On-chain security analysis — is it a scam or legit?
The HydrexToken contract is an ERC20 token with burnable and permit functionalities, inheriting from OpenZeppelin's battle-tested libraries.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x1548…4eda0xd03b…9cde0xc6d0…16880xb2e3…f0040xfa1f…ed7c0x9c78…4fabNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
mint(address to, uint256 amount) function is callable by onlyOwner, allowing the contract owner to mint an arbitrary amount of tokens at any time. This capability grants the owner absolute control over the token supply, posing a critical economic risk. Unlimited minting can lead to severe token inflation, devaluation of existing tokens, and a loss of trust from token holders, as the supply can be increased without any external checks or balances. This directly impacts the token's economic stability and integrity (7.4 Economic, 7.3 Access Control).C-01The mint(address to, uint256 amount) function is callable by onlyOwner, allowing the contract owner to mint an arbitrary amount of tokens at any time. This capability grants the owner absolute control over the token supply, posing a critical economic risk. Unlimited minting can lead to severe token inflation, devaluation of existing tokens, and a loss of trust from token holders, as the supply can be increased without any external checks or balances. This directly impacts the token's economic stability and integrity (7.4 Economic, 7.3 Access Control).
Implement a more decentralized or constrained minting mechanism. Options include: 1) Removing the mint function entirely after the initial distribution to create a fixed supply token. 2) Implementing a capped minting limit per period or a total supply cap. 3) Integrating a governance mechanism (e.g., DAO) to approve minting operations. 4) Using a time-lock for minting operations to provide transparency and a window for community reaction. If centralized minting is a core design choice, ensure…
Unresolved
initialMint function allows the owner to mint 500 * 1e6 * 1e18 (500 million with 18 decimals) tokens in a single transaction to a specified recipient. While this is a one-time operation and protected by the initialMinted flag, this represents a very substantial initial supply. The magnitude of this initial mint, combined with the owner's ability to mint more via the mint function, could raise concerns about token distribution fairness and potential market manipulation if not transparently managed (7.4 Economic).H-01The initialMint function allows the owner to mint 500 * 1e6 * 1e18 (500 million with 18 decimals) tokens in a single transaction to a specified recipient. While this is a one-time operation and protected by the initialMinted flag, this represents a very substantial initial supply. The magnitude of this initial mint, combined with the owner's ability to mint more via the mint function, could raise concerns about token distribution fairness and potential market manipulation if not transparently managed (7.4 Economic).
Ensure that the purpose and recipient of this large initial mint are clearly documented and communicated to the community. Provide a detailed plan for the distribution and use of these tokens to maintain transparency and build trust. Consider if such a large initial mint is truly necessary or if a more gradual distribution could be beneficial.
Unresolved
Ownable address for critical administrative operations, including the mint and initialMint functions, as well as transferOwnership and renounceOwnership. Although the provided information indicates the owner is a multisig (2/4 threshold), which mitigates some risk, a compromise of the multisig's keys or a malicious consensus among its signers could still lead to unauthorized actions, including unlimited token minting. This represents a single point of failure for the contract's administrative control (7.3 Access Control, 7.8 Operations).L-01The contract relies on a single Ownable address for critical administrative operations, including the mint and initialMint functions, as well as transferOwnership and renounceOwnership. Although the provided information indicates the owner is a multisig (2/4 threshold), which mitigates some risk, a compromise of the multisig's keys or a malicious consensus among its signers could still lead to unauthorized actions, including unlimited token minting. This represents a single point of failure for the contract's administrative control (7.3 Access Control, 7.8 Operations).
While the use of a multisig is a strong mitigation, consider further decentralizing control over critical functions if feasible for the project's roadmap. For example, implementing a time-lock for transferOwnership or for very large minting operations could add an extra layer of security. Regularly review and update the multisig signers and their security practices.
Unresolved
The HydrexToken contract lacks a mechanism to pause token transfers or other critical functionalities in case of an emergency, such as a severe vulnerability discovered in an integrated DeFi protocol, a major market exploit, or a critical bug within the token contract itself. While not a direct vulnerability in the current code, the absence of a pause mechanism could limit the ability to react swiftly to unforeseen events, potentially leading to greater losses for users (7.2 Code Security, 7.8 Operations).
Consider implementing a Pausable mechanism (e.g., from OpenZeppelin) that allows the owner (preferably a multisig with a time-lock) to temporarily halt token transfers or other sensitive operations. This would provide a crucial emergency stop-gap to protect users and the protocol in adverse scenarios. Clearly define the conditions under which the pause mechanism can be activated and deactivated.
Unresolved
The HydrexToken contract is an ERC20 token with burnable and permit functionalities, inheriting from OpenZeppelin's battle-tested libraries. The primary security concern is the centralized control over token supply, specifically the owner's ability to mint an unlimited amount of tokens. While the owner is a multisig, the inherent power of unlimited minting introduces significant economic risk. The contract is not upgradeable.
The HydrexToken contract (7.1 Architecture) is a straightforward ERC20 implementation, leveraging robust and audited OpenZeppelin contracts for its core functionalities (ERC20, ERC20Burnable, ERC20Permit, Ownable). This significantly reduces the likelihood of common code-level vulnerabilities (7.2 Code Security). The custom logic for initialMint and mint is minimal and correctly implements access control checks. No reentrancy, integer overflow/underflow (beyond what OpenZeppelin handles safely with unchecked blocks and prior checks), or other low-level code security issues were identified.
The contract's economic model is highly centralized, granting the owner unlimited minting capabilities via the mint function (7.4 Economic). This poses a critical risk of token inflation and devaluation, as the owner can arbitrarily increase the token supply. A significant strength is that the contract owner is a multisig (2/4 threshold), which enhances the security of the owner's privileges and reduces the risk of a single point of compromise (7.5 Governance, 7.8 Operations). Despite the multisig, the inherent power of unlimited minting remains a core economic concern that could undermine trust and token value.
The HydrexToken contract is not designed as an upgradeable proxy (7.7 Upgrades). This means there are no upgrade-specific risks such as storage collisions, proxy logic errors, or issues with upgradeability patterns. Any changes to the contract's logic would require a new deployment and migration of assets, which is a standard approach for non-upgradeable tokens.
It is strongly recommended to implement a robust decentralization strategy for the token's minting capabilities.
Consider migrating to a fixed supply model or a community-governed minting mechanism to mitigate the critical economic risks associated with centralized, unlimited minting. If centralized minting is intended, ensure transparent communication of the minting policy and use cases to all token holders, and consider implementing time-locks or multi-signature requirements for minting operations beyond the initial supply.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
