L.XYZ Audit
Summary
The L.XYZ token was audited on December 8, 2025 by SpyWolf, covering token configuration, authorities, metadata, website, and social presence. The token’s mint authority and freeze authority are permanently revoked, ensuring a fixed supply and preventing any account freezing. The standard SPL Token program (TokenkegQfe…) is used, meaning no transfer-fee extensions or hidden token mechanics exist. The primary issue identified is the active update authority combined with mutable metadata (isMutable = 1). This allows changes to the token’s name, symbol, URI, and metadata JSON, creating a potential identity-tampering risk. All other authority checks — transfer fee, mint authority status, and freeze authority — passed without vulnerabilities. Website and social media analysis shows a clear design and active presence, though the website lacks SSL, which is a basic security concern. Overall, the token’s supply and program-level security are strong, with the main recommendation being to lock metadata and optionally revoke the update authority for maximum safety.
Issue (1)
Low | Medium | High | Critical | Total | |
|---|---|---|---|---|---|
Not fixed | 1 | - | - | - | 1 |
Acknowledged | - | - | - | - | 0 |
Fixed | - | - | - | - | 0 |
| Total | 1 | 0 | 0 | 0 | 1 |