Quantum Audit Logo
Launch App

Is Immutable X Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

Immutable X IMX
0xf57e…79ff
Ethereum
Not verifiedThis record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked today 1 audit on record
DexScreener ↗
How is this score calculated? → Low Risk
Executive SummaryAI Copilot

The IMXToken contract is an ERC-20 compliant token that incorporates OpenZeppelin's AccessControl for managing administrative functions. A key finding highlights the presence of a minting capability, restricted to a specific role, which allows for the creation of new tokens and could impact the token's economic stability if not managed transparently.

2 Medium4 Informational
Volume 24h
$95.4K
Liquidity
$170.5K
Price
$0.1973
Token Age
4y
Top 10 Holders
71.8%

Security Findings

2 Med4 Info
Medium

Privileged Minting Capability

CP-01The `mint` function allows a controller with the `MINTER_ROLE` to create new IMX tokens and add them to any address. This increases the total supply of tokens, which can dilute the value of existing tokens held by other users.
IssueThe `mint` function allows a controller with the `MINTER_ROLE` to create new IMX tokens and add them to any address. This increases the total supply of tokens, which can dilute the value of existing tokens held by other users.
FixToken holders should understand that a specific role has the power to increase the token supply. It is recommended that the project clearly communicates the policies and conditions under which new tokens will be minted. Consider implementing a multi-signature wallet for the `MINTER_ROLE` to prevent a single point of failure.
StatusUnresolved
Medium

Liquidity not locked

QA-LIQUIDITY0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 3 address(es) other than the owner/deployer. One of them — a wallet, 0x858d…34c5 — holds 95.1% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 67% of the token's DEX liquidity; the other pools were not assessed.
Issue0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 3 address(es) other than the owner/deployer. One of them — a wallet, 0x858d…34c5 — holds 95.1% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 67% of the token's DEX liquidity; the other pools were not assessed.
FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.
StatusAcknowledged
Info

Who holds the supply

QA-HOLDERSThe ten largest holders own 71.8% of supply. What remains: 8.8% in wallets, 63.0% in other contracts. 96,823 holders in total.
IssueThe ten largest holders own 71.8% of supply. What remains: 8.8% in wallets, 63.0% in other contracts. 96,823 holders in total.
FixWatch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
StatusAcknowledged
Info

Identity verified by independent sources

QA-IDENTITYListed on CoinGecko as Immutable (IMX), market cap $186M, rank #196. Traded on Binance, Coinbase. 96,823 holders. Verified by: CoinGecko, exchange listings.
IssueListed on CoinGecko as Immutable (IMX), market cap $186M, rank #196. Traded on Binance, Coinbase. 96,823 holders. Verified by: CoinGecko, exchange listings.
FixMatch the contract address against the project's official channels before trading.
StatusAcknowledged
Info

The market for this token

QA-MARKETLiquidity $254K (DexScreener, all pools). 24h trading volume $19.5M (CoinGecko, all markets, daily snapshot). 24h trading volume $103K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $9.52 on 2021-11-25; the price is now 97.8434% below it.
IssueLiquidity $254K (DexScreener, all pools). 24h trading volume $19.5M (CoinGecko, all markets, daily snapshot). 24h trading volume $103K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $9.52 on 2021-11-25; the price is now 97.8434% below it.
FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
StatusAcknowledged
Info

Asset class: Project token

QA-PROFILEA token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $254K of DEX liquidity across 11 pools. Launch: 1799 days of market history.
IssueA token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $254K of DEX liquidity across 11 pools. Launch: 1799 days of market history.
FixCheck the project's own documentation for what the token is used for; this report covers what the contract allows.
StatusAcknowledged

Category Ratings

TechnicalLow8/10

The IMXToken contract implements the ERC-20 standard with additional AccessControl features, ensuring standard token functionalities like `transfer` and `approve` are present (7.2 Code Security). The contract leverages OpenZeppelin's battle-tested libraries, contributing to robust code security. Access to administrative functions like `grantRole` and `revokeRole` is properly restricted to authorized roles (7.3 Access Control). However, the `mint` function, which increases token supply, is also restricted to a role, posing a centralized control point.

GovernanceHigh2/10

The economic model of the IMXToken includes a minting capability, controlled by a specific role (7.4 Economic). This allows for the expansion of the token supply, which could impact token value through dilution if not managed transparently and predictably. The `AccessControl` mechanism provides a framework for governance over these privileged functions (7.5 Governance), but the power to mint remains a significant centralized control.

UpgradesHigh3/10

The IMXToken contract is not deployed as a proxy (7.7 Upgrades), meaning its logic cannot be directly upgraded or modified after deployment. This eliminates upgrade-related risks such as proxy implementation mismatches or insecure upgrade paths. Any changes to the contract's functionality would require a new deployment and migration of assets.

Security Checklist

2/5 checks passed
Contract VerifiedPass
Ownership Renounced?
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyPass
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

71.8% in top 10
8.8% in wallets63.0% in contracts
Effective Concentration34.0%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$253.5K across 11 pairs
Uniswap v3WETHanalysed$170.5K67.2%SushiswapWETH$50.9K20.1%Uniswap v3WETH$26.3K10.4%Uniswap v2WETH$3.9K1.5%Uniswap v4ETH$1.9K0.8%Uniswap v4ETH$510.0%
Show 4 more pairsShow less
0xdFbc…d332WETH$420.0%Uniswap v3ICHI$340.0%0x2D72…C792WETH$70.0%Uniswap v4ABDS$10.0%

One more pair holds $1 and is not listed.

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder95.0%
Top-3 Unlocked100.0%

Key Addresses

8 addresses
Deployer
0xe9df…1d05
Unlocked LP Held By
0x858d…34c50x893d…d4380xff27…f6250x41e7…b8c80x6879…8f270x43a6…a8b30x31b6…f61b

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

4 factors
  • Mintable supply — no cap found, dilution unbounded
  • Ownership status UNKNOWN (owner could not be resolved)
  • Liquidity NOT locked (100% of the pool; this pool is 67% of DEX liquidity) — held by independent providers — market-depth risk
  • Top-10 concentration > 30% (71.8% total → 34.0% effective; 8.8% in EOAs, 63.0% in contracts)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
StarmanLow RiskPrometheusLow RiskVERA (VRA)Low RiskPendleLow RiskWrapped SOL (SOL)Low RiskTraivo (TRVO)Low Risk

Would You Like a More Detailed Audit of Immutable X?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit