze malicious accounts (7.8 Operations). While this design choice promotes immutability and censorship resistance, it limits the project's ability to respond to unforeseen circumstances or mitigate severe exploits.

FixEvaluate the project's risk profile and potential need for emergency controls. If such mechanisms are deemed necessary, consider integrating battle-tested libraries like OpenZeppelin's `Pausable` or `AccessControl` contracts. Implement these features carefully, ensuring that control is vested in a secure, multi-signature wallet or a robust governance process to prevent abuse.

StatusUnresolved

Info

Centralized Initial Token Supply

I-01All 69,000,000,000 tokens are minted to the contract deployer (`msg.sender`) during the `doginme` contract's construction. This design choice results in a highly centralized initial distribution, giving the deployer complete control over the entire token supply. While not a technical vulnerability in the code itself, this represents a significant economic and governance risk (7.4, 7.5) if the project aims for decentralization or broad community participation. The deployer could potentially manipulate market prices or control voting power if the token were used in a governance system.

IssueAll 69,000,000,000 tokens are minted to the contract deployer (`msg.sender`) during the `doginme` contract's construction. This design choice results in a highly centralized initial distribution, giving the deployer complete control over the entire token supply. While not a technical vulnerability in the code itself, this represents a significant economic and governance risk (7.4, 7.5) if the project aims for decentralization or broad community participation. The deployer could potentially manipulate market prices or control voting power if the token were used in a governance system.

FixIf decentralization is a goal, consider implementing a more distributed initial token supply. This could involve a multi-sig wallet for the initial supply, a vesting schedule, or a public sale/airdrop mechanism to distribute tokens more broadly from the outset. Clearly communicate this distribution strategy to the community.

StatusUnresolved

Category Ratings

TechnicalLow10/10

The technical architecture (7.1) is a straightforward ERC20 token, inheriting from a custom base. Code security (7.2) is robust; `unchecked` blocks are correctly preceded by `require` statements, preventing integer underflows. Access control (7.3) is standard for ERC20, with no special roles beyond the initial deployer. The contract avoids complex external interactions, mitigating reentrancy and other common attack vectors. Overall, the implementation is clean and adheres to secure coding practices.

GovernanceMedium5/10

The economic model (7.4) involves minting the entire token supply (69 billion tokens) to the contract deployer during construction. This results in a highly centralized initial distribution, giving the deployer complete control over the token's initial supply and market dynamics. There are no explicit governance mechanisms (7.5) beyond this initial distribution. This centralization is a significant factor for the project's long-term decentralization goals and potential for manipulation.

UpgradesLow7/10

The contract is not designed with any upgradeability patterns (7.7), such as proxy contracts. This means its logic is immutable once deployed. While this eliminates upgrade-related risks, any future changes would require a new contract deployment and migration.

Security Checklist

4/5 checks passed

Contract VerifiedPass

Ownership Renounced?

No Mint FunctionPass

Liquidity LockedPass

Not a ProxyPass

Holder Composition

50.2% in top 10

39.8% in wallets10.3% in contracts

Effective Concentration44.0%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$1.51M across 15 pairs

Uniswap v3WETHanalysed$1.38M AerodromeWETH$93.3K AerodromeWETH$30.6K Uniswap v4AIOCTO$2.9K BaseswapWETH$307 Uniswap v3WETH$126

Show 4 more pairsShow less

Uniswap v4MIGGLES$74 InfusionWETH$68 AerodromeUSDC$51 AerodromeAERO$50

The 5 remaining pairs hold $65 between them and are not listed.

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

LP Burned94.5%

LP Locked94.5% · Dead Address

Key Addresses

10 addresses

Deployer

0x3308…ee2d

Unlocked LP Held By

0x5cc4…d4c50xb282…3ae90x8354…2bfe0x4365…30750x5b0d…74cc0xaa6f…3f9d0xc873…88a60x1782…fa9b0x27ca…9e29

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

3 factors

Ownership status UNKNOWN (owner could not be resolved)
Top-10 concentration > 30% (50.2% total → 44.0% effective; 39.8% in EOAs, 10.3% in contracts — moderate)
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is doginme Safe?