IMDRIP (0x885ea754bdD1dF1c363249321142e24bef99D2aC) risk review
Verdict (snapshot: 2026-10-02 12:57 UTC): The token contract has a strong, narrow set of immutable properties: it is verified, not a proxy, has no owner/administrator interface, and exposes no post-deployment mint, tax, blacklist, pause, or transfer-restriction function. The liquidity position is credibly locked in the sense relevant to this Uniswap v4 design: its launcher reports lpBurned = true and owner = 0x0, while still reporting non-zero position liquidity. The irreversible lock was performed in a confirmed transaction.
That is not a blanket “safe” verdict. Trading is governed by a distinct, still-owned hook which levies a fixed 2% ETH-side fee. Its owner can redirect the 0.5% marketing share. The contract that receives the other 1.5% is also controlled by that same owner/keeper and does not enforce the advertised “top 100 holders” allocation on-chain. The token is also extremely new, thinly held, and concentrated. I would characterize it as technically simple at the ERC-20 and LP-lock layers, but economically and reward-distribution centralized; high risk for a buyer.
This is an on-chain code/state review, not financial advice or a security audit.
Scope and evidence method
All state below was read from Ethereum mainnet at the snapshot time using eth_call against https://ethereum-rpc.publicnode.com; code, source, events, transactions, and holder data were cross-checked in Blockscout. Links identify the actual contracts/transactions, rather than relying on a token-list label. “Verified source” means the explorer reports source verification; it does not independently prove that the code has no bug.
Primary evidence:
Facts — token contract
| Observation | Evidence / result |
|---|
| Chain and identity | Ethereum mainnet ERC-20; name/symbol IMDRIP, 18 decimals. |
| Source and upgradeability | The explorer marks it verified and no proxy/implementation. The verified ABI/runtime dispatcher has only name, symbol, decimals, TOTAL_SUPPLY, totalSupply, balanceOf, allowance, approve, transfer, and transferFrom. |
| Supply | totalSupply() and TOTAL_SUPPLY() each returned 1,000,000,000 × 10^18. The deployment minted that amount once to the launcher 0xcb39…285e. |
| Owner / renouncement | There is no owner(), renounceOwnership(), or admin role in the token ABI or verified source. owner() reverts. Thus it was not “renounced” in the usual Ownable-event sense; it was deployed without token ownership to renounce. |
| Mint, tax, blacklist, pause | The verified source has a private _mint used only by the constructor, and no externally callable mint/burn, fee-setting, blacklist/allowlist, pause, rescue, or arbitrary-transfer function. Transfers use the ordinary ERC-20 balance/allowance logic. |
Facts — liquidity lock and renouncement
This is a Uniswap v4 position, not a conventional ERC-20 LP token. The verified launcher is the position owner and is the relevant control point.
Snapshot read from launcher 0xcb39…285e | Value |
|---|
launched() | true |
lpBurned() | true |
owner() | 0x0000000000000000000000000000000000000000 |
positionLiquidity() | 31,627,551,493,412,811,474,352 (non-zero) |
| pool | native ETH / IMDRIP, fee 0, tick spacing 60, hook 0x7C9E…e0cc |
The verified burnLp() code sets lpBurned = true and then transfers launcher ownership to address(0). The launcher’s only removal route, removeLiquidity(address), requires both onlyOwner and !lpBurned; therefore, on the observed state it cannot be called by anyone. The successful burnLp() call was made by 0xd1E9…5745 at block 26,100,128 on 2026-10-01 21:22:35 UTC. These are direct, attributable facts from the linked transaction and launcher source.
Facts — trading hook and rewards controls
The fixed-supply token is not the whole trading system. The pool key points to the verified IMDRIPHook, whose current reads were:
| Hook control / setting | Snapshot value |
|---|
FEE_BPS() / MARKETING_BPS() | 200 / 50 (2% total ETH-side swap fee; 0.5% of trade to marketing and 1.5% to drip) |
hook owner() | 0xd1E9d964f272C7E252fB5967A20810DCAa9b5745 |
marketingWallet() | the same 0xd1E9…5745 address |
distributor() | 0xAe4BBa5839194d81327F46a45966887de2F72e6f (immutable) |
initialized() | true |
The hook source makes the fee constants and distributor immutable and has no blacklist, per-user tax, trading switch, or fee-rate setter. It does expose setMarketingWallet(address) to its owner, so that owner can redirect the marketing portion at any time. flush() is permissionless, but it sends the two already-accrued portions to the fixed distributor and the mutable marketing wallet.
The hook’s immutable distributor is also a verified, non-proxy contract. Its current owner() and keeper() are 0xd1E9…5745. It holds the IMD reward token and lets the keeper buy IMD and publish a Merkle root. The source does prevent the owner from rescuing IMD, but publishRoot only checks that total allocations do not exceed available IMD; it does not verify “top 100,” average balances, or an independent holder snapshot. A keeper can publish a root allocating the available IMD to arbitrary addresses, including itself. This is a material control retained by the same address.
Facts — market structure and concentration
At the snapshot, the explorer reported 49 holders. The Uniswap v4 PoolManager held 398,734,176.878 IMDRIP, about 39.87% of the 1 billion supply. The next ten non-pool holder entries together held about 28.56%; the largest individual non-pool holder held about 4.53%. These figures are a point-in-time holder ledger, not proof that addresses are independent people or that all holdings are freely sellable. See the token’s linked holder view.
Inferences and risk interpretation
- LP lock: supported. The combination of the source’s irreversible guard,
lpBurned=true, zero launcher owner, a confirmed burn transaction, and non-zero position liquidity is strong evidence that this launcher’s initial v4 position cannot be withdrawn through its published code. It is better evidence than merely seeing tokens sent to a burn address.
- Token renouncement: wording needs care. It is accurate to say the token has no owner and no privileged token functions. It is inaccurate to imply a conventional
renounceOwnership() event occurred on the token, because the token does not implement Ownable.
- No token-level honeypot mechanism found. The verified token implementation is standard fixed-supply ERC-20 logic and its dispatcher has no hidden fallback routes. The verified hook applies a fixed 2% ETH-side fee to swaps and does not contain address-specific sell blocking. This reduces a common contract-level rug vector, but is not a guarantee that a trade will execute or be profitable.
- The “safe functions” conclusion applies only narrowly. The hook and distributor add meaningful non-token trust assumptions: the hook owner controls the marketing recipient, and the distributor owner/keeper controls which Merkle root receives the IMD rewards. The issuer address presently occupies all of those roles.
- Economic risk remains high. A ~40% pool share, only 49 listed holders, substantial wallet concentration, a very recent deployment, price impact, and a 2% fee mean the asset can still lose value rapidly even if no token mint or LP withdrawal is available.
Unanswered questions / limits
- I did not identify the human or organization behind
0xd1E9…5745, nor establish whether it controls any holder wallets. On-chain addresses alone cannot answer that.
- This review does not audit Uniswap v4 PoolManager, the external IMD token/pool used by the distributor, router integrations, MEV behavior, or the project website/social claims.
- No independent audit, formal verification, or live buy-and-sell simulation was performed. A future code change is impossible for these non-proxy contracts, but external infrastructure and market conditions can change.
- “LP locked” addresses only the observed launcher-owned initial position. It cannot prevent third parties from adding/removing their own liquidity positions, and it does not guarantee depth, price stability, or the safety of every integration.
Reproducibility checks performed
- Read token, launcher, hook, and distributor state directly with
eth_call at the snapshot time.
- Compared the token runtime selector list to its verified ABI; no privileged token selector was present.
- Read the verified launcher, hook, and distributor source and inspected the access control around liquidity removal, fee routing, and reward allocation.
- Cross-checked token deployment,
burnLp() execution, verification/proxy flags, and holder balances in the linked explorer records.