On-chain security analysis — is it a scam or legit?
EthereumThe AstraAI token is a standard ERC-20 implementation with additional tax and liquidity management features.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Nov 7, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x3049…8a240xa245…8e5f0x1f2f…f3870xd603…08a9A privileged address — the deployer, the owner, or the token contract itself — is among these holders, so that party can withdraw liquidity.
0.0% of the pool's LP is burned or time-locked. 85.8% still sits in UNCX, but that lock expired on 12 Jun 2026 — its owner can withdraw it at any moment. 14.2% is held, unlocked, by the token's owner/deployer (0x3049…8a24, 0xd603…08a9) — they can pull that liquidity at any moment. This is the rug-pull path.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The manualSwap function allows the marketing wallet to trigger token swaps and withdraw ETH at will. This function acts as a switch that can influence the token's liquidity and price stability.
Implement a time-lock or a more automated, decentralized mechanism for triggering liquidity swaps to reduce reliance on a single wallet.
Unresolved
The blacklist function allows the owner to prevent specific addresses from transferring or selling tokens. This creates a risk where holders can be arbitrarily restricted from accessing their assets.
Remove the blacklist functionality or restrict it to only address malicious actors via a transparent, community-voted process.
Unresolved
The owner can change buy and sell fees at any time using updateBuyFees and updateSellFees. This allows for potential 'honeypot' scenarios or sudden changes to the tokenomics.
Set a hard cap on the maximum fee percentage that can be set and consider using a time-lock for any fee adjustments.
Unresolved
The swapAndLiquify function performs division before multiplication, which can lead to precision loss in token calculations.
Always perform multiplication before division to maintain maximum precision in financial calculations.
Unresolved
The swapTokensAtAmount threshold can be modified by the owner, which affects how often the contract triggers liquidity swaps. This can be used to manipulate the frequency of automated market activity.
Define a fixed range for this threshold in the contract to prevent extreme adjustments.
Unresolved
The ten largest holders own 37.2% of supply. Of that, 2.0% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 6.4% in wallets, 28.8% in other contracts. 3,981 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as AstraAI (ASTRA), market cap $5M, rank #1677. 3,981 holders.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $199K (DexScreener, all pools). 24h trading volume $131K (CoinGecko, all markets, daily snapshot). 24h trading volume $89K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $5.25 on 2024-03-13; the price is now 90.5411% below it.
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: a 5-of-9 multisig. Code: not upgradeable (no proxy). Fees: 5% on buy, 5% on sell. Market: $199K of DEX liquidity across 1 pools. Launch: 1103 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The AstraAI token is a standard ERC-20 implementation with additional tax and liquidity management features. The contract exhibits high centralization, as the owner maintains significant control over transfer logic, fees, and blacklisting capabilities. While the code is functional and follows standard patterns, the presence of administrative backdoors necessitates caution for potential investors.
The architecture follows a standard ERC-20 structure with integrated tax logic. 7.1 Architecture and 7.2 Code Security are generally sound, utilizing OpenZeppelin standards. However, 7.3 Access Control is highly centralized, allowing the owner to modify core transfer mechanics at will. 7.6 External interactions are limited to standard DEX router calls.
7.4 Economic and 7.5 Governance are heavily skewed toward the contract owner. The owner can unilaterally adjust buy/sell fees and blacklist addresses, directly impacting token liquidity and holder access. These mechanisms create a high degree of trust dependency on the project deployer.
7.7 Upgrades are not supported as the contract is not a proxy. 7.8 Operations are managed via owner-restricted functions, which are transparent but carry significant centralization risks. No further upgradeability concerns exist.
Investors should be aware that the contract owner possesses the ability to modify transfer rules, blacklist addresses, and adjust fees at any time.
We recommend that the project team considers transitioning ownership to a decentralized governance model or a time-locked multisig to mitigate these centralization risks. For the development team, we suggest implementing a more transparent fee structure and removing the ability to blacklist individual holders to increase trust. Additionally, ensure that all mathematical operations are checked for potential rounding errors to maintain precision in tax calculations.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
