Is Grass Safe? Smart Contract Security Analysis

Security Findings

1 Crit1 Low

Critical

Mint Authority Not Revoked

C-01The mint authority is 31rYar…LGqQ. The holder of this key can mint unlimited new tokens, diluting all current holders to zero value. This fact is also flagged by a third-party risk registry.

IssueThe mint authority is . The holder of this key can mint unlimited new tokens, diluting all current holders to zero value. This fact is also flagged by a third-party risk registry.

FixVerify on-chain that the mint authority is set to null before treating supply as fixed.

StatusUnresolved

Low

Mutable Metadata

L-01Token name, symbol, or image can be changed post-launch, as indicated by `metadata_mutable: True`. This fact is also noted by a third-party risk registry.

IssueToken name, symbol, or image can be changed post-launch, as indicated by `metadata_mutable: True`. This fact is also noted by a third-party risk registry.

FixVerify metadata against off-chain expectations before trusting branding.

StatusUnresolved

Category Ratings

TechnicalMedium4/10

The token is implemented using the classic SPL Token Program (spl-token). A critical finding is the active mint authority, held by , which enables the creation of new tokens. Conversely, the freeze authority has been revoked, preventing the freezing of holder accounts. No Token-2022 extensions such as permanent delegate, transfer hook, or default account state frozen are active, indicating a simpler token configuration.

GovernanceHigh1/10

The token exhibits moderate liquidity at $320,381 USD, with a healthy 24-hour volume of $7,110 USD. The Volume/Liquidity Ratio is 0.02, which does not indicate wash trading. The DEX pair has been active for 620 days, suggesting a relatively established market presence. Holder concentration data was unavailable, precluding an assessment of whale risk.

UpgradesMedium4/10

The mint authority remains active, allowing for potential changes to the token's total supply. The freeze authority has been revoked, which is a positive for the immutability of account states. However, the token's metadata is mutable, meaning its name, symbol, or image can be altered post-launch. No Token-2022 specific upgradeable features like transfer fee or transfer hook are present or upgradable.

Security Checklist

1/4 checks passed

Contract VerifiedFail

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

Liquidity Depth

$722.1K across 23 pairs

Raydium CLMMSOLanalysed$277.6K Orca wpUSDC$161.8K Orca wpUSDC$142.6K Orca wpSOL$88.0K Meteora DLMMSOL$23.5K Orca wpUSDC$18.6K

Show 4 more pairsShow less

Meteora DLMMUSDC$6.3K Meteora DLMMSOL$1.4K Raydium CPMMSOL$1.0K Meteora DYN2Circuit$513

The 13 remaining pairs hold $820 between them and are not listed.

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

7 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 50% (53.5% total → 53.5% effective; 53.5% in EOAs, 0.0% in contracts — heavy)
Liquidity NOT locked (owner can withdraw — rug-pull risk)
1 Critical finding(s) from audit
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Frequently Asked Questions

Is Grass a scam?

Based on the available data, Grass (GRASS) exhibits several characteristics typically associated with high-risk tokens. While ownership is renounced and no mint function exists, the absence of contract verification and unlocked liquidity are significant red flags. Furthermore, the concentration of 55.6% of the supply among the top 10 holders indicates a centralized distribution. These factors contribute to its high-risk score of 54/100, suggesting caution rather than definitively labeling it a scam.

Is Grass safe to buy?

Given its high-risk score of 54/100, Grass (GRASS) is not considered safe to buy without significant caution. Key risk factors include the unverified contract, which prevents independent code review, and the unlocked liquidity, exposing it to potential rug pulls. The substantial concentration of tokens among the top 10 holders also poses a risk of market manipulation or sudden sell-offs. Investors should be aware of these fundamental vulnerabilities.

Has Grass been audited?

The provided information indicates that the Grass (GRASS) contract has not been verified. Contract verification is a foundational step for transparency, allowing public review of the code. Without verification, it's impossible to confirm if the contract has undergone a formal security audit by a reputable third party. Investors should assume no audit has occurred unless public verification and audit reports are explicitly available.

Is Grass Safe?