Is Libra a Scam? Security Analysis

Security Findings

1 Med5 Info

Medium

Liquidity only partly locked or burned

QA-LIQUIDITY89.8% of the pool's LP is burned or time-locked. 89.8% of the LP tokens were sent to a burn address — that liquidity can never be withdrawn by anyone. 3.2% is held, unlocked, by 9 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.

Issue89.8% of the pool's LP is burned or time-locked. 89.8% of the LP tokens were sent to a burn address — that liquidity can never be withdrawn by anyone. 3.2% is held, unlocked, by 9 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.

FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.

StatusAcknowledged

Info

A privileged address controls a switch that decides whether transfers go through

CP-05An on/off setting checked in the transfer path can be changed by a privileged function; depending on its value, transfers or sales are allowed or refused. Ownership is renounced, so no one can call these functions now. Functions: setMode. Restricted to: owner.

IssueAn on/off setting checked in the transfer path can be changed by a privileged function; depending on its value, transfers or sales are allowed or refused. Ownership is renounced, so no one can call these functions now. Functions: setMode. Restricted to: owner.

FixCheck who holds these functions and whether a timelock or multisig stands between them and holders.

StatusUnresolved

Info

Who holds the supply

QA-HOLDERSThe ten largest holders own 79.4% of supply. Of that, 9.2% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 0.2% in wallets, 70.0% in other contracts. 146,992 holders in total.

IssueThe ten largest holders own 79.4% of supply. Of that, 9.2% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 0.2% in wallets, 70.0% in other contracts. 146,992 holders in total.

FixWatch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

StatusAcknowledged

Info

Not listed by any independent source

QA-IDENTITY146,992 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.

Issue146,992 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.

FixMatch the contract address against the project's official channels before trading.

StatusAcknowledged

Info

The market for this token

QA-MARKETLiquidity $1.2M (DexScreener, all pools). 24h trading volume $199K (DexScreener, all pools).

IssueLiquidity $1.2M (DexScreener, all pools). 24h trading volume $199K (DexScreener, all pools).

FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

StatusAcknowledged

Info

Asset class: Meme token

QA-PROFILEA community token whose value comes from attention rather than a product. Being a meme is not a risk in itself: it is scored on exactly the same contract and market facts as any other token. The class itself adds no points; the contract and market facts decide the score. Basis: launched on four.meme, a meme launchpad. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $1.2M of DEX liquidity across 3 pools. Launch: launched on four.meme, 342 days of market history.

IssueA community token whose value comes from attention rather than a product. Being a meme is not a risk in itself: it is scored on exactly the same contract and market facts as any other token. The class itself adds no points; the contract and market facts decide the score. Basis: launched on four.meme, a meme launchpad. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $1.2M of DEX liquidity across 3 pools. Launch: launched on four.meme, 342 days of market history.

FixExpect attention-driven volatility; the facts in this report say whether the contract itself can be used against holders.

StatusAcknowledged

Category Ratings

TechnicalLow8/10

The Token contract implements standard ERC-20 functionality, including `transfer`, `transferFrom`, `balanceOf`, and `totalSupply`. The core transfer logic appears sound (7.2 Code Security). A `_mode` switch exists to control transfer rules, which could impact token movement. However, the `setMode` function, which modifies this switch, is restricted to the owner, and ownership has been renounced (7.3 Access Control). This means the switch is effectively immutable in its current state.

GovernanceLow8/10

The contract includes a `setMode` function that could alter transfer rules by changing the `_mode` state variable (7.4 Economic). This function was originally restricted to the contract owner. However, the contract's ownership has been renounced (7.5 Governance), rendering `setMode` and other owner-restricted functions permanently inaccessible. This eliminates any potential governance or economic risk associated with a centralized control over transfer mechanisms.

UpgradesLow8/10

The Token contract is not implemented as a proxy and does not include any upgradeability mechanisms (7.7 Upgrades). This means the contract's logic is immutable and cannot be changed post-deployment. This design choice eliminates upgrade-related risks but also prevents future modifications or bug fixes.

Security Checklist

4/5 checks passed

Contract VerifiedPass

Ownership RenouncedPass

No Mint FunctionPass

Liquidity LockedFail

Not a ProxyPass

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

79.4% in top 10

0.2% in wallets70.0% in contracts

Effective Concentration28.2%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$1.23M across 3 pairs

Pancakeswap v2WBNBanalysed$1.23M Pancakeswap v2Subject 3$9 Pancakeswap v2USDT$0

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

LP Burned89.8%

LP Locked89.8%

Key Addresses

10 addresses

Deployer

0x2ce2…9ea7

Unlocked LP Held By

0x5116…394f0xd17a…1e1d0xd4a9…fa7b0x3100…517a0x7a36…0aea0x54b1…7c440x5dc0…3eb20xa7c0…9ed10xabae…5ea8

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

3 factors

Liquidity NOT locked (10% of the pool) — held by independent providers — market-depth risk
Top-10 concentration > 20% (79.4% total → 28.2% effective; 0.2% in EOAs, 70.0% in contracts; 9.2% burned, locked or in pools excluded)
The deployer has launched a honeypot before

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Not Signed In

Is Libra a Scam?

Security Findings

Liquidity only partly locked or burned

A privileged address controls a switch that decides whether transfers go through

Who holds the supply

Not listed by any independent source

The market for this token

Asset class: Meme token

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of Libra?