Is io.net (IO) Safe? Smart Contract Security Analysis

Security Findings

1 Low

Low

Mutable Metadata

L-01The `metadata_mutable` flag is set to True. This means the token's name, symbol, or image can be changed by an authorized party after launch, as indicated by the fact `metadata_mutable: True`.

IssueThe `metadata_mutable` flag is set to True. This means the token's name, symbol, or image can be changed by an authorized party after launch, as indicated by the fact `metadata_mutable: True`.

FixVerify metadata against off-chain expectations before trusting branding.

StatusUnresolved

Category Ratings

TechnicalMedium6/10

The IO token is an SPL token operating under the classic `spl-token` program. Both the mint authority and freeze authority have been revoked, ensuring no new tokens can be minted and no holder accounts can be frozen. The token is initialized with a supply of 79,879,931.874527234 IO tokens (8 decimals). No advanced Token-2022 extensions like permanent delegates or transfer hooks are active.

GovernanceHigh1/10

The token exhibits moderate liquidity at $66,764 USD, with a healthy 24-hour volume of $229,644 USD, resulting in a normal Volume/Liquidity Ratio of 3.44. The DEX pair has been active for 285 days, providing a reasonable track record. While chain-native RPC data on holder concentration was unavailable, a third-party risk registry flagged signals of single holder ownership and high holder concentration.

UpgradesMedium5/10

The token's mint and freeze authorities are revoked, preventing changes to supply or account freeze capabilities. However, the `metadata_mutable` flag is set to True, meaning the token's name, symbol, or image can be altered post-launch. There are no upgradable transfer fees or transfer hooks as this is a classic SPL token.

Security Checklist

1/4 checks passed

Contract VerifiedFail

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

Liquidity Depth

$72.0K across 9 pairs

Raydium CLMMUSDCanalysed$64.4K Raydium CLMMSOL$5.4K Raydium CLMMRENDER$922 Orca wpSOL$764 Orca wpSOL$169 Meteora DYN2SOL$127

Show 3 more pairsShow less

Meteora DYNPawel$83 Meteora DYNJUP$60 Meteora DYN2SOL$24

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

6 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 50% (58.7% total → 58.7% effective; 58.7% in EOAs, 0.0% in contracts — heavy)
Liquidity NOT locked (owner can withdraw — rug-pull risk)
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is io.net Safe?