Is Hydrex (HYDX) Safe? Smart Contract Security Analysis

Security Findings

1 Crit1 High1 Low1 Info

Critical

Centralized Unlimited Minting Capability

C-01The `mint(address to, uint256 amount)` function is callable by `onlyOwner`, allowing the contract owner to mint an arbitrary amount of tokens at any time. This capability grants the owner absolute control over the token supply, posing a critical economic risk. Unlimited minting can lead to severe token inflation, devaluation of existing tokens, and a loss of trust from token holders, as the supply can be increased without any external checks or balances. This directly impacts the token's economic stability and integrity (7.4 Economic, 7.3 Access Control).

IssueThe `mint(address to, uint256 amount)` function is callable by `onlyOwner`, allowing the contract owner to mint an arbitrary amount of tokens at any time. This capability grants the owner absolute control over the token supply, posing a critical economic risk. Unlimited minting can lead to severe token inflation, devaluation of existing tokens, and a loss of trust from token holders, as the supply can be increased without any external checks or balances. This directly impacts the token's economic stability and integrity (7.4 Economic, 7.3 Access Control).

FixImplement a more decentralized or constrained minting mechanism. Options include: 1) Removing the `mint` function entirely after the initial distribution to create a fixed supply token. 2) Implementing a capped minting limit per period or a total supply cap. 3) Integrating a governance mechanism (e.g., DAO) to approve minting operations. 4) Using a time-lock for minting operations to provide transparency and a window for community reaction. If centralized minting is a core design choice, ensure…

StatusUnresolved

High

Large Initial Mint Amount

H-01The `initialMint` function allows the owner to mint `500 * 1e6 * 1e18` (500 million with 18 decimals) tokens in a single transaction to a specified recipient. While this is a one-time operation and protected by the `initialMinted` flag, this represents a very substantial initial supply. The magnitude of this initial mint, combined with the owner's ability to mint more via the `mint` function, could raise concerns about token distribution fairness and potential market manipulation if not transparently managed (7.4 Economic).

IssueThe `initialMint` function allows the owner to mint `500 * 1e6 * 1e18` (500 million with 18 decimals) tokens in a single transaction to a specified recipient. While this is a one-time operation and protected by the `initialMinted` flag, this represents a very substantial initial supply. The magnitude of this initial mint, combined with the owner's ability to mint more via the `mint` function, could raise concerns about token distribution fairness and potential market manipulation if not transparently managed (7.4 Economic).

FixEnsure that the purpose and recipient of this large initial mint are clearly documented and communicated to the community. Provide a detailed plan for the distribution and use of these tokens to maintain transparency and build trust. Consider if such a large initial mint is truly necessary or if a more gradual distribution could be beneficial.

StatusUnresolved

Low

Single Point of Failure for Ownership

L-01The contract relies on a single `Ownable` address for critical administrative operations, including the `mint` and `initialMint` functions, as well as `transferOwnership` and `renounceOwnership`. Although the provided information indicates the owner is a multisig (2/4 threshold), which mitigates some risk, a compromise of the multisig's keys or a malicious consensus among its signers could still lead to unauthorized actions, including unlimited token minting. This represents a single point of failure for the contract's administrative control (7.3 Access Control, 7.8 Operations).

IssueThe contract relies on a single `Ownable` address for critical administrative operations, including the `mint` and `initialMint` functions, as well as `transferOwnership` and `renounceOwnership`. Although the provided information indicates the owner is a multisig (2/4 threshold), which mitigates some risk, a compromise of the multisig's keys or a malicious consensus among its signers could still lead to unauthorized actions, including unlimited token minting. This represents a single point of failure for the contract's administrative control (7.3 Access Control, 7.8 Operations).

FixWhile the use of a multisig is a strong mitigation, consider further decentralizing control over critical functions if feasible for the project's roadmap. For example, implementing a time-lock for `transferOwnership` or for very large minting operations could add an extra layer of security. Regularly review and update the multisig signers and their security practices.

StatusUnresolved

Info

Lack of Emergency Pause Mechanism

I-01The HydrexToken contract lacks a mechanism to pause token transfers or other critical functionalities in case of an emergency, such as a severe vulnerability discovered in an integrated DeFi protocol, a major market exploit, or a critical bug within the token contract itself. While not a direct vulnerability in the current code, the absence of a pause mechanism could limit the ability to react swiftly to unforeseen events, potentially leading to greater losses for users (7.2 Code Security, 7.8 Operations).

IssueThe HydrexToken contract lacks a mechanism to pause token transfers or other critical functionalities in case of an emergency, such as a severe vulnerability discovered in an integrated DeFi protocol, a major market exploit, or a critical bug within the token contract itself. While not a direct vulnerability in the current code, the absence of a pause mechanism could limit the ability to react swiftly to unforeseen events, potentially leading to greater losses for users (7.2 Code Security, 7.8 Operations).

FixConsider implementing a `Pausable` mechanism (e.g., from OpenZeppelin) that allows the owner (preferably a multisig with a time-lock) to temporarily halt token transfers or other sensitive operations. This would provide a crucial emergency stop-gap to protect users and the protocol in adverse scenarios. Clearly define the conditions under which the pause mechanism can be activated and deactivated.

StatusUnresolved

Category Ratings

TechnicalMedium5/10

The HydrexToken contract (7.1 Architecture) is a straightforward ERC20 implementation, leveraging robust and audited OpenZeppelin contracts for its core functionalities (ERC20, ERC20Burnable, ERC20Permit, Ownable). This significantly reduces the likelihood of common code-level vulnerabilities (7.2 Code Security). The custom logic for `initialMint` and `mint` is minimal and correctly implements access control checks. No reentrancy, integer overflow/underflow (beyond what OpenZeppelin handles safely with `unchecked` blocks and prior checks), or other low-level code security issues were identified.

GovernanceHigh2/10

The contract's economic model is highly centralized, granting the owner unlimited minting capabilities via the `mint` function (7.4 Economic). This poses a critical risk of token inflation and devaluation, as the owner can arbitrarily increase the token supply. A significant strength is that the contract owner is a multisig (2/4 threshold), which enhances the security of the owner's privileges and reduces the risk of a single point of compromise (7.5 Governance, 7.8 Operations). Despite the multisig, the inherent power of unlimited minting remains a core economic concern that could undermine trust and token value.

UpgradesHigh3/10

The HydrexToken contract is not designed as an upgradeable proxy (7.7 Upgrades). This means there are no upgrade-specific risks such as storage collisions, proxy logic errors, or issues with upgradeability patterns. Any changes to the contract's logic would require a new deployment and migration of assets, which is a standard approach for non-upgradeable tokens.

Security Checklist

2/5 checks passed

Contract VerifiedPass

Ownership RenouncedFail

No Mint FunctionFail

Liquidity LockedFail

Not a ProxyPass

Holder Composition

77.9% in top 10

6.6% in wallets71.3% in contracts

Effective Concentration35.1%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$727.1K across 12 pairs

Hydrex CLAMMUSDCanalysed$710.8K Hydrex CLAMMWETH$7.9K Hydrex OMNIUSDC$4.6K Uniswap v3WETH$2.7K Hydrex OMNIEVRGROW$854 Hydrex OMNIKIBBLE$178

Show 4 more pairsShow less

Uniswap v3USDC$83 Uniswap v4USDC$8 Hydrex OMNIcbBTC$2 Uniswap v4USDC$1

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder52.7%

Top-3 Unlocked91.6%

Key Addresses

7 addresses

Deployer

0x40fb…92f0

Unlocked LP Held By

0x1548…4eda0xd03b…9cde0xc6d0…16880xb2e3…f0040xfa1f…ed7c0x9c78…4fab

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

9 factors

Ownership NOT renounced — owner is a contract (governance/executor, not an EOA)
Mintable supply — no cap found, dilution unbounded
Top-10 concentration > 30% (77.9% total → 35.1% effective; 6.6% in EOAs, 71.3% in contracts — moderate)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 52.7% (independent LP — depth risk, pool = 98% of DEX liquidity)
LP top3 unlocked holders = 91.6% (independent LP — depth risk, pool = 98% of DEX liquidity)
1 Critical finding(s) from audit
1 High finding(s) from audit
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is Hydrex Safe?

Security Findings

Centralized Unlimited Minting Capability

Large Initial Mint Amount

Single Point of Failure for Ownership

Lack of Emergency Pause Mechanism

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of Hydrex?