Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Dolomite Safe?

DOLOEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical7/10Governance2/10Upgrades4/10Checks passed2 of 5Findings1 High · 3 Info4
SummaryAI Copilot

The DOLOWithOwnable contract is an ERC20Burnable token with an Ownable access control pattern.

Read the full analysis
What raised the score
  • Ownership not renounced — Multisig
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 50%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 High finding(s) from audit
Exact factors
  • Ownership NOT renounced — Multisig (2-of-3)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 50% (79.3% total → 59.4% effective; 46.1% in EOAs, 33.2% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 53% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 53% of DEX liquidity)
  • 1 High finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 42 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintMintable
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
33.2%Contracts46.1%Wallets20.7%Everyone else
33.2%Contracts46.1%Wallets20.7%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
79.3%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking33.2%
  • Walletsanonymous holders, free to sell46.1%
  • Everyone elsethe rest of the supply20.7%
Effective concentrationwhat the score reads59.4%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$354.3K across 3 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$188.2KShare of depth53.1%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x6e93…f682

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High3 Info
High

Centralized Unlimited Minting Capability

The DOLOWithOwnable contract grants the owner the ability to set and unset minters, and these minters can call the mint function to create an arbitrary amount of new tokens. This centralized control over token supply introduces a significant economic risk, as a compromised owner key or a malicious minter could lead to unlimited inflation, devaluing existing tokens.H-01

Issue

The DOLOWithOwnable contract grants the owner the ability to set and unset minters, and these minters can call the mint function to create an arbitrary amount of new tokens. This centralized control over token supply introduces a significant economic risk, as a compromised owner key or a malicious minter could lead to unlimited inflation, devaluing existing tokens.

Fix

Implement safeguards to limit the minting capability. This could include a hard cap on the total supply, a maximum mintable amount per period, or requiring a multi-signature approval or a timelock for minting operations. If unlimited minting is a core design choice, ensure the operational security of the owner and minter addresses is exceptionally high.

Status

Unresolved

Info

renounceOwnership Function Reverted

The renounceOwnership function is explicitly overridden to revert, preventing the owner from ever relinquishing ownership. This design choice ensures that the contract will always have an owner with the associated administrative privileges, including control over minting and setting the CCIP admin.I-01

Issue

The renounceOwnership function is explicitly overridden to revert, preventing the owner from ever relinquishing ownership. This design choice ensures that the contract will always have an owner with the associated administrative privileges, including control over minting and setting the CCIP admin.

Fix

Acknowledge this design choice. If future decentralization or transfer of ownership to a DAO is desired, this design would require a new contract deployment. Ensure the implications of permanent ownership are well understood and documented.

Status

Unresolved

Info

Minter Must Be a Contract

The _ownerSetMinter function includes a Require.that(_minter.isContract(), ...) check, enforcing that only smart contract addresses can be designated as minters. This prevents Externally Owned Accounts (EOAs) from directly holding minting privileges.I-02

Issue

The _ownerSetMinter function includes a Require.that(_minter.isContract(), ...) check, enforcing that only smart contract addresses can be designated as minters. This prevents Externally Owned Accounts (EOAs) from directly holding minting privileges.

Fix

Document the rationale behind this design choice. Ensure that any contract designated as a minter is thoroughly audited and secured, as its compromise would directly impact the token's supply. This design can be beneficial for integrating with governance or timelock contracts.

Status

Unresolved

Info

Undefined _ccipAdmin Role Functionality

The contract defines a _ccipAdmin state variable and functions (ownerSetCCIPAdmin, getCCIPAdmin) to manage it. However, the provided contract code does not implement any logic that utilizes this _ccipAdmin role. This suggests that its functionality is intended for external integration or future development.I-03

Issue

The contract defines a _ccipAdmin state variable and functions (ownerSetCCIPAdmin, getCCIPAdmin) to manage it. However, the provided contract code does not implement any logic that utilizes this _ccipAdmin role. This suggests that its functionality is intended for external integration or future development.

Fix

Clearly document the intended purpose and responsibilities of the _ccipAdmin role. If this role interacts with external systems or contracts, ensure those integrations are secure and that the _ccipAdmin address is managed with the highest security standards.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The DOLOWithOwnable contract is an ERC20Burnable token with an Ownable access control pattern. It includes a centralized minting mechanism controlled by the contract owner, who can designate minter addresses. The contract leverages OpenZeppelin libraries for standard token functionality and access control, along with a custom 'Require' library for assertions. While code quality is generally good, the significant power vested in the owner, particularly regarding token minting, introduces a high economic risk.

Technical7/10Low risk

The contract demonstrates good code security practices (7.2) by inheriting from battle-tested OpenZeppelin ERC20, ERC20Burnable, and Ownable contracts. It uses Solidity 0.8.9+, mitigating common integer overflow/underflow risks. Custom Require library usage is consistent. However, the centralized minting function, accessible via onlyMinter modifier, presents a technical risk if the minter's keys are compromised or if the minter contract has vulnerabilities. The _transfer and _approve functions include checks to prevent tokens from being sent to or approved by the contract itself, which is a good practice.

Governance2/10High risk

The economic model (7.4) of the DOLO token is highly centralized, with the contract owner having the ability to grant unlimited minting power to designated minters. This introduces a significant economic risk due to potential for inflation or malicious minting. The initial supply of 1 billion DOLO tokens is minted directly to the owner, concentrating a large portion of the supply. While the owner is a multisig (7.5), which enhances security over a single EOA, the inherent power of the owner role remains substantial. The renounceOwnership function is explicitly reverted, meaning ownership cannot be relinquished, permanently vesting control in the current owner.

Upgrades4/10Medium risk

The DOLOWithOwnable contract is not designed with an upgrade mechanism (7.7), meaning its logic is immutable once deployed. This simplifies the architecture and removes upgrade-related risks such as proxy misconfigurations or malicious upgrade implementations. Any future changes to the token's logic would require a new deployment and migration of assets, which is a common approach for standard ERC20 tokens.

Final RecommendationWhat to do about this score

It is crucial to implement robust operational security measures for the owner's multisig and any designated minter contracts, given the significant power over token supply.

Consider introducing mechanisms to limit the minting capability, such as a maximum total supply, a per-period minting cap, or a timelock for minting operations, to mitigate the economic risks associated with centralized minting. Thoroughly audit any external contracts designated as minters or CCIP admins.

Contract & Record

1 audit on record
TypeToken
NetworkEthereum
Token age1y
Contract0x0f81…a654
Deployer0x4427…9e85
Badge for your website
Dolomite security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202662Medium
  2. Aug 16, 202642Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
SEIEthereum62MediumRedstoneRED · Ethereum62MediumPinLinkPIN · Ethereum62MediumFuse CatFUSECAT · Ethereum62MediumEtherStreetSTREET · Ethereum62MediumCONDOEthereum62Medium

Would You Like a More Detailed Audit of Dolomite?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page