Is Osaka Protocol (OSAK) Safe? Smart Contract Security Analysis

Security Findings

1 Med5 Info

Medium

Liquidity not locked

QA-LIQUIDITY0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 2 address(es) other than the owner/deployer. One of them — a wallet, 0xb8f2…fa08 — holds 99.5% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 78% of the token's DEX liquidity; the other pools were not assessed.

Issue0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 2 address(es) other than the owner/deployer. One of them — a wallet, 0xb8f2…fa08 — holds 99.5% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 78% of the token's DEX liquidity; the other pools were not assessed.

FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.

StatusAcknowledged

Info

No issues identified in the reviewed source

I-01The verified source code was reviewed and no issue rising to Informational severity or above was identified. This is a statement about the code that was read, not a guarantee: the review covers the published source only. Fact-layer checks (mint capability, holder concentration) were applied separately and feed the risk score.

IssueThe verified source code was reviewed and no issue rising to Informational severity or above was identified. This is a statement about the code that was read, not a guarantee: the review covers the published source only. Fact-layer checks (mint capability, holder concentration) were applied separately and feed the risk score.

FixRe-check after any contract upgrade or ownership change, both of which can alter behaviour without changing this page.

StatusAcknowledged

Info

Who holds the supply

QA-HOLDERSThe ten largest holders own 80.3% of supply. Of that, 23.9% burned, 1.9% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 52.4% in wallets, 2.1% in other contracts. 12,762 holders in total.

IssueThe ten largest holders own 80.3% of supply. Of that, 23.9% burned, 1.9% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 52.4% in wallets, 2.1% in other contracts. 12,762 holders in total.

FixWatch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

StatusAcknowledged

Info

Identity verified by independent sources

QA-IDENTITYListed on CoinGecko as Osaka Protocol (OSAK), market cap $17M, rank #945. 12,762 holders. Verified by: CoinGecko.

IssueListed on CoinGecko as Osaka Protocol (OSAK), market cap $17M, rank #945. 12,762 holders. Verified by: CoinGecko.

FixMatch the contract address against the project's official channels before trading.

StatusAcknowledged

Info

The market for this token

QA-MARKETLiquidity $794K (DexScreener, all pools). 24h trading volume $138K (CoinGecko, all markets, daily snapshot). 24h trading volume $34K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $4.38e-07 on 2024-03-06; the price is now 94.8774% below it.

IssueLiquidity $794K (DexScreener, all pools). 24h trading volume $138K (CoinGecko, all markets, daily snapshot). 24h trading volume $34K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $4.38e-07 on 2024-03-06; the price is now 94.8774% below it.

FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

StatusAcknowledged

Info

Asset class: Meme token

QA-PROFILEA community token whose value comes from attention rather than a product. Being a meme is not a risk in itself: it is scored on exactly the same contract and market facts as any other token. The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Meme. Tokenomics — Supply: fixed — the contract has no mint function. Control: an owner that could not be resolved. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $794K of DEX liquidity across 5 pools. Launch: 1264 days of market history.

IssueA community token whose value comes from attention rather than a product. Being a meme is not a risk in itself: it is scored on exactly the same contract and market facts as any other token. The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Meme. Tokenomics — Supply: fixed — the contract has no mint function. Control: an owner that could not be resolved. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $794K of DEX liquidity across 5 pools. Launch: 1264 days of market history.

FixExpect attention-driven volatility; the facts in this report say whether the contract itself can be used against holders.

StatusAcknowledged

Category Ratings

TechnicalLow8/10

The TokenMintERC20Token contract implements the ERC-20 standard, providing essential token functionalities such as `transfer` and `balanceOf`. The code analysis (7.2 Code Security) reveals no custom or privileged functions that could introduce specific technical vulnerabilities. The transfer mechanisms (7.1 Architecture) adhere strictly to the ERC-20 specification, utilizing standard `_transfer` and `_approve` internal functions, which implies robust handling of token movements and allowances. No access control issues (7.3 Access Control) were identified as there are no roles or permissions beyond the token holder's own actions.

GovernanceMedium5/10

The contract exhibits a decentralized economic model (7.4 Economic) as it lacks any privileged functions for minting, burning, pausing, or blacklisting. This means no single entity can unilaterally alter the token supply or restrict transfers. There are no governance mechanisms (7.5 Governance) built into the contract, ensuring that all token operations are solely driven by the ERC-20 standard and individual token holder actions. This design minimizes economic manipulation risks by removing central points of control.

UpgradesLow8/10

The TokenMintERC20Token contract is not designed as a proxy (7.7 Upgrades) and is therefore not upgradeable. This immutability provides a high degree of certainty regarding its long-term behavior, as its logic cannot be altered post-deployment. While this means no future feature enhancements are possible, it also eliminates the risks associated with upgrade mechanisms, such as potential upgrade path vulnerabilities or governance failures during an upgrade.

Security Checklist

3/5 checks passed

Contract VerifiedPass

Ownership Renounced?

No Mint FunctionPass

Liquidity LockedFail

Not a ProxyPass

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

80.3% in top 10

52.4% in wallets2.1% in contracts

Effective Concentration53.2%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$794.0K across 5 pairs

Uniswap v2WETHanalysed$620.9K Uniswap v3WETH$129.2K Uniswap v4ETH$40.2K Uniswap v2SHIB$3.4K Curve triWETH$218

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder99.5%

Top-3 Unlocked99.9%

Key Addresses

10 addresses

Deployer

0xd27b…de53

Unlocked LP Held By

0xb8f2…fa080xc663…c8900x84e6…aeae0x102a…eacd0x2609…245b0xa4b5…fbb80x8cfe…c0cc0xb3ac…68a00x0000…8a90

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

2 factors

Liquidity NOT locked (100% of the pool; this pool is 78% of DEX liquidity) — held by independent providers — market-depth risk
Top-10 concentration > 50% (80.3% total → 53.2% effective; 52.4% in EOAs, 2.1% in contracts; 25.8% burned, locked or in pools excluded)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Final Recommendation

AI Copilot

Given the contract's non-upgradeable nature and lack of privileged functions, its security posture is largely determined by the robustness of the underlying ERC-20 standard implementation.…

Read the verdictHide

Token holders should be aware that the contract's logic is fixed and cannot be changed post-deployment. For future deployments, consider using the latest stable Solidity compiler versions and battle-tested libraries like OpenZeppelin for standard implementations. Ensure thorough testing of any custom logic, even in seemingly simple token contracts, to prevent unexpected behavior.

Contract

TypeTokenMintERC20Token

Audit History

1 audit on record

Oct 935

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Not Signed In

Is Osaka Protocol Safe?

Security Findings

Liquidity not locked

No issues identified in the reviewed source

Who holds the supply

Identity verified by independent sources

The market for this token

Asset class: Meme token

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of Osaka Protocol?