Is NO Safe? Smart Contract Security Analysis

Security Findings

1 Info

Info

No code-level findings — an SPL mint exposes no auditable program source

I-01This token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on holder concentration, which are read directly from chain state and from third-party risk registries.

IssueThis token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on holder concentration, which are read directly from chain state and from third-party risk registries.

FixRead the risk score breakdown below as the substance of this audit. For a code-level review, the token would need an accompanying verified program.

StatusAcknowledged

Category Ratings

TechnicalMedium6/10

The token is an SPL Token Program v3 mint with 6 decimals. Both the mint authority and freeze authority are revoked, ensuring no new tokens can be minted and no existing accounts can be frozen. No advanced Token-2022 extensions like permanent delegates, transfer hooks, or default frozen states are active. The token's balance and metadata are immutable, as indicated by `balance_mutable: False` and `metadata_mutable: False`.

GovernanceHigh1/10

The token exhibits a healthy volume-to-liquidity ratio of 0.15, indicating normal trading patterns. Total DEX liquidity stands at $40,877, which is sufficient to avoid the 'Very Low Liquidity' flag. The DEX pair has been active for 53 days, providing a reasonable track record. Holder concentration data was unavailable, preventing an assessment of supply distribution.

UpgradesMedium5/10

The token mint's core authorities, Mint Authority and Freeze Authority, are both revoked, meaning the token's supply and account freeze status cannot be altered. No Token-2022 specific upgradeability flags like `transfer_fee_upgradable` or `transfer_hook_upgradable` are active, consistent with it being an SPL Token Program v3 mint. The metadata is also immutable, ensuring branding consistency.

Security Checklist

1/4 checks passed

Contract VerifiedFail

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

Liquidity Depth

$29.5K across 7 pairs

PumpswapSOLanalysed$28.6K Orca wpALONE$480 Orca wpDERP$277 Orca wpTROLL$82 Meteora DYN2IME$25 Meteora DYN2CSR$9

Show 1 more pairShow less

Meteora DYN2USD2$6

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

7 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 30% (46.2% total → 46.2% effective; 46.2% in EOAs, 0.0% in contracts — moderate)
Liquidity NOT locked (owner can withdraw — rug-pull risk)
Liquidity < $50k ($29,459 across 7 pairs — thin market)
Token age < 30 days (still settling)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is NO Safe?