Is Identity.md (IMD) Safe? Smart Contract Security Analysis

Security Findings

1 Med1 Info

Medium

Centralized Control Over Token Metadata

M-01The `BridgedFP` contract allows the `onlyOwner` to update the token's `_updatableName` and `_updatableSymbol` via the `updateName`, `updateSymbol`, and `updateNameAndSymbol` functions. While this provides flexibility for branding or corrections, it introduces a single point of control. A compromised owner key or a malicious owner could change the token's name and symbol to something misleading, potentially causing confusion among users, facilitating phishing attempts, or damaging the project's reputation.

IssueThe `BridgedFP` contract allows the `onlyOwner` to update the token's `_updatableName` and `_updatableSymbol` via the `updateName`, `updateSymbol`, and `updateNameAndSymbol` functions. While this provides flexibility for branding or corrections, it introduces a single point of control. A compromised owner key or a malicious owner could change the token's name and symbol to something misleading, potentially causing confusion among users, facilitating phishing attempts, or damaging the project's reputation.

FixImplement robust security practices for the owner's private key, such as using a multi-signature wallet (e.g., Gnosis Safe) for the `_delegate` address. Consider whether the ability to change the name and symbol is strictly necessary post-deployment. If not, these functions could be removed or made immutable after an initial setup period. If dynamic updates are required, ensure clear communication channels are established to inform users of any changes.

StatusUnresolved

Info

Reliance on External Contracts

I-01The `BridgedFP` contract inherits significant functionality from external, widely-used libraries: `@openzeppelin/contracts/access/Ownable.sol` and `@layerzerolabs/oft-evm/contracts/OFT.sol`. While these libraries are generally considered secure and well-audited, any vulnerability discovered within them could directly impact the security and functionality of the `BridgedFP` contract. This represents a standard dependency risk.

IssueThe `BridgedFP` contract inherits significant functionality from external, widely-used libraries: `@openzeppelin/contracts/access/Ownable.sol` and `@layerzerolabs/oft-evm/contracts/OFT.sol`. While these libraries are generally considered secure and well-audited, any vulnerability discovered within them could directly impact the security and functionality of the `BridgedFP` contract. This represents a standard dependency risk.

FixEnsure that all external dependencies are kept up-to-date with their latest secure versions. Regularly monitor security advisories and audits related to OpenZeppelin Contracts and LayerZero's OFT library. While direct control over these external contracts is limited, awareness of their security posture is crucial.

StatusUnresolved

Category Ratings

TechnicalLow8/10

The contract demonstrates good technical architecture (7.1) by extending well-audited libraries like LayerZero's OFT and OpenZeppelin's Ownable. Code security (7.2) is generally strong, with appropriate string length checks in `updateName` and `updateSymbol`. However, the centralized control over token metadata via `onlyOwner` functions (7.3) presents a technical risk, as a compromised owner key could lead to misleading token information. The reliance on external contracts (7.6) is a standard practice but introduces dependency risks.

GovernanceHigh3/10

The economic model (7.4) is primarily inherited from the LayerZero OFT standard, which handles cross-chain token transfers. The governance model (7.5) is highly centralized, with a single owner address controlling the ability to update the token's name and symbol. While this allows for flexibility in branding or corrections, it introduces a single point of failure. A compromised owner key could lead to malicious or misleading changes to the token's identity, potentially impacting user trust and creating confusion.

UpgradesMedium6/10

The BridgedFP contract is not designed as an upgradeable proxy (7.7). This means its logic is immutable once deployed, eliminating risks associated with upgrade mechanisms like proxy misconfigurations or faulty upgrade implementations. However, it also implies that any discovered critical vulnerabilities would necessitate a new contract deployment and token migration.

Security Checklist

3/5 checks passed

Contract VerifiedPass

Ownership RenouncedFail

No Mint FunctionPass

Liquidity LockedFail

Not a ProxyPass

Holder Composition

52.9% in top 10

5.8% in wallets47.1% in contracts

Effective Concentration24.6%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$1.89M across 8 pairs

Uniswap v4ETHanalysed$1.59M Uniswap v4ETH$283.2K Uniswap v4ETH$7.4K Uniswap v3WETH$3.1K Uniswap v4USDC$3.1K Uniswap v4ETH$924

Show 2 more pairsShow less

Uniswap v4USDT$35 Uniswap v4ETH$3

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder85.7%

Top-3 Unlocked99.3%

Key Addresses

7 addresses

Deployer

0x047f…54b7

Unlocked LP Held By

0xc657…08080x0a72…65de0xe171…daa50xf768…8dad0x536f…5eee0x51f1…2189

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

6 factors

Ownership NOT renounced — owner is an EOA (single private key)
Top-10 concentration > 20% (52.9% total → 24.6% effective; 5.8% in EOAs, 47.1% in contracts — mild)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 85.7% (independent LP — depth risk, pool = 84% of DEX liquidity)
LP top3 unlocked holders = 99.3% (independent LP — depth risk, pool = 84% of DEX liquidity)
1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is Identity.md Safe?