MANTRA ($MANTRA, formerly $OM) Tokenomics Audit

MANTRA Coin Audit Executive Summary (formerly $OM)

• The coin now goes by a different name. In March 2026 the project carried out a rebrand with redenomination: one OM was exchanged for four MANTRA. The old ticker was delisted, the ERC-20 migration window closed on 15 January 2026, and the balances that did not migrate — roughly 7% of supply — passed to the project's association. All historical figures in this document are restated in the current unit.
• The price is 99.8% below its all-time high. The February 2025 peak, converted to the current unit, works out to $2.26; the current price is $0.004523. The 90% crash of 13 April 2025 was not the end of the decline but its midpoint: since then the coin has lost a further 97% or so.
• 16% annual emission with zero absorption. The mint module parameter is fixed at 0.16, annual emission is 1.30bn MANTRA. The project's documentation states 3%. The discrepancy with the network's actual parameter is a factor of 5.3.
• What was burned has returned to circulation. The 300m OM burned in April 2025 after the crash sat at a burn address. On 20 August 2026 that address was drained in an exploit: 720.9m MANTRA returned to circulation.
• The declared tokenization did not materialize. The $1bn deal with DAMAC and the $500m deal with MAG were announced publicly. In fact, assets worth $370.9k have been issued on the network, and both issuers are third-party companies, Ondo and Circle. The MAG partner moved to a competitor in May 2025.
• The network is almost empty. 726 transactions per day, 11,537 addresses over two years of operation, network utilization of 0.093%, TVL of $540k, of which 99.1% is a single third-party exchange.
• The license and the buyer are real. The VARA license is in force, and in June 2026 the project was acquired by Inveniam Capital Partners. These are the only two assets that withstood verification.

Rating: 22 / 100, CC

MANTRA is a rare case where there is nothing to verify — not because the data is closed, but because almost nothing that was declared has materialized. The coin is necessary for its own network to operate: without it you cannot pay for gas and you cannot become a validator. But the network it serves processes seven hundred transactions per day, and the tokenization business for which all of it was built passes it by: the license belongs to a separate legal entity, and assets on the network are issued by third-party issuers. Against a 16% annual emission there is not a single absorption mechanism, and the only one that existed — the burn — turned out to be reversible.

1. Introduction

The audit has no commercial purpose, and its conclusions are not an investment recommendation. The audit is intended for a broad audience, and its development aims to identify the weak points of the MANTRA coin and present them both to the project itself and to all holders of the coin. The audit uses only open data from the Internet.

MANTRA Chain is a layer-one blockchain built on the Cosmos SDK, designed for the tokenization of real-world assets with a declared commitment to regulatory compliance. The testnet was launched in November 2023, the mainnet on 24 October 2024. The network supports contract execution in an EVM environment as well as Cosmos ecosystem tooling.

Key distinguishing features:

• A proprietary participant verification layer: in addition to the usual KYC, KYB and KYT, a "know your validator" procedure has been added.
• EVM compatibility on a Cosmos SDK base — contracts are deployed with familiar tooling.
• A VARA license held by the subsidiary legal entity Mantra Finance FZE, issued on 19 February 2025.
• The mantraUSD stablecoin and the first in-house tokenization product — the Pyse electric transport fleet, launched on 26 August 2025.

6.431bn MANTRA are in circulation. The coin is used to pay for gas, for staking and for participation in network governance; it has no other functions.

For a UAE audience this audit lands close to home. MANTRA holds a VARA licence through Mantra Finance FZE in Dubai, and the tokenization deals it announced — DAMAC and MAG — are Dubai real-estate names. That makes the gap between the licence and the coin the practical lesson here: a VARA or ADGM permission sits with a legal entity, it does not attach itself to a token, and nothing in a licence obliges an issuer to settle in its own coin.

Website: mantrachain.io

2. Coin price

2.1 Coin price analysis

• Current price: $0.004523 as of 9 September 2026;
• All-time high converted to the current unit: $2.26, recorded on 23 February 2025 — the current price is 99.80% below it;
• High after the redenomination: $0.02627, recorded on 4 March 2026 — the day trading resumed under the new ticker;
• All-time low: $0.004004, recorded on 26 August 2026 — six days after the exploit;
• Market capitalisation: $29.07m, 679th by capitalisation;
• Daily trading volume: $2.55m — about 8.8% of capitalisation.

The price history breaks down into four phases.

The first — the 2024 rally: from $0.015 in January to $0.37 by the mainnet launch in October, followed by a jump to $1.05 in November. Over the year the coin rose roughly seventyfold on interest in the real-world asset tokenisation narrative.

The second — the peak and the crash: the high of $2.12 on the weekly series was recorded in February 2025, and on 13 April 2025 the coin lost more than 90% within a few hours. The event is examined separately in Section 7.

The third — eighteen months of continuous decline: from $0.25 in April 2025 to $0.0176 by February 2026. The crash was not a one-off event after which the market found a new equilibrium; it opened a phase in which the coin lost a further 93% or so.

The fourth — after the redenomination: from $0.0184 in March 2026 to $0.0045 in September. The ticker change and the expansion of the supply cap did not change the direction of movement.

A separate structural factor is availability. All trading is concentrated on centralised venues: there is not a single decentralised exchange in the top ten by volume. On 21 August 2026 the three largest Korean exchanges — Upbit, Bithumb and Coinone — placed the coin on a delisting watch list. As of the data snapshot date no decision has been taken.

2.2 TVL and network activity analysis

For a layer-one network the functional analogue of TVL is the volume of funds placed in its applications, together with the volume of assets actually issued on it. Both indicators are measured directly.

The network's TVL as of the snapshot date is $540,196 against a peak value of $4,545,094 — a decline of 88.1%. Of this amount, 99.1% comes from a single application, Quickswap V4, which is external to the project. The network has no decentralised finance layer of its own.

Network activity is measured by a direct query to the explorer: 277,149 transactions in the EVM environment over the entire period, 726 transactions per day, 11,537 addresses over two years of mainnet operation. Network load is 0.093%, i.e. less than one tenth of one percent of its throughput.

2.3 Conclusions regarding the coin price

The MANTRA price is determined by residual interest in the real-world asset tokenisation narrative rather than by the economics of the coin itself. The product metric — the volume of assets issued on the network — stands at $370.9k and has grown by 0.28% over thirty days. There is no channel in the model through which business growth would translate into demand for the coin.

3. Coin distribution

At mainnet genesis, 1,777,777,776 OM were issued, which in terms of the current unit amounts to 7,111,111,104 MANTRA. Supply as of the snapshot date was verified by a direct query to the network: 8,133,111,252 MANTRA against a cap of 10,000,000,000 fixed in the parameters of the mint module. 6.431bn are in circulation, that is 79% of the amount issued and 64% of the cap.

3.1 How the coins are distributed, cliffs and unlocks

There was no public sale at genesis: investors entered only through the pre-seed and seed rounds, 10.7% of supply in total. Half of the genesis is a mirror of the legacy coin, meaning the distribution was inherited rather than sold anew.

Unlock schedule:

• Seed: 6-month lock-up, then 12 months linear — completed on 23 April 2026;
• Pre-seed: 12-month lock-up, then 24 months linear — completes on 23 October 2027;
• Staker incentives: 4 months, then 44 months linear — complete on 16 October 2028;
• Team and contributors: 30-month cliff until 23 April 2027, then 30 months linear — completes on 22 October 2029;
• Ecosystem: no lock-up and no vesting, liquid from genesis.

The ecosystem allocation warrants separate examination. 151m MANTRA were fully liquid from day one, with no lock-up period and no vesting. To these were added the balances of holders who failed to migrate before the window closed on 15 January 2026: according to the project's Token Transparency Filing this is about 7% of supply, and it went to the association. The project has published no rules governing the spending of either sum.

3.2 Conclusions regarding coin distribution

MANTRA's distribution structure is transparent in form and unverifiable in substance. The schedule is published, but not one of the addresses through which it is supposed to be executed has been disclosed. The project's only verifiable address is the one to which the burned coins were sent, and it is precisely that address which was drained in the exploit.

4. Staking and farming

4.1 Analysis of instruments

Staking is the coin's main function. A holder delegates coins to a validator and receives a share of the emission. The parameters were verified by a direct query to the network as of the data snapshot date: the active set is limited to 38 validators out of 92 registered, the unbonding period is 8 days, and the minimum validator commission is 0%.

2,361,236,889 MANTRA is staked, i.e. 29.0% of the issued supply and about 36.7% of the circulating supply. The stated yield according to aggregators ranges from 16% to 29% per annum depending on the measurement date.

The project offers no liquid staking and no liquidity provision reward programmes. The only application of this kind on the network is the third-party Fluxtra with $22.7k in funds.

4.2 Analysis of formulas

Emission parameters were read directly from the mint module of the MANTRA network on 9 September 2026:

• Minimum and maximum inflation rate: 0.16, i.e. the rate is fixed at 16% per annum;
• Annual emission: 1,301,297,779 MANTRA;
• Target staked share: 0.67 against an actual 0.29;
• Blocks per year: 9,562,910;
• Supply cap: 10,000,000,000 MANTRA.

The rate determines the timeline for exhausting the cap. With 8.133bn issued and emission of 16% per annum, the 10bn limit is reached in roughly fifteen months, i.e. by the end of 2027, after which emission must stop. For a holder this means that the remaining dilution reserve — 1.87bn coins, or 23% of current circulation — will be spent in less than a year and a half.

The distribution of emission was checked separately. The project's Token Transparency Filing states that 60% of emission goes to stakers and 40% to the association for liquidity and ecosystem support. The community_tax parameter of the distribution module as of the snapshot date equals zero, meaning that through the standard Cosmos mechanism the entire emission goes to validators and delegators. Either the association's share is withdrawn by a non-standard module, or it is not withdrawn at all; it is impossible to determine this from open data.

4.3 Cash flow analysis

Inflow to the market:

• Emission: 1.30bn MANTRA per year, about 3.57m per day — roughly $16.1k per day at the price as of the audit date;
• Linear unlock of pre-seed and staker incentives, continuing until October 2027 and October 2028 respectively;
• 720.9m MANTRA returned to circulation from the burn address during the exploit of 20 August 2026.

Withdrawal from circulation:

• There are no withdrawal mechanisms: there is no burn, no protocol locks, and fees are not destroyed.

The buyback programme deserves separate mention, since it is often mistaken for an absorption mechanism. On 27 August 2025, a buyback of at least $45m was announced: $25m from the subsidiary MANTRA AG and $20m from Inveniam Capital Partners. The bought-back coins are not burned: by the official wording, they are withdrawn from exchanges, migrate to the mainnet and are staked by the project's validator set. Supply is therefore not reduced — the coins return under the issuer's control and begin to generate emission income and voting power for it. The project has not published consolidated reports on the volumes actually bought back.

The network has no protocol revenue. There is no DefiLlama fee adapter for MANTRA, and with 726 transactions per day the volume of fees cannot be significant at any rate.

4.4 Conclusions

• Staking yield is paid out of emission rather than revenue: this is a redistribution between holders, not value creation.
• The actual inflation rate of 16% diverges from the project's documentation by a factor of 5.3 and is nowhere explained.
• There are no supply absorption mechanisms, and the only burn that did take place was reversed by theft.
• The dilution reserve up to the cap is exhausted in roughly fifteen months.

The section that in most projects describes the mechanics of token retention describes, in MANTRA's case, the mechanics of dilution. Staking here is not a source of income but a condition for preserving one's share, and participation in it is mandatory for anyone who does not want to lose 16% per year.

5. Coin Utilization

5.1 Use Cases

• Gas payment — any transaction on MANTRA Chain requires MANTRA. The coin cannot be bypassed.
• Staking — delegation to validators, securing the network and receiving a share of emission.
• Governance — voting on network proposals.
• Storage and transfer — basic functionality.

The gap is visible in the numbers. If demand for the coin were driven by network usage, it would rest on 726 transactions per day and $370.9k of issued assets. A capitalization of $29.07m rests on something else.

5.2 Tools and Services

• mantraUSD — a proprietary stablecoin backed by short-term US Treasury obligations;
• Pyse E-Bike Fleet — the first proprietary tokenization product, launched on 26 August 2025, a fleet of electric vehicles in the UAE and India;
• Google Cloud — the principal validator and infrastructure partner since October 2024;
• Binance — admitted to the network's active validator set;
• NVNM Chain — a second-layer network for artificial intelligence agents, launched jointly with Inveniam in May 2026.

5.3 Conclusions

• The coin is indispensable to the network's operation — without it one cannot make a transaction and cannot become a validator.
• The coin is not needed for the tokenization business: the license sits with a separate legal entity, and the assets are issued by third-party issuers.
• There is no additional utility: neither yield from revenue nor any application beyond the network.

To the methodology's question "Who will buy this coin, and why?" the answer today is: the buyer is whoever intends to be a validator or a delegator. Demand from network users is measured in seven hundred transactions per day, and demand from the tokenization business is absent by construction. Staking creates demand, but that demand is closed on itself: coins are bought in order to receive coins.

6. Coin circulation

6.1 How the coins move

1. Inflow into circulation:

• Emission — 1.30bn MANTRA per year at a rate of 16%, the primary and permanent source;
• Linear unlock of the pre-seed through October 2027 and of staker incentives through October 2028;
• The team cliff on 23 April 2027, after which about 600m coins are released linearly over thirty months;
• A one-off arrival of 720.9m coins from the emptied burn address in August 2026.

2. Withdrawal from circulation:

• There are no protocol-level withdrawal mechanisms: no burn, no buyback with destruction and no collateral locks are provided for.

A separate case is the bought-back coins. They are not destroyed but staked by the project's validator set, meaning they remain in supply and continue to generate emission income for their owner. Economically this is a movement of coins from the market to the issuer, not a reduction in supply.

6.2 Risks

• Emission of 16% per annum with a complete absence of absorption mechanisms: all new supply must be bought up by organic demand, the source of which is not apparent.
• Reversibility of the burn: the address holding the burned coins was emptied, and the project did not track its outgoing transactions.
• Opacity of addresses: the treasury, team and vesting contracts are not publicly labelled, and adherence to the schedule cannot be verified.
• Regulatory risk at venues: the three largest Korean exchanges have kept the coin on a delisting watch list since 21 August 2026.
• Ownership uncertainty: the deal to acquire the project by Inveniam was announced on 16 June 2026, but its formal closing has not been publicly confirmed.

7. Critical remarks

• The crash of 13 April 2025 has never been assigned an established cause. Within a few hours the coin lost between 90 and 94% of its value — from $6.14 to $0.52 in the units of the time — and capitalisation contracted by roughly $5.4bn. Futures liquidations exceeded $50m, open interest fell from $345m to $130m. The established fact: beginning on 7 April, 43.6m OM, about $227m, were moved onto exchanges from no fewer than seventeen wallets. Who owned those wallets has not been publicly established: the labelling by an analytics service that linked two addresses to a strategic investor was denied by that investor. The project attributes the crash to reckless forced liquidations by exchanges; the exchanges point to cross-exchange liquidations and to coordinated activity across addresses. No independent investigation has published any findings: the project's own investigation has not been disclosed, and the Inveniam investigation was conducted by a shareholder and acquirer, that is, an interested party, and its full text has not been published. Allegations of an organised dump by the team have received no evidentiary support and are not endorsed in this audit.
• The burn turned out to be reversible. The 300m OM burned on 29 April 2025 sat at an address that the project had not included in its monitoring, treating it as immobile. On 20 August 2026 the address was emptied together with a dormant multisig wallet: 720.9m MANTRA worth about $3.6m was stolen, of which 94.7% was withdrawn to a single exchange deposit address in fifteen transactions. The theft went unnoticed for about four hours. Nothing has been recovered. The deflationary effect of the single measure the project adopted after the crash has been annulled.
• The patch had been available for twenty hours before the attack. The ASA-2026-002 vulnerability in the Cosmos EVM module is the same one that in January 2026 cost another network about $7m. The attack on MANTRA began roughly twenty hours after the fix was published. The project's position: twenty hours is not enough to assess, build, test and coordinate an upgrade across 38 independent validators. There is a mitigating circumstance on the vendor's side as well: Cosmos Labs acknowledged that it had previously closed this defect in error as non-dangerous.
• The declared tokenisation is not confirmed on-chain. The agreement with DAMAC for no less than $1bn was announced in January 2025, the agreement with MAG for $500m in July 2024. On-chain, as at the snapshot date, $370.9k of assets have been issued, and both issuers are third-party companies. In May 2025 the MAG partner concluded a $10bn deal with a competing network covering the same properties. The gap between declared and executed exceeds four thousand times.

• Governance works formally and is substantively absent. The voting module functions: 34 proposals from October 2024 to August 2026. All 34 were passed, none rejected. The active validator set is capped at 38 against 92 registered, and the Hacken audit separately noted the use of a single external address in the role of network administrator. This is coordination of upgrades by validators, not adversarial governance.
• Audit findings were accepted rather than remediated. Of the sixteen findings in the Hacken audit of November 2024, including one critical and one of high severity, two were remediated; fourteen were moved to accepted-risk status. The Code4rena contest produced four more high-severity findings. The project has not launched a public bug bounty programme.

At the same time, two of the project's assets withstood verification. VARA licence number VL/25/02/001 was indeed issued to a subsidiary legal entity on 19 February 2025, appears in the regulator's public register as active, and covers exchange, broker-dealer and investment services. The acquisition of the project by Inveniam Capital Partners was officially announced, and the buyer is not a random market participant but a company that invested $20m in the project a year earlier. These are real assets, and any revaluation of the project will rest on them.

8. Final conclusion

MANTRA sets the audit a rare task. Usually one has to determine whether a product's success is transferred to the coin. Here one first has to determine whether the product exists. The network runs, validators validate, the licence is in force, first-tier partners are real — and yet over two years the mainnet has processed 277 thousand transactions, issued $370.9k worth of assets and gathered 11.5 thousand addresses. The infrastructure is built, there is no load on it.

The coin's link to the network, meanwhile, is strong and genuine. Gas is paid only in MANTRA, you cannot become a validator without it, you cannot obtain a share in governance without it. The problem is that this link leads in the wrong direction: it connects the coin to the infrastructure, not to the business. The VARA licence belongs to a separate legal entity, tokenised assets are issued by Ondo and Circle, and settlements on them are not in the coin. If tomorrow tokenisation in the UAE goes the way the press releases of 2024 and 2025 promised, a MANTRA holder will get from it exactly as much as the increased gas spend brings.

Against this stands emission of 16% per annum, fixed in the network parameters and diverging from the project's own documentation by more than fivefold. There is not a single absorption mechanism. The only one that existed — the burn of 300m coins after the crash — was cancelled by a theft from an address the project was not monitoring. The buyback programme does not reduce supply: the coins return to the issuer and are staked. The dilution headroom to the cap is exhausted in roughly fifteen months, and what will secure the network after that has not been publicly described.

April 2025 remains unresolved. It has been established that a significant volume of coins moved onto exchanges before the crash; it has not been established who owned it. The project and the exchanges have been publicly accusing each other for a second year, there is no independent arbiter, and the two existing investigations were conducted by interested parties and not published. For a holder this means that the risk that materialised in April 2025 has not been described and, consequently, has not been eliminated.

August 2026 showed the same pattern in miniature. The defect was known, the fix had been published, and the project had twenty hours. The network halted for thirty hours, the coins left the burn address, and nothing could be recovered. The complaint here is not about reaction speed — twenty hours to coordinate an upgrade among 38 validators is indeed little. The complaint is that the address holding the burned coins was not monitored at all.

The key question for MANTRA today is not "when will the price recover" but "will the coin acquire a source of demand unrelated to emission". The change of owner gives more grounds for this than anything over the past year and a half: Inveniam has capital, has private-market data and has a reason to take tokenisation through to real issuance. But as of the data snapshot date this is an intention, not a mechanism.

8.1 Recommendations for the project

1. 1

   Bring the stated inflation into line with the actual figure or explain the discrepancy.

   The documentation names 3%, the network parameter equals 16%. For a project that builds its positioning on regulatory compliance, a 5.3x divergence of the principal monetary parameter from its own documentation is not a technical inaccuracy but direct grounds for distrust of every other published figure.

2. 2

   Disclose the addresses of the treasury, team allocation and vesting contracts.

   Today the vesting schedule is published, but execution against it cannot be verified because not a single address is labelled. The only disclosed address of the project is the burn address, and that is exactly the one that was emptied. Address disclosure is the cheapest possible measure and the only one that makes published promises verifiable.

3. 3

   Create a supply absorption mechanism independent of emission.

   Against 1.30bn new coins a year there stands nothing. Burning a share of fees, buybacks with destruction instead of staking, or collateral lock-up against asset issuance — any of these mechanisms would give the coin the first link in its history between network usage and supply.

4. 4

   Describe what will happen when the cap is exhausted.

   The emission headroom runs out in roughly fifteen months, after which there will be nothing with which to pay for network security. No public plan for transitioning to paying for security out of fees exists, and at 726 transactions per day fees will clearly be insufficient for this.

5. 5

   Take at least one of the announced tokenisation deals through to real issuance on the network.

   The gap between $1.5bn announced and $370.9k executed is the main source of distrust towards the project, and it is closed not by press releases but by the first asset of a material size visible on-chain.

6. 6

   Remediate the accepted audit findings and launch a public vulnerability disclosure programme.

   Fourteen findings in accepted-risk status with one critical and five of high severity is not residual risk but deferred risk. The August incident showed that deferred risk materialises.

7. 7

   Publish reporting on the buyback programme.

   No less than $45m was announced, periodic reports and address publication were promised; no consolidated reports have appeared over the year. An unfulfilled promise of reporting devalues the programme itself.

8.2 Important notes for investors

1. 1

   The coin should be valued separately from the project's business.

   The VARA licence, the partnership with Google Cloud and the Inveniam deal are assets of the group's legal entities, not of the coin holder. There is no mechanism in the model by which their value passes to the coin.

2. 2

   A holder is diluted by 16% a year, and this is a verifiable network parameter, not an estimate.

   Staking compensates for dilution but does not create income: the share is preserved, the value is not. A non-staking holder loses 16% of their share annually.

3. 3

   The main indicator to track is the volume of assets actually issued on the network.

   Today it is $370.9k. Growth of this figure to amounts comparable with those announced will be the first evidence that the model has started to work. Press releases about new agreements are not such evidence.

4. 4

   The second indicator is the appearance of a supply absorption mechanism before the cap is exhausted.

   The timeframe is roughly fifteen months. Its absence by that point should be regarded as confirmation of the current model.

5. 5

   Venue risk is real and near.

   The three largest Korean exchanges have kept the coin on a delisting watch list since 21 August 2026, and as of the snapshot date no decision has been taken. Delisting on one of the key retail markets would hit liquidity directly.

6. 6

   The cause of the April 2025 crash has not been officially established.

   The project's dispute with the exchange is in its second year, and there is no independent investigation. A position should be assessed taking into account that the mechanism that led to the loss of 90% of value within hours has not been publicly described.

7. 7

   What is burned can come back.

   The August incident showed that coins at the project's burn address were neither protected nor monitored. Any future statements about burns are worth checking for the mechanism by which irreversibility is ensured.

MANTRA Rating under the 8Blocks Methodology

Final rating: 22 / 100. Letter rating: CC.

Interpretation. Token Product Linkage 1.32 — the No / Very Weak Linkage category. The coin's link to the network is strong: gas is paid only in MANTRA, and one cannot become a validator without it. The coin's link to the tokenization business the network was built for is absent: the license belongs to a separate legal entity, assets are issued by third-party issuers, and settlements on them are not made in the coin. A value below 2.0 triggers a methodology constraint — a cap of 45 points on the final score — but the actual score is below the cap, so it does not apply.

Penalty for the security incident. The methodology applies a penalty when all three conditions are met: material losses, incomplete reimbursement, and retention of the vulnerable mechanism in the current version. The exploit of 20 August 2026 satisfies all three: 720.9m MANTRA were stolen, nothing was returned, and the project's addresses are still not under monitoring. The penalty is 3.00 points out of a maximum of five.

Strengths: an active VARA license, the technical necessity of the coin for the network's operation, the presence of a buyer with capital and domain expertise, a functioning governance module, and a publicly published vesting schedule.

Weaknesses: 16% annual emission with a complete absence of absorption mechanisms, a 5.3x discrepancy between the actual parameter and the documentation, the reversibility of the single burn carried out, a gap between declared and actual tokenization of more than four thousand times, undisclosed treasury and team addresses, and fourteen accepted audit findings.

What must change for the rating to improve. The appearance of any mechanism that removes coins from circulation independently of emission would raise the tokenomics sustainability block. A first issuance of tokenized assets in a material amount on the project's own network with settlements in the coin would raise Token Product Linkage. Disclosure of treasury addresses and remediation of the accepted audit findings would raise governance and security. Each of these changes is verifiable on-chain.

Robustness of the score. Under conservative assumptions the rating is 19 points, under optimistic assumptions 26. The upper bound moves into the CCC category, so the letter rating on the data of this snapshot is not robust: it sits on the boundary between two categories.

Confidence in the score: 74 / 100 (Medium). Key limitations: unlabeled treasury and team addresses make it impossible to verify execution of the vesting schedule; the 6.9x discrepancy in daily trading volume estimates between sources has not been resolved; the results of both investigations into the April crash have not been published.

Data snapshot date: 9 September 2026.

What this means for UAE-based token projects

Three points travel from this audit to any project building a token model out of Dubai or Abu Dhabi.

• A licence is not a token utility. VARA licences the operating company; ADGM does the same under its own framework. If the coin is not required to settle the licensed business, the licence adds credibility to the company and nothing to the coin.
• Announced volumes are checked on-chain now. The $1.5bn of announced real-estate tokenization against $370.9k actually issued is publicly verifiable, and regional regulators as well as counterparties read the same explorers. A press release is the weakest form of evidence.
• Monetary parameters must match the documentation. A network parameter of 16% against 3% in the project's own docs would be a finding in any VARA or ADGM review of disclosure materials, regardless of how the rate itself is judged.

We run these model reviews out of Dubai, so if your token is licensed here we can go through the unlock schedule, the absorption side and the disclosure set in one pass.

Appendix. Data sources

Discrepancies between sources. First: daily trading volume is $2.55m according to CoinGecko and $17.58m according to CoinMarketCap, a 6.9-fold difference. The audit uses the conservative CoinGecko estimate, since the second figure would imply a turnover of 62% of market capitalisation per day, incomparable with the network's activity. Second: the project's documentation states annual inflation of 3%, whereas the mint module parameter in the live network equals 0.16. The actual network parameter is used; the discrepancy is disclosed in section 4. Third: the volume stolen in the exploit is reported in various communications within a range of 720 to 730m coins; the value of 720.9m is used, confirmed by the sum of the withdrawal transactions.