Is Pomni Safe? Smart Contract Security Analysis

Security Findings

1 Info

Info

No code-level findings — an SPL mint exposes no auditable program source

I-01This token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on holder concentration, which are read directly from chain state and from third-party risk registries.

IssueThis token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on holder concentration, which are read directly from chain state and from third-party risk registries.

FixRead the risk score breakdown below as the substance of this audit. For a code-level review, the token would need an accompanying verified program.

StatusAcknowledged

Category Ratings

TechnicalMedium6/10

The Pomni token is implemented using the spl-token-2022 program. Both the mint authority and freeze authority have been permanently revoked, which prevents further token issuance and ensures that no holder accounts can be frozen. The token does not utilize a transfer hook, nor is the default account state set to frozen, simplifying transfer mechanics. (7.1 Architecture, 7.3 Access Control)

GovernanceHigh1/10

The token's market presence shows a liquidity of $17,207 USD, which is moderate. The 24-hour volume to liquidity ratio is 0.44, suggesting healthy trading activity without signs of wash trading. The DEX pair has been established for 105 days, providing a reasonable operational history. Holder concentration data was not available for this audit. (7.4 Economic)

UpgradesMedium5/10

The Pomni token mint has a fixed configuration due to the revocation of both mint and freeze authorities, preventing any future changes to supply or account freeze status. The token's metadata is immutable, meaning its name, symbol, or image cannot be altered. There are no upgradable transfer fees or transfer hooks configured for this token. (7.7 Upgrades)

Security Checklist

1/4 checks passed

Contract VerifiedFail

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

Liquidity Depth

$25.0K

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

6 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 50% (50.7% total → 50.7% effective; 50.7% in EOAs, 0.0% in contracts — heavy)
Liquidity NOT locked (owner can withdraw — rug-pull risk)
Liquidity < $50k ($25,031 across 1 pairs — thin market)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Frequently Asked Questions

Is Pomni a scam?

While Pomni exhibits positive traits like renounced ownership and no mint function, mitigating some direct developer-controlled scam vectors, the unverified contract and unlocked liquidity introduce significant scam potential. The inability to review the code and the risk of liquidity withdrawal mean investors face elevated risks. The medium risk score of 37/100 indicates that caution is strongly advised due to these unaddressed vulnerabilities.

Is Pomni safe to buy?

Pomni carries considerable risk due to an unverified contract and unlocked liquidity. These factors prevent independent code review and expose the project to a potential rug pull by liquidity providers. Given its medium risk score (37/100) and relatively low liquidity compared to trading volume, which can lead to high volatility and slippage, potential investors should exercise extreme caution and acknowledge the elevated risk of capital loss.

Has Pomni been audited?

The Pomni contract is listed as unverified, meaning its source code has not been published or confirmed on the blockchain explorer. Consequently, it has not undergone a public, independent audit process based on available on-chain data. Investors cannot independently review its code for security vulnerabilities or malicious functions, which significantly elevates the project's risk profile compared to audited and verified contracts.

Is Pomni Safe?