Is Jotchua Safe? Smart Contract Security Analysis

Security Findings

1 Info

Info

No code-level findings — an SPL mint exposes no auditable program source

I-01This token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on holder concentration, which are read directly from chain state and from third-party risk registries.

IssueThis token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on holder concentration, which are read directly from chain state and from third-party risk registries.

FixRead the risk score breakdown below as the substance of this audit. For a code-level review, the token would need an accompanying verified program.

StatusAcknowledged

Category Ratings

TechnicalMedium6/10

The Jotchua token is an SPL Token-2022 mint. Both the mint authority and freeze authority have been revoked, ensuring no new tokens can be minted and no accounts can be frozen post-launch. No transfer hook is active, and the default account state is not frozen, allowing free transfers upon receipt. The token is not balance_mutable, closable, freezable, non_transferable, and its transfer fee and transfer hook are not upgradable, indicating a robust and immutable configuration.

GovernanceHigh3/10

The token exhibits a low holder concentration, with the top 10 accounts holding 19.96% of the supply, reducing the risk of large-scale price manipulation. Liquidity stands at $201,170 USD, which is sufficient for moderate trading activity. The 24-hour volume to liquidity ratio is 0.79, indicating normal trading patterns without signs of wash trading. The pair has been active for 45 days, providing some track record.

UpgradesMedium5/10

The token's mint and freeze authorities are revoked, preventing any post-launch changes to supply or account states. It utilizes the Token-2022 program but does not have a transfer hook or default frozen account state. Importantly, the metadata is not mutable, meaning the token's name, symbol, or image cannot be altered after deployment. This configuration ensures a high degree of immutability and predictability for holders.

Security Checklist

1/4 checks passed

Contract VerifiedFail

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

Liquidity Depth

$321.2K across 12 pairs

PumpswapUSDCanalysed$262.4K Meteora DLMMSOL$53.7K Meteora DLMMSOL$3.1K Meteora DLMMSOL$1.5K Meteora DLMMSOL$311 Meteora DYN2ANSEM$53

Show 4 more pairsShow less

Meteora DYN2USD2$27 Meteora DYN2IME$22 Meteora DYN2CSR$11 Meteora DYN2PEPE$6

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

4 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Liquidity NOT locked (owner can withdraw — rug-pull risk)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is Jotchua Safe?