What a deep audit looks like.

AUTONOMOPOLY (AUTONO) | Deep Audit

What this means for you

Two summaries. One for the team behind the project. One for everyone else.

Five pillars. Twenty questions each.

Seven findings, ranked by severity

In addition to the 100-point project assessment, the code-level audit identified seven findings. Two high. Three medium. Two low. Both high-severity findings relate to ownership concentration and absence of liquidity commitments.

Owner retains unrestricted mint authority

Severity: High · Category: Access control · Location: AUTONOMOPOLY.sol

Description

The deployer wallet (0x49F5b131...0F7957cda) retains the ability to mint an unlimited number of tokens at any time. There is no cap enforcement at the contract level, no multi-sig requirement, and no timelock on the mint function. This means a single externally owned account can inflate the supply without warning, diluting all existing holders to zero.

Code reference

function mint(address to, uint256 amount) external onlyOwner {
    // No supply cap check
    // No timelock or multi-sig
    _mint(to, amount);
}

Recommendation

Implement a hard supply cap enforced at the contract level (require(totalSupply() + amount <= MAX_SUPPLY)). Transfer mint authority to a multi-sig with a minimum 48-hour timelock. Publish the max supply and the multi-sig address in project documentation. Without these changes, the token is economically equivalent to an IOU from an anonymous party.

Status

Open. No team contact available. No response channel identified.

No liquidity lock or LP token commitment

Severity: High · Category: Tokenomics · Location: On-chain analysis

There is no evidence of locked liquidity on any DEX. The deployer can remove all liquidity from the trading pair at any time, rendering the token untradeable. No LP tokens have been sent to a lock contract, burned, or committed to a vesting schedule. In the absence of locked liquidity, the trading pair functions as a withdrawal mechanism for the deployer rather than a market.

Recommendation: Lock a minimum of 80% of LP tokens in a reputable time-lock contract (Team.Finance, Unicrypt, or equivalent) for a minimum of 6 months. Publish the lock transaction hash. Until liquidity is verifiably locked, any price shown on a DEX aggregator is functionally meaningless.

(Detailed findings M-01 through L-02 follow the same format in the full report. Each includes code reference, exploit scenario, and remediation guidance.)

Attack scenarios for high-severity findings

Each high-severity finding is expanded into a step-by-step attack chain showing how exploitation would unfold in practice. These narratives inform remediation urgency.

Before and after: recommended fixes

Line-level remediation guidance for the two highest-priority findings. Copy-paste ready for the development team.

H-01: Enforce hard supply cap on mint

function mint(address to, uint256 amount) external onlyOwner {
    _mint(to, amount);
}

uint256 public constant MAX_SUPPLY = 1_000_000_000 * 1e18;
address public constant MINT_MULTISIG = 0x...;  // 3-of-5 multi-sig
uint256 public constant MINT_TIMELOCK = 48 hours;

mapping(bytes32 => uint256) public mintRequests;

function requestMint(address to, uint256 amount) external onlyOwner {
    require(totalSupply() + amount <= MAX_SUPPLY, "cap exceeded");
    bytes32 id = keccak256(abi.encode(to, amount, block.timestamp));
    mintRequests[id] = block.timestamp;
    emit MintRequested(to, amount, id);
}

function executeMint(bytes32 id, address to, uint256 amount) external {
    require(msg.sender == MINT_MULTISIG, "not multisig");
    require(block.timestamp >= mintRequests[id] + MINT_TIMELOCK, "timelock");
    require(totalSupply() + amount <= MAX_SUPPLY, "cap exceeded");
    _mint(to, amount);
    delete mintRequests[id];
}

H-02: Lock liquidity with verifiable time-lock

// LP tokens held in deployer wallet
// No lock contract, no burn, no vesting
// Deployer can call removeLiquidity() at any time

// Transfer 80%+ of LP tokens to a time-lock contract
ILPLocker locker = ILPLocker(TEAM_FINANCE_LOCKER);

// Lock for minimum 6 months, verifiable on-chain
locker.lockTokens(
    LP_TOKEN_ADDRESS,
    msg.sender,          // beneficiary after unlock
    lpAmount * 80 / 100, // 80% of LP tokens
    block.timestamp + 180 days  // 6-month lock
);

// Publish lock tx hash in project documentation
// Remaining 20% stays liquid for operational needs

Automated regulatory screening

Six regulatory dimensions checked against the deployer address, contract design, and public project materials. This is a structured screening, not a legal opinion.

This section is an automated screening based on publicly available data and contract analysis at the stated block height. It does not constitute legal advice. Projects operating in regulated jurisdictions should obtain independent legal counsel.

Tier 2 of 10: Exit Liquidity

AI consensus assessment

This report was prepared by the GhostLabs audit team. The lead auditor’s cryptographic signature is embedded in the signed-PDF version and verifiable against the GhostLabs public key at ghostlabs.asia/pubkey.pem.

Findings reflect the state of the contract at the assessed block height on Base. Subsequent on-chain modifications (proxy upgrades, governance changes, ownership transfers) may alter the risk profile and require re-assessment.

This report is a code analysis and project assessment, not investment advice or a guarantee of safety. The audit examined the contract source, on-chain data, and public project information at the time stated; subsequent deployments, upgrades, governance changes, or external dependencies are out of scope. The 100-point score is a structured evaluation framework, not a prediction. Absence of a finding does not guarantee absence of a vulnerability. Always do your own research before transacting.