Is Pump.fun (PUMP) Safe? Smart Contract Security Analysis

Security Findings

1 Info

Info

No code-level findings — an SPL mint exposes no auditable program source

I-01This token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on holder concentration, which are read directly from chain state and from third-party risk registries.

IssueThis token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on holder concentration, which are read directly from chain state and from third-party risk registries.

FixRead the risk score breakdown below as the substance of this audit. For a code-level review, the token would need an accompanying verified program.

StatusAcknowledged

Category Ratings

TechnicalMedium6/10

The Pump (PUMP) token is implemented using the spl-token-2022 program. Its supply is fixed at 850,388,805.799315888 tokens due to the Mint Authority being revoked. No Transfer Hook is active, and new accounts are not created in a frozen state, as indicated by "Default Account State Frozen: False". The token is not balance_mutable, closable, freezable, non_transferable, or transfer_fee_upgradable.

GovernanceHigh1/10

The token exhibits healthy liquidity with $63,317,940 USD available on DEXs. The 24-hour volume of $21,543,259 USD results in a normal Volume/Liquidity Ratio of 0.34, not indicating wash trading. The DEX pair has been active for 134 days, providing a sufficient track record. Holder concentration data was unavailable, preventing an assessment of supply distribution risk.

UpgradesHigh2/10

The token's core parameters are immutable, as both Mint and Freeze authorities are revoked. Metadata is also immutable ("metadata_mutable: False"), ensuring the token's name, symbol, and image cannot be changed post-launch. While the token uses the spl-token-2022 program, no permanent delegate is configured, and the transfer hook is not active, although the `transfer_hook_upgradable` flag is true.

Security Checklist

1/4 checks passed

Contract VerifiedFail

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

Liquidity Depth

$34.38M across 30 pairs

PumpswapUSDCanalysed$22.26M Meteora DLMMUSDC$2.99M Orca wpSOL$2.44M Meteora DLMMHYPE$2.15M Meteora DLMMSOL$1.66M Raydium CLMMSOL$1.07M

Show 4 more pairsShow less

Raydium CLMMUSDC$722.9K Meteora DLMMSOL$376.2K Meteora DLMMUSDC$223.4K Orca wpUSDC$202.6K

The 20 remaining pairs hold $285.8K between them and are not listed.

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

5 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 50% (67.8% total → 67.8% effective; 67.8% in EOAs, 0.0% in contracts — heavy)
Liquidity NOT locked (owner can withdraw — rug-pull risk)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Frequently Asked Questions

Is Pump.fun a scam?

It's not definitively labeled a scam based on available data, but significant risks exist. While ownership is renounced and no mint function prevents new token creation, the unverified contract, highly concentrated holder distribution (75.8% by top 10), and unlocked liquidity introduce substantial potential for malicious activity or adverse market events. Investors should be aware of these structural vulnerabilities.

Is Pump.fun safe to buy?

Pump.fun is associated with a high risk score of 52/100. Key risks include the contract not being verified, meaning its security hasn't been audited. A large portion (75.8%) of tokens is held by the top 10 wallets, risking manipulation. Additionally, the liquidity is not locked, which poses a significant rug pull risk. These factors suggest a high level of speculative risk for potential investors.

Has Pump.fun been audited?

No, the Pump.fun contract is explicitly listed as "False" for verification. This means its code has not been publicly validated or audited by a third party. Without verification, there's no transparency into the contract's functionality or security, leaving potential vulnerabilities undisclosed and raising the overall risk profile for investors.

Is Pump.fun Safe?