Is MindNetwork FHE Token (FHE) Safe? Smart Contract Security Analysis

Security Findings

1 High1 Med1 Low

High

Centralized Control of Critical Roles

H-01The `DEFAULT_ADMIN_ROLE` holds significant power, including the ability to grant and revoke the `MINTER_ROLE` and to change the `ccipAdmin` address. Initially, this role is assigned to the contract deployer (`msg.sender`). A compromise of this single address could lead to unauthorized token minting (up to `maxSupply`), manipulation of administrative settings, and potential economic instability for the token. (7.3 Access Control, 7.4 Economic, 7.8 Operations)

IssueThe `DEFAULT_ADMIN_ROLE` holds significant power, including the ability to grant and revoke the `MINTER_ROLE` and to change the `ccipAdmin` address. Initially, this role is assigned to the contract deployer (`msg.sender`). A compromise of this single address could lead to unauthorized token minting (up to `maxSupply`), manipulation of administrative settings, and potential economic instability for the token. (7.3 Access Control, 7.4 Economic, 7.8 Operations)

FixIt is strongly recommended to transfer the `DEFAULT_ADMIN_ROLE` to a robust multi-signature wallet or a decentralized autonomous organization (DAO) governance contract immediately after deployment. This distributes control and significantly reduces the single point of failure risk.

StatusUnresolved

Medium

Unused `ccipAdmin` Role

M-01The `ccipAdmin` state variable and its setter function `setCCIPAdmin` are implemented, allowing the `DEFAULT_ADMIN_ROLE` to change this address. However, the `ccipAdmin` variable is not utilized anywhere within the provided `FHE` contract code. This introduces an unnecessary administrative function and state variable, potentially leading to confusion about its purpose or creating an unused attack vector if its intended external use is not properly secured. (7.1 Architecture, 7.8 Operations)

IssueThe `ccipAdmin` state variable and its setter function `setCCIPAdmin` are implemented, allowing the `DEFAULT_ADMIN_ROLE` to change this address. However, the `ccipAdmin` variable is not utilized anywhere within the provided `FHE` contract code. This introduces an unnecessary administrative function and state variable, potentially leading to confusion about its purpose or creating an unused attack vector if its intended external use is not properly secured. (7.1 Architecture, 7.8 Operations)

FixClarify the intended purpose and usage of the `ccipAdmin` variable. If it is meant for an external system, ensure that system's security model is robust and integrated. If it has no current or future use, consider removing the variable and its associated functions to reduce contract complexity and potential attack surface.

StatusUnresolved

Low

Lack of Explicit Renouncement Mechanism for `MINTER_ROLE`

L-01While the `DEFAULT_ADMIN_ROLE` can grant and revoke the `MINTER_ROLE`, there is no explicit function within the `FHE` contract for an account holding the `MINTER_ROLE` to renounce it themselves. Although `AccessControl` provides a general `renounceRole` function, it requires the `callerConfirmation` parameter, which might not be intuitive for all users. An explicit function or clear documentation for `MINTER_ROLE` holders to step down could improve operational clarity and reduce potential attack surface if a minter's key is compromised and they wish to remove their privileges proactively. (7.3 Access Control, 7.8 Operations)

IssueWhile the `DEFAULT_ADMIN_ROLE` can grant and revoke the `MINTER_ROLE`, there is no explicit function within the `FHE` contract for an account holding the `MINTER_ROLE` to renounce it themselves. Although `AccessControl` provides a general `renounceRole` function, it requires the `callerConfirmation` parameter, which might not be intuitive for all users. An explicit function or clear documentation for `MINTER_ROLE` holders to step down could improve operational clarity and reduce potential attack surface if a minter's key is compromised and they wish to remove their privileges proactively. (7.3 Access Control, 7.8 Operations)

FixConsider adding a specific `renounceMinterRole()` function that calls `_revokeRole(MINTER_ROLE, _msgSender())` or provide clear documentation on how `MINTER_ROLE` holders can use the inherited `renounceRole` function to step down.

StatusUnresolved

Category Ratings

TechnicalLow7/10

The contract is built upon well-audited OpenZeppelin libraries (ERC20, AccessControl, ERC20Burnable, ERC20Permit), which significantly reduces the risk of common technical vulnerabilities. Custom logic is minimal, primarily involving a `mint` function with a `maxSupply` check and a `setCCIPAdmin` function. The `mint` function correctly enforces the `maxSupply` limit, preventing unbounded inflation (7.2 Code Security). No reentrancy or integer overflow/underflow vulnerabilities were identified due to the use of Solidity 0.8.x and OpenZeppelin's robust implementations (7.2 Code Security).

GovernanceMedium5/10

The economic model features a fixed `maxSupply` for the FHE token, providing a clear cap on total inflation. However, the `MINTER_ROLE` has the ability to mint tokens up to this maximum, introducing a centralized point of control over token supply (7.4 Economic). The `DEFAULT_ADMIN_ROLE` holds extensive power, including the ability to grant and revoke the `MINTER_ROLE` and manage the `ccipAdmin` address (7.3 Access Control). There is no on-chain governance mechanism implemented, meaning all administrative decisions and role changes are controlled by addresses holding these specific roles (7.5 Governance).

UpgradesMedium6/10

The FHE token contract is not designed as an upgradeable proxy. Therefore, there are no upgrade-specific risks such as proxy initialization issues, storage collisions, or logic inconsistencies between proxy and implementation contracts (7.7 Upgrades). Any future changes to the contract logic would require a new deployment and migration of assets.

Security Checklist

3/5 checks passed

Contract VerifiedPass

Ownership RenouncedPass

No Mint FunctionFail

Liquidity LockedFail

Not a ProxyPass

Holder Composition

80.7% in top 10

25.9% in wallets54.8% in contracts

Effective Concentration47.8%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$984.4K across 5 pairs

Pancakeswap v3WBNBanalysed$954.6K UniswapUSDT$29.8K Pancakeswap v3USDT$6 Pancakeswap v2Subject 3$5 Pancakeswap v2XRP$1

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder94.8%

Top-3 Unlocked97.7%

Key Addresses

11 addresses

Deployer

0x9f82…65d5

Unlocked LP Held By

0xdff6…7faa0x5f27…0ae60xbee2…ef090x966d…e41a0xa7af…c3ee0x19bc…de510xd79f…f4700x1e8c…131a0xb16b…01350x10f1…7832

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

8 factors

Mintable supply, capped at 32%/year
Top-10 concentration > 30% (80.7% total → 47.8% effective; 25.9% in EOAs, 54.8% in contracts — moderate)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 94.8% (independent LP — depth risk, pool = 97% of DEX liquidity)
LP top3 unlocked holders = 97.7% (independent LP — depth risk, pool = 97% of DEX liquidity)
1 High finding(s) from audit
1 Medium finding(s) from audit
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is MindNetwork FHE Token Safe?

Security Findings

Centralized Control of Critical Roles

Unused `ccipAdmin` Role

Lack of Explicit Renouncement Mechanism for `MINTER_ROLE`

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of MindNetwork FHE Token?