Is Wormhole Token (W) Safe? Smart Contract Security Analysis

Security Findings

2 Med5 Info

Medium

Liquidity not locked

QA-LIQUIDITY0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 5 address(es) other than the owner/deployer. One of them — a contract, 0x9c4d…264f — holds 93.1% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 50% of the token's DEX liquidity; the other pools were not assessed.

Issue0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 5 address(es) other than the owner/deployer. One of them — a contract, 0x9c4d…264f — holds 93.1% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 50% of the token's DEX liquidity; the other pools were not assessed.

FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.

StatusAcknowledged

Medium

What the token's controller can do

QA-POWERSThe contract lets its controller — a contract — mint new supply. Nothing independent vouches for whoever holds them, so each is a live risk to holders.

IssueThe contract lets its controller — a contract — mint new supply. Nothing independent vouches for whoever holds them, so each is a live risk to holders.

FixCheck who holds these powers and whether a timelock or multisig stands between them and holders.

StatusAcknowledged

Info

No issues identified in the reviewed source

I-01The verified source code was reviewed and no issue rising to Informational severity or above was identified. This is a statement about the code that was read, not a guarantee: the review covers the published source only. Fact-layer checks (mint/owner authority, mint capability, holder concentration) were applied separately and feed the risk score.

IssueThe verified source code was reviewed and no issue rising to Informational severity or above was identified. This is a statement about the code that was read, not a guarantee: the review covers the published source only. Fact-layer checks (mint/owner authority, mint capability, holder concentration) were applied separately and feed the risk score.

FixRe-check after any contract upgrade or ownership change, both of which can alter behaviour without changing this page.

StatusAcknowledged

Info

Who holds the supply

QA-HOLDERSThe ten largest holders own 37.5% of supply. What remains: 18.5% in wallets, 19.1% in other contracts. 231,652 holders in total.

IssueThe ten largest holders own 37.5% of supply. What remains: 18.5% in wallets, 19.1% in other contracts. 231,652 holders in total.

FixWatch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

StatusAcknowledged

Info

Identity verified by independent sources

QA-IDENTITYListed on CoinGecko as Wormhole (W), market cap $115M, rank #264. Traded on Binance. 231,652 holders. Verified by: CoinGecko, exchange listings.

IssueListed on CoinGecko as Wormhole (W), market cap $115M, rank #264. Traded on Binance. 231,652 holders. Verified by: CoinGecko, exchange listings.

FixMatch the contract address against the project's official channels before trading.

StatusAcknowledged

Info

The market for this token

QA-MARKETLiquidity $127K (DexScreener, all pools). 24h trading volume $46.8M (CoinGecko, all markets, daily snapshot). 24h trading volume $122K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $1.66 on 2024-04-03; the price is now 98.9462% below it.

IssueLiquidity $127K (DexScreener, all pools). 24h trading volume $46.8M (CoinGecko, all markets, daily snapshot). 24h trading volume $122K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $1.66 on 2024-04-03; the price is now 98.9462% below it.

FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

StatusAcknowledged

Info

Asset class: Governance token

QA-PROFILEA token whose main use is voting on a protocol's decisions (delegation and vote checkpoints in its code). The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Governance. Tokenomics — Supply: mintable with no on-chain cap found. Control: a contract. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $127K of DEX liquidity across 12 pools. Launch: 851 days of market history.

IssueA token whose main use is voting on a protocol's decisions (delegation and vote checkpoints in its code). The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Governance. Tokenomics — Supply: mintable with no on-chain cap found. Control: a contract. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $127K of DEX liquidity across 12 pools. Launch: 851 days of market history.

FixCheck how much of the voting supply insiders hold and what governance can change.

StatusAcknowledged

Category Ratings

TechnicalLow7/10

The WToken contract is a well-structured ERC-20 token, incorporating standard functionalities like burning, voting, and EIP-2612 permit. It inherits from OpenZeppelin's AccessControlDefaultAdminRulesUpgradeable and UUPSUpgradeable, ensuring robust architecture (7.1 Architecture). Privileged functions such as `mint(address,uint256)` and `setDelegate(address,address)` are appropriately restricted by roles (`MINTER_ROLE`, `SET_DELEGATE_ROLE`). No reentrancy, integer overflows, or other critical technical vulnerabilities were identified (7.2 Code Security).

GovernanceHigh1/10

The contract employs AccessControl for managing administrative roles, including the `DEFAULT_ADMIN_ROLE` and specific roles like `MINTER_ROLE`, `BURNER_ROLE`, and `SET_DELEGATE_ROLE`. The `grantMinterAndBurner(address)` function allows a role to assign minting and burning capabilities, which directly impacts the token's economic model (7.4 Economic). The `mint(address,uint256)` function, restricted to the `MINTER_ROLE`, allows for arbitrary token creation, posing a centralized supply control risk. Effective governance (7.5 Governance) is crucial to manage these powerful roles and prevent potential misuse.

UpgradesHigh1/10

The WToken contract utilizes the UUPS upgradeable proxy pattern, allowing its logic to be updated via the `upgradeToAndCall(address,bytes)` function. This function is restricted to a specific role, typically the `DEFAULT_ADMIN_ROLE` (7.3 Access Control). While upgradeability offers flexibility for bug fixes and feature enhancements, it introduces a centralized point of control where the entity holding the upgrade role can alter the contract's behavior (7.7 Upgrades). Careful management of this role is essential to mitigate potential risks.

Security Checklist

1/5 checks passed

Contract VerifiedPass

Ownership RenouncedFail

No Mint FunctionFail

Liquidity LockedFail

Not a ProxyFail

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Proxy Upgrade Controls

Proxy TypeEip1967 Uups

ImplementationVerified source

Upgrades (30d)0 · stable

Holder Composition

37.5% in top 10

18.5% in wallets19.1% in contracts

Effective Concentration26.1%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$126.9K across 12 pairs

AerodromeWETHanalysed$63.2K AerodromeWETH$60.5K Uniswap v3WETH$3.1K PancakeswapWETH$61 Uniswap v4ETH$54 Uniswap v4ZRO$10

Show 4 more pairsShow less

Uniswap v2MAEL$8 Uniswap v4ETH$7 Uniswap v4cbETH$1 AerodromeAERO$1

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder93.1%

Top-3 Unlocked98.3%

Key Addresses

7 addresses

Deployer

0x42f9…fb95

Unlocked LP Held By

0x9c4d…264f0x9c78…4fab0x384f…2bd70xf46c…030a0xf7d0…fd230xc65a…7470

What Raised This Score

5 factors

Mintable supply — no cap found, dilution unbounded
Upgradeable proxy — the admin can replace the logic
Liquidity NOT locked (100% of the pool; this pool is 50% of DEX liquidity) — who holds it cannot be verified
Top-10 concentration > 20% (37.5% total → 26.1% effective; 18.5% in EOAs, 19.1% in contracts)
The deployer has launched a honeypot before

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Not Signed In

Is Wormhole Token Safe?

Security Findings

Liquidity not locked

What the token's controller can do

No issues identified in the reviewed source

Who holds the supply

Identity verified by independent sources

The market for this token

Asset class: Governance token

Category Ratings

Security Checklist

Proxy Upgrade Controls

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of Wormhole Token?