On-chain security analysis — is it a scam or legit?
PolygonThe ERC20F contract is a highly privileged, upgradeable token implementation.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 26, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x3d54…63810x9539…a0a80x01a7…8e2b0x173d…9afaThe recoverTokens(address,uint256) function allows privileged roles to move tokens from any user's wallet to the controller's address, effectively bypassing standard ownership.
Restrict this function to only recover tokens sent to the contract address itself, rather than allowing arbitrary withdrawal from user wallets.
Unresolved
The accessRegistryUpdate(address) function allows an admin to change the logic contract that governs all token transfers, potentially freezing or stealing funds.
Implement a time-lock on this function and ensure the registry contract is immutable or governed by a multi-sig.
Unresolved
The mint(address,uint256) function allows privileged roles to create new tokens at will, which can dilute the value of existing holdings.
Implement a hard cap on the total supply or require a governance vote for any minting operations.
Unresolved
0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 2 address(es) other than the owner/deployer. One of them — a contract, 0x3d54…6381 — holds 99.9% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The ten largest holders own 96.0% of supply. Of that, 2.7% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 89.2% in wallets, 4.1% in other contracts. 462 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as BRL1 (BRL1), market cap $3M, rank #1971. 462 holders.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $98K (DexScreener, all pools). 24h trading volume $993K (CoinGecko, all markets, daily snapshot). 24h trading volume $56K (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token designed to hold a fixed value (usually $1). Its safety rests on what backs it and on who can mint, freeze or pause it. Its identity is not independently verified, so it gets none of the allowances an established stablecoin gets: every power its owner holds over supply and transfers is scored in full, because a peg is only as good as whoever can mint. Basis: CoinGecko category: Stablecoins. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $98K of DEX liquidity across 3 pools. Launch: 586 days of market history.
Check what backs the peg and who controls supply: reserve attestations for an issuer-backed coin, collateral and governance for a protocol coin.
Acknowledged
The ERC20F contract is a highly privileged, upgradeable token implementation. It features extensive administrative control over token transfers, supply, and user balances. While the code follows standard OpenZeppelin upgradeable patterns, the centralization of power poses significant risks to token holders.
The architecture utilizes UUPS proxy patterns for upgradeability and integrates multiple modular components like AccessRegistry and Pause. 7.1 Architecture: Modular design with clear separation of concerns. 7.2 Code Security: Standard library usage is correct, but 7.3 Access Control is overly permissive for administrative roles. 7.6 External: The reliance on an external AccessRegistry contract introduces a single point of failure for all transfer logic.
7.4 Economic: The protocol allows for arbitrary minting and balance manipulation, which directly impacts token value and holder trust. 7.5 Governance: Administrative roles are centralized, lacking time-locks or multi-sig requirements for critical functions. 7.8 Operations: The ability to salvage tokens and gas provides operational flexibility but requires high trust in the operator.
7.7 Upgrades: The contract employs UUPS proxy patterns, which is the industry standard for upgradeable contracts. Upgrades are restricted to authorized roles, ensuring that only the protocol owner can modify the implementation. However, the lack of a delay mechanism for upgrades means that malicious or erroneous updates can be applied instantly.
It is strongly recommended to implement a multi-signature wallet or a decentralized governance DAO to manage the administrative roles.
This would mitigate the risk of a single compromised key causing catastrophic loss of funds or unauthorized token manipulation. Furthermore, consider adding a time-lock mechanism for all critical administrative functions, including contract upgrades and AccessRegistry changes. This provides the community with a window to react to potentially harmful changes.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
