Is Mushu Safe? Smart Contract Security Analysis

Security Findings

1 Info

Info

No code-level findings — an SPL mint exposes no auditable program source

I-01This token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on LP lock/burn state, holder concentration, which are read directly from chain state and from third-party risk registries.

IssueThis token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on LP lock/burn state, holder concentration, which are read directly from chain state and from third-party risk registries.

FixRead the risk score breakdown below as the substance of this audit. For a code-level review, the token would need an accompanying verified program.

StatusAcknowledged

Category Ratings

TechnicalMedium6/10

The Mushu (MUSHU) token operates on the `spl-token` program. Its mint authority is revoked (None), preventing further token creation and ensuring a fixed supply. The freeze authority is also revoked (None), meaning no entity can freeze token holder accounts. The token does not utilize advanced Token-2022 extensions such as permanent delegates, transfer hooks, or default frozen account states, as indicated by `default_account_state_frozen: False` and `balance_mutable: False` (7.1 Architecture, 7.3 Access Control).

GovernanceHigh2/10

The token exhibits moderate liquidity with $368,704 USD available on DEXs. The 24-hour volume of $1,120,443 USD results in a Volume/Liquidity Ratio of 3.04, which is within normal ranges and does not suggest wash trading. Holder concentration shows the top 10 accounts hold 31.51% of the supply, which is below thresholds for high concentration risk. The DEX pair has been active for 769 days, providing a long track record (7.4 Economic, 7.5 Governance).

UpgradesMedium5/10

The Mushu (MUSHU) token mint has both its mint authority and freeze authority revoked, meaning its core parameters related to supply and account freezing are immutable. The `metadata_mutable` flag is `False`, indicating that the token's name, symbol, or image cannot be changed post-launch. The token does not have upgradable transfer fees or transfer hooks, as `transfer_fee_upgradable: False` and `transfer_hook_upgradable: False` (7.7 Upgrades).

Security Checklist

1/4 checks passed

Contract VerifiedFail

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

Liquidity Depth

$277.4K across 2 pairs

RaydiumSOLanalysed$277.3K Meteora DYN2CSR$25

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

LP Burned100.0% · ≈ permanent lock

What Raised This Score

5 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 30% (44.1% total → 44.1% effective; 44.1% in EOAs, 0.0% in contracts — moderate)
Liquidity NOT locked (owner can withdraw — rug-pull risk)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is Mushu Safe?