Is Meta Platforms Inc. (METAC) Safe? Smart Contract Security Analysis

Security Findings

3 Info

Info

Lack of Source Code Verification

I-01The smart contract deployed at 0xb200…707c on the Base network is not verified on the block explorer. This means its Solidity source code is not publicly available or linked to the deployed bytecode. Users cannot independently review the contract's logic, functionality, or security properties. This significantly increases the risk of interacting with the contract, as its behavior is opaque and could potentially contain malicious code or critical vulnerabilities (7.2 Code Security).

IssueThe smart contract deployed at on the Base network is not verified on the block explorer. This means its Solidity source code is not publicly available or linked to the deployed bytecode. Users cannot independently review the contract's logic, functionality, or security properties. This significantly increases the risk of interacting with the contract, as its behavior is opaque and could potentially contain malicious code or critical vulnerabilities (7.2 Code Security).

FixThe contract deployer should immediately verify the source code on the Base block explorer. This provides transparency, allows for community review, and is a fundamental step in establishing trust for any public smart contract.

StatusUnresolved

Info

Undetermined Contract Functionality and Architecture

I-02Without access to the source code, the specific functionality, purpose, and architectural design of the contract cannot be determined (7.1 Architecture). It is impossible to ascertain if it's a token, a DeFi protocol component, a governance contract, or something else entirely. This lack of clarity prevents any assessment of its intended use, potential attack vectors, or adherence to best practices for its presumed type.

IssueWithout access to the source code, the specific functionality, purpose, and architectural design of the contract cannot be determined (7.1 Architecture). It is impossible to ascertain if it's a token, a DeFi protocol component, a governance contract, or something else entirely. This lack of clarity prevents any assessment of its intended use, potential attack vectors, or adherence to best practices for its presumed type.

FixProvide the source code and a clear description of the contract's intended functionality and architectural overview. This context is crucial for any security assessment and for users to understand the contract's role within a larger ecosystem.

StatusUnresolved

Info

Unassessable Access Control and Economic Risks

I-03The absence of source code makes it impossible to evaluate the contract's access control mechanisms (7.3 Access Control) or its economic model (7.4 Economic). Critical questions regarding who can perform privileged operations, potential centralization risks, or how value is managed and distributed remain unanswered. This creates a high risk of unknown administrative backdoors, owner-controlled functions, or economic exploits that could lead to loss of funds or manipulation (7.5 Governance, 7.8 Operations).

IssueThe absence of source code makes it impossible to evaluate the contract's access control mechanisms (7.3 Access Control) or its economic model (7.4 Economic). Critical questions regarding who can perform privileged operations, potential centralization risks, or how value is managed and distributed remain unanswered. This creates a high risk of unknown administrative backdoors, owner-controlled functions, or economic exploits that could lead to loss of funds or manipulation (7.5 Governance, 7.8 Operations).

FixFull transparency of the source code is required to assess and mitigate access control and economic risks. Implement robust, multi-signature based access control for critical functions and ensure economic parameters are transparent and, where appropriate, decentralized or governed by a community.

StatusUnresolved

Category Ratings

TechnicalLow10/10

The technical architecture (7.1 Architecture) and code security (7.2 Code Security) of this contract cannot be assessed due to the absence of verifiable source code. While a well-designed contract would exhibit clear modularity and robust error handling, the current lack of transparency prevents any evaluation of these potential strengths. Consequently, critical vulnerabilities like reentrancy or integer overflows remain undetected, posing significant risks to users interacting with the opaque bytecode.

GovernanceHigh3/10

Without source code, the economic model (7.4 Economic) and governance structure (7.5 Governance) of the contract cannot be evaluated. A robust system would typically feature transparent tokenomics and decentralized decision-making, but these aspects are entirely unknown here. This lack of transparency poses a high risk regarding potential economic manipulation or centralized control by an unknown entity, making it impossible to assess external dependencies (7.6 External) or operational risks (7.8 Operations).

UpgradesMedium6/10

The provided information indicates the contract is not a proxy (`is_proxy: false`), suggesting it is not designed for upgradeability (7.7 Upgrades). This inherently limits the risk associated with upgrade mechanisms, as the contract's logic is immutable once deployed, which is a significant strength for stability. However, without source code, it's impossible to definitively confirm this immutability or rule out potential self-destruct or migration functions that could alter its state or functionality.

Security Checklist

2/5 checks passed

Contract VerifiedPass

Ownership Renounced?

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

81.0% in top 10

20.2% in wallets60.8% in contracts

Effective Concentration44.6%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$836.8K across 7 pairs

AerodromeUSDCanalysed$830.3K Uniswap v3USDC$2.8K Uniswap v4ETH$2.7K Uniswap v4RWAGMI$618 Hydrex CLAMMWETH$267 Uniswap v4USDC$100

Show 1 more pairShow less

Uniswap v3USDC$22

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder46.7%

Top-3 Unlocked100.0%

Key Addresses

3 addresses

Unlocked LP Held By

0xba4b…ed360x4a4c…9cc70xe99b…318c

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

5 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Top-10 concentration > 30% (81.0% total → 44.6% effective; 20.2% in EOAs, 60.8% in contracts — moderate)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 99% of DEX liquidity)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is Meta Platforms Inc. Safe?

Security Findings

Lack of Source Code Verification

Undetermined Contract Functionality and Architecture

Unassessable Access Control and Economic Risks

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of Meta Platforms Inc.?