Most new tokens are bought within days of launch, long before anyone reads the contract. This report measures new token launch risks directly: 368 tokens that were less than a week old when Quantum Audit analysed them between 20 September and 20 October 2026, on Solana, BNB Chain, Base and Ethereum. Every figure below is a share of the tokens on one network, with the number of tokens behind it. The picture differs sharply by chain. On Solana, the controls that let a creator print or freeze supply are almost always gone, and the open question is liquidity. On Base, one new token in three can still mint more supply, and almost none lock their liquidity.
How the sample was built
The sample is every token on the public token security dashboard that was under seven days old at the moment of analysis and was analysed between 20 September and 20 October 2026. Tokens reach the dashboard through a daily selection of actively traded new tokens, so this is a picture of launches that found buyers, not of every contract deployed that month. The median token was 35 hours old when it was analysed.
Each token was read once, at that moment: who can still mint supply or freeze holders, whether the liquidity of its pools was locked or burned, how the supply was spread across holders, and what taxes apply to a buy or a sale. The risk score combines those facts; it is computed by a deterministic function, and the scoring methodology lists every factor and how it moves the score.
Three limits apply to every number here:
- A snapshot, not a history. A token analysed at hour 30 may have locked its liquidity at hour 40. Each figure describes the token at the time of analysis.
- Unknown is reported as unknown. When a fact could not be read, it is counted in its own column, never as a pass.
- Not a honeypot census. The daily selection skips tokens with an obvious sell block, so honeypot rates are not measured in this sample.
Arbitrum and Polygon are left out: too few tokens in the period had a complete set of facts. The full per-token dataset is published as a CSV file, one row per token with a link to its record.
Four networks, four different risk profiles
| Network | Tokens | Can still mint | Liquidity not locked or burned | Top-10 wallets hold over 30% | High or Critical risk | Median score |
|---|---|---|---|---|---|---|
| Solana | 266 | 0.8% | 26.7% | 11.1% of 63 readable | 1.2% | 16 |
| BNB Chain | 32 | 6.2% | 56.2% | 9.4% | 6.2% | 27 |
| Base | 29 | 34.5% | 96.6% | 32.1% of 28 readable | 41.4% | 57 |
| Ethereum | 41 | 12.2% | 65.9% | 7.3% | 19.5% | 27 |
"Top-10 wallets" counts personal wallets only, not pools, lockers or burn addresses, and only for tokens whose holder list could be read in full — on Solana that was 63 of 266 tokens. Risk levels follow the published ladder: Low below 35, Medium below 65, High below 85, Critical from 85.
Solana: the creator's levers are closed, liquidity is not
On Solana, the two powers that matter most in a new token — the mint authority and the freeze authority of the token's mint: the first can print supply, the second can lock any holder's balance — were still active on 0.8% of tokens each. That is mostly a launchpad effect: 180 of the 266 Solana tokens (68%) were launched through pump.fun, which revokes both authorities by default.
Liquidity is where Solana tokens differ. Across the network, 26.7% of new tokens had pool liquidity that was neither locked nor burned at the time of analysis. Split by origin, the gap is wide:
| Solana launches | Tokens | Liquidity not locked or burned |
|---|---|---|
| Launched through pump.fun | 180 | 17.8% |
| Launched elsewhere | 86 | 45.3% |
A Solana token launched outside pump.fun was about two and a half times as likely to have liquidity its creator could still withdraw. Holder concentration was moderate where it could be measured: the median share of the ten largest personal wallets was 21%, and 11.1% of tokens had more than 30% in those ten wallets. Only 1.2% of new Solana tokens scored High or Critical.
Base: one new token in three can still mint
Base produced the riskiest new tokens in the sample, on a small base of 29 tokens. A third of them (34.5%) could still mint more supply; for another 24.1% the mint right could not be determined. Liquidity was locked or burned on one token out of 29 — 96.6% had pool liquidity that could still be withdrawn. Concentration was higher too: in 32.1% of tokens with a readable holder list, the ten largest personal wallets held more than 30% of the supply, and in 21.4% they held more than half.
Ownership tells the same story from another angle: 34.5% of Base tokens had renounced ownership, 20.7% kept it, and for 44.8% the owner could not be identified. With these facts combined, 41.4% of new Base tokens scored High risk and the median score was 57, in the Medium band.
BNB Chain: taxes are common, mostly small
On BNB Chain the distinctive feature is the transaction tax. 43.8% of the 32 new tokens charged a buy or sell tax; none charged more than 10%. Every contract had its source code verified, 59.4% had renounced ownership, and 6.2% could still mint. Liquidity was not locked or burned on 56.2% of tokens. Most scored Low (56.2%) or Medium (37.5%), with a median score of 27.
Ethereum: verified code, unlocked liquidity
All 41 new Ethereum tokens had verified source code, and 12.2% could still mint. That figure includes tokens whose issuer mints by design — wrapped and tokenized assets, where supply follows deposits — which also explains part of the 19.5% that scored High or Critical: a retained mint right is a risk to holders whoever holds it. Liquidity was not locked or burned on 65.9% of tokens. Concentration was the lowest of the four networks: in only 7.3% of tokens did the ten largest personal wallets hold more than 30%.
What to check before buying a token in its first week
The data points to different first checks on different networks:
- Solana: mint and freeze are usually revoked, so start with liquidity. Is the pool's liquidity burned or locked, and was the token launched through a launchpad that does this by default? Then look at who the largest holders are.
- Base: start with the mint right and the owner. Can supply still be minted, is ownership renounced, and who holds the top of the supply?
- BNB Chain: read the taxes, and whether the owner can change them after launch.
- Ethereum: if the token can mint, find out who holds that right and whether that is the token's stated purpose.
Each of these facts is shown, dated, on every record of the token security dashboard, next to the score it produced.
About this report
Quantum Audit is an automated smart-contract security analysis platform for Web3 that reads a token's contract and on-chain facts and publishes the result as a dated public record. This report is the first in a monthly series on new token launch risks; each edition uses the same definitions, so the figures can be compared month to month. The data may be cited with a link to this page. Token teams that want their own token's record kept current for investors can use the Founder plan: $149 for 12 months, one token.
FAQ
How risky are new tokens on Solana compared with Base?
New token launch risks in this sample differ sharply by network. On Solana, 0.8% of new tokens could still mint and 1.2% scored High or Critical. On Base, 34.5% could still mint, 96.6% had liquidity that could be withdrawn, and 41.4% scored High. The Base sample is small (29 tokens), so its shares move more from month to month.
What share of new tokens lock or burn their liquidity?
It depends on the network: 73.3% of new Solana tokens had locked or burned liquidity at the time of analysis, 43.8% on BNB Chain, 34.1% on Ethereum and 3.4% on Base. On Solana, tokens launched through pump.fun did so far more often than others.
How was this data collected?
Each token was analysed once, when it was under seven days old, between 20 September and 20 October 2026. The facts come from the token's contract and its on-chain state at that moment; the risk score is computed from them by a deterministic function described in the methodology.
Can this data be reused?
Yes. The per-token dataset is published as a CSV file linked above, with a link to every token's record. Please cite this page as the source.