Is OpenVPP (OVPP) Safe? Smart Contract Security Analysis

Security Findings

1 Med1 Low1 Info

Medium

Centralized Control of Token Supply

M-01The entire fixed supply of 1,000,000,000 OVPP tokens is minted to a single `_treasuryWallet` address during contract deployment. This grants significant control over the token's initial distribution, liquidity provision, and potential market impact to a single entity or set of keys. A compromise of this wallet could lead to a large-scale token dump or misuse, impacting the project's integrity and token value (7.4 Economic).

IssueThe entire fixed supply of 1,000,000,000 OVPP tokens is minted to a single `_treasuryWallet` address during contract deployment. This grants significant control over the token's initial distribution, liquidity provision, and potential market impact to a single entity or set of keys. A compromise of this wallet could lead to a large-scale token dump or misuse, impacting the project's integrity and token value (7.4 Economic).

FixConsider implementing a multi-signature wallet for the `_treasuryWallet` to distribute control and require multiple approvals for large transactions. Alternatively, a time-locked vesting schedule or a decentralized distribution mechanism could be explored for future token releases to mitigate single-point-of-failure risks.

StatusUnresolved

Low

Owner Privileges and Single Point of Control

L-01The contract utilizes OpenZeppelin's `Ownable2Step` for access control, which is a robust pattern for ownership transfer. However, the `_owner` address retains full control over critical administrative functions, such as initiating ownership transfers and potentially interacting with other privileged functions if added in the future. While `Ownable2Step` enhances security for ownership changes, the owner remains a single point of control (7.3 Access Control, 7.5 Governance).

IssueThe contract utilizes OpenZeppelin's `Ownable2Step` for access control, which is a robust pattern for ownership transfer. However, the `_owner` address retains full control over critical administrative functions, such as initiating ownership transfers and potentially interacting with other privileged functions if added in the future. While `Ownable2Step` enhances security for ownership changes, the owner remains a single point of control (7.3 Access Control, 7.5 Governance).

FixIt is recommended that the `_owner` address be secured with a multi-signature wallet to distribute control and reduce the risk of a single point of compromise. Implement robust operational security procedures for managing the owner's private keys.

StatusUnresolved

Info

Potential User-Side Front-Running with ERC20Permit

I-01The contract inherits `ERC20Permit`, which allows users to approve token transfers off-chain using signed messages, enabling gasless approvals. While beneficial for user experience, the `permit` function can be susceptible to front-running if a user's signed message (especially with a high allowance and a distant deadline) is observed by an attacker who then submits the transaction with a higher gas price. This is primarily a user-side risk rather than a contract vulnerability (7.2 Code Security).

IssueThe contract inherits `ERC20Permit`, which allows users to approve token transfers off-chain using signed messages, enabling gasless approvals. While beneficial for user experience, the `permit` function can be susceptible to front-running if a user's signed message (especially with a high allowance and a distant deadline) is observed by an attacker who then submits the transaction with a higher gas price. This is primarily a user-side risk rather than a contract vulnerability (7.2 Code Security).

FixEducate users on the potential risks associated with `permit` signatures, particularly regarding front-running. Advise users to use reasonable `deadline` values and be cautious when signing permits for large amounts. Consider providing client-side tools that help users set appropriate parameters and understand the implications of their signatures.

StatusUnresolved

Category Ratings

TechnicalLow10/10

The OpenVPP token contract is built upon battle-tested OpenZeppelin libraries (ERC20, ERC20Permit, Ownable2Step), ensuring a high level of code security (7.2). The architecture (7.1) is straightforward, implementing a standard ERC20 token with a fixed supply. Constructor checks (7.3) prevent zero addresses for the owner and treasury. No reentrancy or integer overflow vulnerabilities were identified, and the use of Solidity 0.8.24 mitigates common arithmetic issues.

GovernanceLow7/10

The contract exhibits a centralized economic model (7.4) where the entire token supply is minted to a single treasury wallet at deployment, granting significant control over initial distribution. Access control (7.3) is managed by a single owner using the robust Ownable2Step pattern, which mitigates some risks associated with ownership transfer but still represents a single point of control for governance (7.5) and operations (7.8).

UpgradesLow9/10

The OpenVPP contract is not designed as an upgradeable proxy (7.7). This simplifies its architecture by removing upgrade-related complexities and potential vulnerabilities, but also means that any future changes to the contract logic would require a new deployment and migration of assets.

Security Checklist

4/5 checks passed

Contract VerifiedPass

Ownership RenouncedPass

No Mint FunctionPass

Liquidity LockedFail

Not a ProxyPass

Holder Composition

44.8% in top 10

5.7% in wallets39.1% in contracts

Effective Concentration21.4%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$339.0K across 3 pairs

AerodromeWETHanalysed$336.9K Uniswap v4USDC$1.6K Uniswap v4USDC$513

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder99.9%

Top-3 Unlocked100.0%

Key Addresses

3 addresses

Deployer

0x5d02…7243

Unlocked LP Held By

0x73e3…93d50x5a01…a692

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

6 factors

Top-10 concentration > 20% (44.8% total → 21.4% effective; 5.7% in EOAs, 39.1% in contracts — mild)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 99.9% (independent LP — depth risk, pool = 99% of DEX liquidity)
LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 99% of DEX liquidity)
1 Medium finding(s) from audit
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is OpenVPP Safe?

Security Findings

Centralized Control of Token Supply

Owner Privileges and Single Point of Control

Potential User-Side Front-Running with ERC20Permit

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of OpenVPP?