Is Main Street USD (MSUSD) Safe? Smart Contract Security Analysis

Security Checklist

1/5 checks passed

Contract VerifiedPass

Ownership RenouncedFail

No Mint FunctionFail

Liquidity LockedFail

Not a ProxyFail

Audit History

2 audits on record

Jul 2372

Every audit run adds a dated snapshot — history is append-only and cannot be edited.

Audit Summary

This audit covers an ERC1967Proxy contract, which is a standard UUPS proxy implementation from OpenZeppelin. While the proxy contract itself is well-vetted, the critical finding is that its associated implementation contract (0x96271bea7a9c4b8edd6c3a05e548f05f157ada46) is unverified on-chain. This prevents any meaningful security assessment of the protocol's core logic, access control, economic model, and upgrade mechanisms, introducing severe risks.

Final Recommendation: The most critical recommendation is to immediately verify the source code of the implementation contract (0x96271bea7a9c4b8edd6c3a05e548f05f157ada46) on the blockchain. Without this, a full security audit cannot be performed, and the system's overall security posture remains unknown and highly risky. Once verified, a comprehensive audit of the implementation contract should be conducted to identify and mitigate any vulnerabilities related to its core logic, access control, economic model, and upgrade authorization mechanisms.

Category Ratings

TechnicalHigh

3/10

The proxy contract (7.1 Architecture) utilizes the battle-tested OpenZeppelin ERC1967Proxy, which is a strong foundation for upgradeability. However, the primary technical risk stems from the unverified implementation contract (7.2 Code Security). Without access to the implementation's source c

GovernanceHigh

1/10

The governance and economic models (7.4 Economic, 7.5 Governance) of the protocol are entirely dependent on the logic within the implementation contract. Since the implementation contract is unverified, it is impossible to assess critical aspects such as tokenomics, fee structures, access control fo

UpgradesHigh

1/10

The contract employs the UUPS proxy pattern (7.7 Upgrades), which is a secure and widely adopted upgrade mechanism. The `ERC1967Proxy` correctly delegates upgrade authorization to the implementation contract. However, the unverified status of the implementation contract means that the actual upgrade

Proxy Upgrade Controls

Proxy TypeEip1967 Uups

ImplementationVerified source

Upgrades (30d)0 · stable

LP Distribution

Top-1 Unlocked Holder100.0%

Top-3 Unlocked100.0%

What Raised This Score

9 factors

Ownership NOT renounced — Multisig (3-of-4)
Mintable supply — no cap found, dilution unbounded
Proxy contract (upgradeable — admin can replace logic)
Top-10 concentration > 30% (98.8% total → 39.9% effective; 0.6% in EOAs, 98.2% in contracts — moderate)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 89% of DEX liquidity)
LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 89% of DEX liquidity)
1 Critical finding(s) from audit
2 High finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Findings

6 total

1 Critical 2 High 3 Info

C-01CriticalUnresolved

Unverified Implementation Contract

The proxy contract at 0x4ba01f22827018b4772cd326c7627fb4956a7c00 delegates calls to an implementation contract at 0x96271bea7a9c4b8edd6c3a05e548f05f157ada46. However, the source code for this implementation contract is not verified on the blockchain. This prevents any security analysis of the actual business logic, access control, economic model, and upgrade authorization, making the entire system's security posture unknown and highly vulnerable to undiscovered issues.

Recommendation: Immediately verify the source code of the implementation contract (0x96271bea7a9c4b8edd6c3a05e548f05f157ada46) on the blockchain. Once verified, a full security audit of the implementation contract must be performed to identify and address any vulnerabilities.

H-01HighUnresolved

Undeterminable Access Control and Economic Logic

Due to the unverified nature of the implementation contract, it is impossible to assess the access control mechanisms (7.3 Access Control) governing critical functions, privileged roles, or the economic logic (7.4 Economic) of the protocol. This includes evaluating potential attack vectors like unauthorized fund transfers, manipulation of economic parameters, or reentrancy vulnerabilities within the core logic. The lack of visibility into these critical components poses a high risk to the integrity and security of the protocol.

Recommendation: Verify the implementation contract's source code and then conduct a thorough audit of its access control mechanisms, role-based permissions, and economic logic to ensure they are robust and secure against common attack patterns.

H-02HighUnresolved

Upgrade Mechanism Security Risk

While the proxy uses the UUPS pattern, which is generally secure, the actual authorization logic for upgrades resides within the unverified implementation contract. This means the conditions under which the contract can be upgraded, who has the authority to initiate upgrades, and any associated timelocks or governance procedures (7.7 Upgrades) cannot be verified. A compromised or malicious implementation could allow unauthorized upgrades, leading to a complete loss of control over the protocol or introduction of backdoors.

Recommendation: After verifying the implementation contract, meticulously audit the `_authorizeUpgrade` function and any related upgrade governance mechanisms within the implementation. Ensure that upgrade permissions are tightly controlled, ideally through a multi-signature wallet or a robust governance process with appropriate timelocks.

I-01InformationalResolved

Use of Standard OpenZeppelin ERC1967Proxy

The contract utilizes the `ERC1967Proxy` from OpenZeppelin Contracts (v5.0.0). This is a well-audited and widely adopted standard for upgradeable proxies, providing a solid and secure foundation for the proxy layer.

Recommendation: Continue to rely on well-vetted libraries like OpenZeppelin for core infrastructure components.

I-02InformationalResolved

UUPS Proxy Pattern in Use

The contract implements the UUPS (Universal Upgradeable Proxy Standard) pattern, where the upgrade logic resides within the implementation contract itself, rather than a separate admin contract. This design choice offers flexibility and can simplify the upgrade process.

Recommendation: Ensure that the upgrade logic within the implementation contract is robust, secure, and adheres to best practices for authorization and safety checks.

I-03InformationalResolved

Constructor Initialization with `upgradeToAndCall`

The proxy's constructor uses `ERC1967Utils.upgradeToAndCall(implementation, _data)` to initialize the implementation address and optionally call an initialization function on the implementation. This is a standard and secure way to deploy and initialize UUPS proxies.

Recommendation: Ensure that the initialization function in the implementation contract is properly secured against re-initialization attacks.

Frequently Asked Questions

Is Main Street USD a scam?

Based on available data, Main Street USD exhibits high-risk characteristics, especially its highly concentrated token distribution where 99.2% is held by the top 10 wallets, and unlocked liquidity. While the contract is verified and ownership renounced, these don't mitigate the direct market manipulation or rug pull potential from concentrated holders and unprotected liquidity. It requires careful consideration.

Is Main Street USD safe to buy?

Investing in Main Street USD carries significant risks. The extreme centralization, with 99.2% of tokens held by the top 10 addresses, makes it vulnerable to price manipulation. Additionally, liquidity is not locked, posing a risk of liquidity withdrawal (rug pull) that could leave investors unable to sell. These factors contribute to its high-risk score.

Has Main Street USD been audited?

The Main Street USD contract has been verified on Ethereum, meaning its code is publicly visible and matches the deployed bytecode. However, "contract verified" is not the same as a comprehensive security audit by an independent third party. An audit typically involves deeper code analysis for vulnerabilities beyond just transparency.

Is Main Street USD Safe? MSUSD