Is p0 Systems (P0) Safe? Smart Contract Security Analysis

Security Findings

1 Low

Low

Mutable Metadata

L-01Token name, symbol, or image can be changed post-launch, as indicated by `metadata_mutable: True` and a third-party risk registry signal.

IssueToken name, symbol, or image can be changed post-launch, as indicated by `metadata_mutable: True` and a third-party risk registry signal.

FixVerify metadata against off-chain expectations before trusting branding.

StatusUnresolved

Category Ratings

TechnicalMedium6/10

The p0 Systems (P0) token is implemented using the classic SPL Token Program. Both the mint authority and freeze authority have been revoked, ensuring that no new tokens can be minted and no existing token accounts can be frozen. The token has 9 decimals and an initialized supply of approximately 1 billion tokens. No advanced Token-2022 extensions like permanent delegates or transfer hooks are active, as indicated by the `spl-token` program and the absence of relevant flags.

GovernanceHigh1/10

The token exhibits a healthy distribution among its top holders, with the top 10 accounts holding 23.4% of the total supply, which is below common concentration thresholds for concern. Liquidity stands at $64,470, which is moderate, and the 24-hour trading volume of $249,932 results in a normal Volume/Liquidity Ratio of 3.88. The DEX pair has been active for 146 days, providing a reasonable track record. Holder distribution data from chain-native RPC was unavailable.

UpgradesMedium5/10

The mint and freeze authorities are permanently revoked, preventing any future changes to supply or account freeze status. The token does not utilize any Token-2022 extensions that would introduce upgradeability or additional administrative control, as indicated by the `transfer_fee_upgradable` and `transfer_hook_upgradable` flags being false. However, the token's metadata, including its name, symbol, or image, remains mutable, as indicated by the `metadata_mutable` flag.

Security Checklist

1/4 checks passed

Contract VerifiedFail

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

Liquidity Depth

$11.8K across 2 pairs

Meteora DYN2SOLanalysed$11.7K Meteora DYN2Circuit$80

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

7 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 50% (50.3% total → 50.3% effective; 50.3% in EOAs, 0.0% in contracts — heavy)
Liquidity NOT locked (owner can withdraw — rug-pull risk)
Liquidity < $50k ($11,816 across 2 pairs — thin market)
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is p0 Systems Safe?