Is SpaceX (Ondo Tokenized) (SPCXON) Safe? Smart Contract Security Analysis

Security Findings

1 High2 Med4 Info

High

Privileged Address Can Replace Critical External Contracts

CP-03A designated role can call `setCompliance(address)` and `setTokenPauseManager(address)` to change the addresses of external contracts that dictate how GMToken transfers behave. These external contracts can impose rules, fees, or even halt transfers. Whoever controls this role can effectively redirect or alter the core logic of all token transfers by pointing to a malicious or compromised contract.

IssueA designated role can call `setCompliance(address)` and `setTokenPauseManager(address)` to change the addresses of external contracts that dictate how GMToken transfers behave. These external contracts can impose rules, fees, or even halt transfers. Whoever controls this role can effectively redirect or alter the core logic of all token transfers by pointing to a malicious or compromised contract.

FixThe role capable of changing these critical external contract addresses should be secured with the highest level of governance, such as a multi-signature wallet with a significant number of signers and a timelock. Any new compliance or token pause manager contract should undergo rigorous security audits and community review before being set.

StatusUnresolved

Medium

Privileged Address Can Mint New Tokens

CP-01A designated role has the ability to call the `mint(address,uint256)` function, which increases the total supply of GMToken. This means that whoever controls this role can create new tokens at any time, potentially diluting the value of tokens held by other users.

IssueA designated role has the ability to call the `mint(address,uint256)` function, which increases the total supply of GMToken. This means that whoever controls this role can create new tokens at any time, potentially diluting the value of tokens held by other users.

FixThe role with minting capabilities should be controlled by a robust governance mechanism, such as a multi-signature wallet, to prevent unilateral and unauthorized token creation. Consider if minting is truly necessary post-deployment or if a fixed supply is preferable.

StatusUnresolved

Medium

Liquidity not locked

QA-LIQUIDITY0.0% of the pool's LP is burned or time-locked. 73.5% is held, unlocked, by 10 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 44% of the token's DEX liquidity; the other pools were not assessed.

Issue0.0% of the pool's LP is burned or time-locked. 73.5% is held, unlocked, by 10 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 44% of the token's DEX liquidity; the other pools were not assessed.

FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.

StatusAcknowledged

Info

Who holds the supply

QA-HOLDERSThe ten largest holders own 85.4% of supply. Of that, 1.5% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 77.5% in wallets, 6.4% in other contracts. 2,587 holders in total.

IssueThe ten largest holders own 85.4% of supply. Of that, 1.5% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 77.5% in wallets, 6.4% in other contracts. 2,587 holders in total.

FixWatch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

StatusAcknowledged

Info

Listed, but not independently verified

QA-IDENTITYListed on CoinGecko as SpaceX (Ondo Tokenized Stock) (SPCXON), market cap $12M, rank #1177. 2,587 holders.

IssueListed on CoinGecko as SpaceX (Ondo Tokenized Stock) (SPCXON), market cap $12M, rank #1177. 2,587 holders.

FixMatch the contract address against the project's official channels before trading.

StatusAcknowledged

Info

The market for this token

QA-MARKETLiquidity $694K (DexScreener, all pools). 24h trading volume $4.4M (CoinGecko, all markets, daily snapshot). 24h trading volume $4.5M (DexScreener, all pools).

IssueLiquidity $694K (DexScreener, all pools). 24h trading volume $4.4M (CoinGecko, all markets, daily snapshot). 24h trading volume $4.5M (DexScreener, all pools).

FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

StatusAcknowledged

Info

Asset class: Tokenized real-world asset

QA-PROFILEA token backed by an off-chain asset (a stock, gold, treasury bills, a fund share) held by a named issuer or custodian. Issuance, redemption and transfer restrictions are the issuer's by design. The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Tokenized Stocks. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $694K of DEX liquidity across 30 pools. Launch: 114 days of market history.

IssueA token backed by an off-chain asset (a stock, gold, treasury bills, a fund share) held by a named issuer or custodian. Issuance, redemption and transfer restrictions are the issuer's by design. The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Tokenized Stocks. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $694K of DEX liquidity across 30 pools. Launch: 114 days of market history.

FixTreat the issuer or custodian as the counterparty: check its custody reports and who may hold or redeem the token.

StatusAcknowledged

Category Ratings

TechnicalMedium6/10

The GMToken contract implements the ERC-20 standard with additional features for compliance and pausing transfers, inheriting from `ERC20Upgradeable` and `AccessControlUpgradeable`. The architecture leverages `TokenPauseManagerClientUpgradeable` and `OndoComplianceGMClientUpgradeable` for external logic integration. Key functions like `transfer` and `transferFrom` correctly utilize internal `_transfer` logic. However, the contract design allows a privileged role to `mint` new tokens, increasing total supply (7.2 Code Security). Furthermore, a privileged role can change the addresses of the `compliance` and `tokenPauseManager` contracts via `setCompliance` and `setTokenPauseManager`, which directly impacts transfer rules and security (7.3 Access Control, 7.6 External).

GovernanceHigh1/10

The economic model of the GMToken is subject to significant control by privileged roles. The ability for a designated role to `mint` new tokens at will (CP-01) introduces inflationary risk and can dilute the value for existing token holders (7.4 Economic). More critically, the power to replace the `compliance` and `tokenPauseManager` contracts (CP-03) means that a single role can unilaterally alter the fundamental rules governing token transfers, including imposing fees, restricting transfers, or even redirecting funds, without direct token holder consent (7.5 Governance, 7.4 Economic). This centralizes substantial economic power within the hands of the role holders.

UpgradesHigh1/10

The GMToken is deployed as a Beacon Proxy, enabling future upgrades to its logic contract. This upgradeability is managed through `AccessControlUpgradeable` roles, meaning that only authorized addresses can initiate an upgrade (7.7 Upgrades). While upgradeability offers flexibility for bug fixes and feature enhancements, it also introduces a governance risk, as a malicious upgrade could alter contract behavior or introduce new vulnerabilities. Proper management of the upgrade role is crucial to maintain security.

Security Checklist

1/5 checks passed

Contract VerifiedPass

Ownership Renounced?

No Mint FunctionFail

Liquidity LockedFail

Not a ProxyFail

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Proxy Upgrade Controls

Proxy TypeBeacon

ImplementationVerified source

Upgrades (30d)0 · stable

Holder Composition

85.4% in top 10

77.5% in wallets6.4% in contracts

Effective Concentration80.0%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$694.4K across 30 pairs

Uniswap v3USDCanalysed$307.1K Uniswap v4USDC$41.8K Uniswap v4XSI$36.0K Uniswap v4SI$27.8K Uniswap v4SPACEXSI$23.7K Uniswap v4ASTEROID$22.7K

Show 4 more pairsShow less

Uniswap v4SXSI$18.4K Uniswap v4SI$18.3K Uniswap v4MERIDIAN$17.0K Uniswap v4ASTEROID$16.9K

The 20 remaining pairs hold $164.8K between them and are not listed.

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder29.5%

Top-3 Unlocked48.9%

Key Addresses

11 addresses

Deployer

0x16ac…6664

Unlocked LP Held By

0x39a3…98c10xc57d…884d0x1592…02550x0843…fa050xd099…2bc30x2959…16de0xc608…6bd50xc55d…29980x24dc…0cbe0xe56e…5b18

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

6 factors

A privileged address can replace a contract every transfer depends on
Mintable supply — no cap found, dilution unbounded
Upgradeable proxy — the admin can replace the logic
Ownership status UNKNOWN (owner could not be resolved)
Liquidity NOT locked (100% of the pool; this pool is 44% of DEX liquidity) — held by independent providers — market-depth risk
Top-10 concentration > 70% (85.4% total → 80.0% effective; 77.5% in EOAs, 6.4% in contracts; 1.5% burned, locked or in pools excluded)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Final Recommendation

AI Copilot

To mitigate the identified risks, it is paramount to implement robust governance procedures around the privileged roles.…

Read the verdictHide

Specifically, the roles capable of minting tokens and changing critical external contract addresses (`compliance`, `tokenPauseManager`) should be secured with multi-signature wallets or time-locks. Additionally, thorough due diligence must be performed on any external contract addresses set for `compliance` and `tokenPauseManager` to ensure they are secure and operate as expected, as these contracts directly control token transfer logic. Consider implementing a timelock for changes to these critical addresses to allow for community review and reaction time.

Contract

TypeBeaconProxy

Audit History

1 audit on record

Oct 574

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Not Signed In

Is SpaceX (Ondo Tokenized) Safe?

Security Findings

Privileged Address Can Replace Critical External Contracts

Privileged Address Can Mint New Tokens

Liquidity not locked

Who holds the supply

Listed, but not independently verified

The market for this token

Asset class: Tokenized real-world asset

Category Ratings

Security Checklist

Proxy Upgrade Controls

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of SpaceX (Ondo Tokenized)?