Quantum Audit Logo
Launch App

Early-stage security check — honeypot & rug-pull analysis

Is BURN a Scam?

BNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Nov 5, 2026 · 1 audit on recordNew Launch · 8h old
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance5/10Upgrades8/10Checks passed5 of 7Findings3 Medium · 1 Low · 6 Info10
SummaryAI Copilot

The FlapDirectTaxToken is an EIP-1167 minimal clone implementing standard ERC-20 functionality with custom tax and anti-sniper mechanisms.

Read the full analysis
What raised the score
  • Owner can change the buy/sell tax
  • A privileged address can change transfer or wallet limits
  • Liquidity < $50k
  • Volume/Liquidity > 15×
  • Code: ETH trapped in contract
  • Code: Use of tx.origin for authorization
Exact factors
  • Owner can change the buy/sell tax
  • A privileged address can change transfer or wallet limits
  • Liquidity < $50k ($11,537 across 1 pairs — thin market)
  • Volume/Liquidity > 15× (21.1× — wash-trading signal)
  • Code: ETH trapped in contract (Medium, static analysis)
  • Code: Use of tx.origin for authorization (Medium, static analysis)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Early-stage analysis. This token has limited on-chain history (8h old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.

Security Checklist

as of audit · Nov 55 of 7 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockLocked
UpgradeabilityFixed code
HoneypotNone found
Buy / sell tax2% / 2%

Holders

as of audit · Nov 5, 2026161 holders
4.1%14.7%Wallets19.1%Burned33.7%DEX pools28.4%Everyone else
14.7%19.1%33.7%DEX pools28.4%Everyone else
ContractsWalletsBurnedDEX poolsEveryone elseBubble area = share of supply
71.6%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking4.1%
  • Walletsanonymous holders, free to sell14.7%
  • Burnedout of circulation19.1%
  • DEX poolsthe pools' own liquidity33.7%
  • Everyone else151 holders28.4%
Effective concentrationwhat the score reads16.3%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Nov 5, 2026

Liquidity

as of audit · Nov 5$11.5K

The risk score reads depth across every pair.

LP tokensLocked

The LP tokens of the analysed pool are locked or burned.

Analysed pool$11.5KShare of depth100.0%
LP Burned100.0% · ≈ permanent lock
LP Locked100.0% · Null Address

Security Findings

3 Medium1 Low6 Info
Medium

ETH trapped in contract

The contract can receive ETH but lacks any function to withdraw or transfer it, meaning any funds sent to the contract address will be permanently locked.CD-01

Issue

The contract can receive ETH but lacks any function to withdraw or transfer it, meaning any funds sent to the contract address will be permanently locked.

Fix

Add a restricted function to allow the owner to withdraw accidentally sent ETH.

Status

Unresolved

Medium

Use of tx.origin for authorization

The _getTaxWithPoolState function uses tx.origin to determine tax rules, which is vulnerable to phishing attacks where a user is tricked into interacting with a malicious contract that then calls the token contract.CD-02

Issue

The _getTaxWithPoolState function uses tx.origin to determine tax rules, which is vulnerable to phishing attacks where a user is tricked into interacting with a malicious contract that then calls the token contract.

Fix

Replace tx.origin with msg.sender to ensure that the immediate caller is the one being authorized.

Status

Unresolved

Medium

Owner can modify transfer fees

The finalizeMigration function allows the owner to set and modify the tax rates applied to token transfers, directly impacting the economic cost for users.CP-07

Issue

The finalizeMigration function allows the owner to set and modify the tax rates applied to token transfers, directly impacting the economic cost for users.

Fix

Implement a timelock or a maximum fee cap to prevent sudden, unexpected changes to the tax structure.

Status

Unresolved

Low

Owner can modify transfer and wallet limits

The finalizeMigration function allows the owner to adjust numeric limits such as anti-sniper windows and launch parameters, which dictate how users can interact with the token.CP-08

Issue

The finalizeMigration function allows the owner to adjust numeric limits such as anti-sniper windows and launch parameters, which dictate how users can interact with the token.

Fix

Document these parameters clearly in the UI and consider making them immutable after the launch phase.

Status

Unresolved

Info

Who holds the supply

The ten largest holders own 71.6% of supply. Of that, 19.1% burned, 33.7% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 14.7% in wallets, 4.1% in other contracts. 161 holders in total.QA-HOLDERS

Issue

The ten largest holders own 71.6% of supply. Of that, 19.1% burned, 33.7% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 14.7% in wallets, 4.1% in other contracts. 161 holders in total.

Fix

Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

Status

Acknowledged

Info

Not listed by any independent source

161 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.QA-IDENTITY

Issue

161 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.

Fix

Match the contract address against the project's official channels before trading.

Status

Acknowledged

Info

Liquidity burned — cannot be withdrawn

100.0% of the pool's LP is burned or time-locked. 100.0% of the LP tokens were sent to a burn address — that liquidity can never be withdrawn by anyone.QA-LIQUIDITY

Issue

100.0% of the pool's LP is burned or time-locked. 100.0% of the LP tokens were sent to a burn address — that liquidity can never be withdrawn by anyone.

Fix

Check the lock's end date and beneficiary on the locker's own page before relying on it.

Status

Acknowledged

Info

The market for this token

Liquidity $12K (DexScreener, all pools). 24h trading volume $244K (DexScreener, all pools).QA-MARKET

Issue

Liquidity $12K (DexScreener, all pools). 24h trading volume $244K (DexScreener, all pools).

Fix

Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

Status

Acknowledged

Info

Asset class: Project token

A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: a role-controlled contract. Code: not upgradeable (no proxy). Fees: 2% on buy, 2% on sell. Market: $12K of DEX liquidity across 1 pools. Launch: under a day of market history.QA-PROFILE

Issue

A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: a role-controlled contract. Code: not upgradeable (no proxy). Fees: 2% on buy, 2% on sell. Market: $12K of DEX liquidity across 1 pools. Launch: under a day of market history.

Fix

Check the project's own documentation for what the token is used for; this report covers what the contract allows.

Status

Acknowledged

Info

Recently launched — less than a day of market history

The token's oldest DEX pool is less than a day old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.QA-RECENT

Issue

The token's oldest DEX pool is less than a day old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.

Fix

Re-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.

Status

Acknowledged

Analysis

AI Copilotas of audit · Nov 5
Executive SummaryWhat the contract is and what the review found

The FlapDirectTaxToken is an EIP-1167 minimal clone implementing standard ERC-20 functionality with custom tax and anti-sniper mechanisms. The contract is not upgradeable, providing immutability for the logic, but the owner retains significant control over economic parameters via migration functions. Key risks include the inability to recover trapped ETH and the use of tx.origin for authorization, which may introduce security vulnerabilities in specific interaction patterns.

Technical8/10Low risk

The architecture utilizes EIP-1167 clones for gas-efficient deployment, ensuring the logic remains immutable post-deployment. 7.1 Architecture and 7.2 Code Security are generally sound, though the use of tx.origin in _getTaxWithPoolState is a known anti-pattern that can be exploited by malicious contracts. 7.3 Access Control is strictly enforced via Ownable, but 7.6 External dependencies rely on an oracle that could potentially be misconfigured.

Governance5/10Medium risk

7.4 Economic and 7.5 Governance aspects are centralized under the contract owner. The owner has the authority to finalize migration, which triggers tax enforcement and anti-sniper windows. While this allows for controlled launches, it grants the owner significant influence over token transferability and fee structures.

Upgrades8/10Low risk

7.7 Upgrades are not applicable as the contract is an EIP-1167 minimal clone, meaning the implementation logic is fixed at deployment. 7.8 Operations are stable, but the lack of an emergency withdrawal mechanism for ETH limits operational flexibility.

Final RecommendationWhat to do about this score

It is recommended to implement an emergency withdrawal function to recover any ETH accidentally sent to the contract.

Additionally, refactor the authorization logic to use msg.sender instead of tx.origin to prevent potential cross-contract manipulation vulnerabilities.

Contract & Record

1 audit on record
TypeFlapDirectTaxToken
NetworkBNB Chain
Token age8h
Contract0x39ac…7777
Deployer0x9ced…3ccf
Badge for your website
BURN security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Nov 5, 202648Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
DAPPOSDOS · BNB Chain48MediumHuma FinanceHUMA · BNB Chain47MediumCapBNB Chain49MediumDGrid AIDGAI · BNB Chain46MediumHoloworld AIHOLO · BNB Chain50Medium金蟾JIN · BNB Chain45Medium

Would You Like a More Detailed Audit of BURN?

This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.

Get Detailed Audit Is this your token? Add your links and get it Verified