Is noice Safe? Smart Contract Security Analysis

Security Findings

1 High1 Low1 Info

High

Centralized and Immutable Admin Role

H-01The `_admin` address holds significant control over critical token parameters (e.g., `updateImage`, `updateMetadata`, `verify`) and is set immutably in the constructor without any mechanism for transfer or multi-signature control (7.3 Access Control, 7.5 Governance). This creates a single point of failure; compromise or loss of this key could lead to unauthorized modifications or permanent loss of administrative control, impacting the token's integrity and user trust.

IssueThe `_admin` address holds significant control over critical token parameters (e.g., `updateImage`, `updateMetadata`, `verify`) and is set immutably in the constructor without any mechanism for transfer or multi-signature control (7.3 Access Control, 7.5 Governance). This creates a single point of failure; compromise or loss of this key could lead to unauthorized modifications or permanent loss of administrative control, impacting the token's integrity and user trust.

FixImplement a more robust access control mechanism for the `_admin` role. This could involve using a multi-signature wallet (e.g., Gnosis Safe) for the admin address or integrating a decentralized governance system. Additionally, consider adding a function to transfer the admin role to a new address, protected by a time-lock or multi-sig, to allow for operational flexibility and recovery.

StatusUnresolved

Low

Missing Event for Admin Role Assignment

L-01The `_admin` address is assigned in the constructor, but no event is emitted to log this critical assignment on-chain (7.8 Operations). While the admin is set during deployment, the absence of an event hinders transparent monitoring and auditing of the initial administrative setup, making it less straightforward to track the initial controller.

IssueThe `_admin` address is assigned in the constructor, but no event is emitted to log this critical assignment on-chain (7.8 Operations). While the admin is set during deployment, the absence of an event hinders transparent monitoring and auditing of the initial administrative setup, making it less straightforward to track the initial controller.

FixEmit an event in the constructor to explicitly log the `_admin` address upon contract deployment. For example: `event AdminSet(address indexed admin);` and then `emit AdminSet(admin_);` in the constructor.

StatusUnresolved

Info

Dependency on External Superchain Token Bridge

I-01The `crosschainMint` and `crosschainBurn` functions are exclusively controlled by `Predeploys.SUPERCHAIN_TOKEN_BRIDGE` (7.6 External). This design means the token's supply management and overall cross-chain functionality are directly dependent on the security and integrity of this external bridge. Any vulnerability or compromise within the bridge could directly impact the token's economic model and supply across chains.

IssueThe `crosschainMint` and `crosschainBurn` functions are exclusively controlled by `Predeploys.SUPERCHAIN_TOKEN_BRIDGE` (7.6 External). This design means the token's supply management and overall cross-chain functionality are directly dependent on the security and integrity of this external bridge. Any vulnerability or compromise within the bridge could directly impact the token's economic model and supply across chains.

FixWhile this is a design choice, it is crucial to ensure thorough due diligence on the `SUPERCHAIN_TOKEN_BRIDGE` contract and its operational security. Understand its audit history, security practices, and potential risks. Implement robust monitoring for bridge activity relevant to this token.

StatusUnresolved

Category Ratings

TechnicalLow8/10

The contract demonstrates strong technical foundations by inheriting from multiple OpenZeppelin ERC20 extensions (`ERC20Permit`, `ERC20Votes`, `ERC20Burnable`), ensuring adherence to established standards and leveraging audited code. Overrides for `_update` and `nonces` are correctly implemented, and `supportsInterface` is properly handled for `IERC7802` and other standards (7.2 Code Security). The use of Solidity 0.8.28 mitigates common integer overflow/underflow risks. However, the `_admin` role is immutable and controls key functions like `updateImage` and `updateMetadata`, representing a centralization of control (7.3 Access Control).

GovernanceHigh2/10

The economic model involves an initial fixed supply minted on a specific chain, with `crosschainMint` and `crosschainBurn` functions enabling supply movement across chains, restricted to a `SUPERCHAIN_TOKEN_BRIDGE` (7.4 Economic). This design relies heavily on the security of the external bridge. Governance is highly centralized, with a single `_admin` address controlling critical parameters such as token image, metadata, and a one-time verification status (7.5 Governance). There is no on-chain governance or multi-signature mechanism for the `_admin` role, which introduces a significant single point of failure risk.

UpgradesLow8/10

The ClankerToken contract is implemented as a standard, non-upgradeable ERC20 token (7.7 Upgrades). This design choice eliminates the complexities and potential risks associated with proxy upgrade patterns, providing immutability and predictability for its users. However, it also means that any future changes or bug fixes to the core logic would require a new contract deployment and migration, which can be a complex and costly process.

Security Checklist

4/5 checks passed

Contract VerifiedPass

Ownership RenouncedPass

No Mint FunctionPass

Liquidity LockedFail

Not a ProxyPass

Holder Composition

81.4% in top 10

66.0% in wallets15.5% in contracts

Effective Concentration72.2%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$241.9K across 5 pairs

Uniswap v3WETHanalysed$233.9K AerodromeWETH$4.4K AerodromeMAMO$2.3K Uniswap v4ETH$1.2K Hydrex CLAMMWETH$70

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder99.9%

Top-3 Unlocked100.0%

Key Addresses

9 addresses

Deployer

0xa32a…4746

Unlocked LP Held By

0x33e2…c8f90x9a88…bd090xf722…e6860xd29c…a4a00x2ee3…3c7f0xb1da…440b0x33ab…21fa0xe961…9f3d

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

6 factors

Top-10 concentration > 70% (81.4% total → 72.2% effective; 66.0% in EOAs, 15.5% in contracts — extreme)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 99.9% (independent LP — depth risk, pool = 97% of DEX liquidity)
LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 97% of DEX liquidity)
1 High finding(s) from audit
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is noice Safe?

Security Findings

Centralized and Immutable Admin Role

Missing Event for Admin Role Assignment

Dependency on External Superchain Token Bridge

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of noice?