Is Happy Merchant (HAPPY) Safe? Smart Contract Security Analysis

Security Findings

1 Info

Info

No code-level findings — an SPL mint exposes no auditable program source

I-01This token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on holder concentration, which are read directly from chain state and from third-party risk registries.

IssueThis token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on holder concentration, which are read directly from chain state and from third-party risk registries.

FixRead the risk score breakdown below as the substance of this audit. For a code-level review, the token would need an accompanying verified program.

StatusAcknowledged

Category Ratings

TechnicalMedium6/10

The Happy Merchant token is implemented using the spl-token-2022 program. Both the mint authority and freeze authority have been revoked, ensuring no new tokens can be minted and no accounts can be frozen post-launch. No Token-2022 extensions such as Transfer Hook or Default Account State Frozen are active, indicating a standard token behavior without complex on-chain logic. The token's balance mutability and metadata mutability are both set to False, preventing unauthorized changes to token balances or core metadata.

GovernanceHigh3/10

The token exhibits moderate liquidity at $48,567, with a healthy 24-hour volume of $48,142, resulting in a normal Volume/Liquidity Ratio of 0.99. The DEX pair has been active for 8 days, providing a short but stable track record. While chain-native holder distribution data was unavailable, a third-party signal indicates that the top 10 token accounts hold 30.64% of the supply, suggesting a relatively decentralized distribution and mitigating concentration risks.

UpgradesMedium5/10

The token's core authorities, Mint Authority and Freeze Authority, are both revoked, meaning the token's supply and transferability parameters are fixed and cannot be altered. Key Token-2022 extension parameters like transfer fee and transfer hook are not upgradable, and metadata is immutable. This configuration ensures a high degree of immutability and predictability for token holders.

Security Checklist

1/4 checks passed

Contract VerifiedFail

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Liquidity Depth

$55.7K across 2 pairs

PumpswapSOLanalysed$55.5K Meteora DLMMSOL$197

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

6 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 20% (29.5% total → 29.5% effective; 29.5% in EOAs, 0.0% in contracts — mild)
Liquidity NOT locked (owner can withdraw — rug-pull risk)
Token age < 30 days (still settling)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is Happy Merchant Safe?