Is Pyth Network (PYTH) Safe? Smart Contract Security Analysis

Pyth Network PYTH

HZ1Jov…BCt3

Solana Not verifiedLast checked 3d ago 1 audit on record

DexScreener ↗

47 / 100

High Risk

Executive SummaryAI Copilot

This audit of the Pyth Network (PYTH) SPL token mint identifies a low-severity risk related to mutable metadata, which allows for changes to the token's branding. Critical authorities like mint and freeze are revoked, enhancing security. The token exhibits healthy liquidity and a mature market presence, with no signs of high holder concentration or wash trading. Third-party registry data was available and confirmed mutable metadata.

1 Low

Volume 24h

$538.0K

Liquidity

$378.6K

Price

$0.05414

Token Age

Top 10 Holders

46.7%

Security Findings

1 Low

Low

Mutable Metadata

L-01The token's metadata is mutable, as indicated by `metadata_mutable: True`. This means the token name, symbol, or image can be changed post-launch by the metadata authority.

IssueThe token's metadata is mutable, as indicated by `metadata_mutable: True`. This means the token name, symbol, or image can be changed post-launch by the metadata authority.

FixVerify metadata against off-chain expectations before trusting branding. Monitor for any unexpected changes to the token's identity.

StatusUnresolved

Category Ratings

TechnicalMedium6/10

The token is implemented using the standard `spl-token` program. Both the Mint Authority and Freeze Authority have been revoked, preventing further token minting or freezing of holder accounts. The token does not utilize advanced Token-2022 extensions such as permanent delegates or transfer hooks. However, the token's metadata is mutable, allowing for potential changes to its name, symbol, or image.

GovernanceHigh2/10

The token exhibits a moderate holder concentration, with the top 10 accounts holding 46.68% of the total supply, which does not trigger a high concentration warning. Liquidity is robust at $386,753, and the pair has been active for 749 days, indicating a mature market presence. The 24-hour volume to liquidity ratio is 2.13, suggesting normal trading activity without signs of wash trading.

UpgradesMedium5/10

The token's core authorities, Mint Authority and Freeze Authority, are permanently revoked, ensuring no future changes to supply or account freeze status. This provides a high degree of immutability for critical token parameters. While the token is based on the standard `spl-token` program and does not feature Token-2022 upgradeable extensions, its metadata remains mutable, meaning the token's branding elements can be altered post-launch.

Security Checklist

1/4 checks passed

Contract VerifiedFail

No Mint Function?

Liquidity LockedFail

Not a ProxyPass

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Liquidity Depth

$594.3K across 30 pairs

Raydium CLMMSOLanalysed$378.6K Orca wpSOL$61.1K Raydium CLMMJUP$56.7K Meteora DYN2USDC$13.8K Orca wpHNT$9.0K Meteora DLMMUSDC$8.6K

Show 4 more pairsShow less

Meteora DYNbSOL$7.7K Orca wpUSDC$6.0K Raydium CPMMSOL$5.5K Raydium CLMMSOL$5.2K

The 20 remaining pairs hold $42.1K between them and are not listed.

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

6 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 30% (46.7% total → 46.7% effective; 46.7% in EOAs, 0.0% in contracts — moderate)
Liquidity NOT locked (owner can withdraw — rug-pull risk)
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is Pyth Network Safe?