On-chain security analysis — is it a scam or legit?
SolanaThe CASH token exhibits significant centralization risks due to active mint, freeze, and permanent delegate authorities.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Solana holder types come from the account itself: a program-derived account (no private key — vaults, vesting, pools) counts as a contract; anything else is a wallet. DEX pools are matched to the token's own pools and left out of the concentration the score reads.
Holder balances as recorded by the audit of Nov 8, 2026
The risk score reads depth across every pair.
Whether the LP tokens are locked could not be determined.
The mint authority is . The holder of this key can mint unlimited new tokens, diluting all current holders to zero value.
Verify on-chain that the mint authority is set to null before treating supply as fixed.
Unresolved
The freeze authority is . The holder can freeze any holder's account, blocking transfers and effectively confiscating funds.
Avoid tokens whose freeze authority is not revoked unless the issuer is a regulated stablecoin operator.
Unresolved
has permanent delegate authority and can transfer any holder's tokens without consent.
Treat this token as fully custodial.
Unresolved
The ten largest holders that can sell hold 77.30% of supply. Coordinated sell-off would crash price; single-whale dumps are common in this range.
Monitor top holder activity for potential exit liquidity events.
Unresolved
GoPlus balance_mutable is True, indicating a balance-mutating authority can adjust user balances.
Review the token program configuration to identify the specific authority responsible for balance adjustments.
Unresolved
Token name, symbol, or image can be changed post-launch.
Verify metadata against off-chain expectations before trusting branding.
Unresolved
The ten largest holders own 84.7% of supply. Of that, 7.4% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 74.9% in wallets, 2.4% in other contracts. 689,003 holders in total. For a verified reference asset the largest holders are custodians, exchanges and bridges; concentration is reported, not scored.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as CASH (CASH), market cap $130M, rank #223. 689,003 holders. Verified by: CoinGecko.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $7.0M (DexScreener, all pools). 24h trading volume $4.2M (CoinGecko, all markets, daily snapshot). 24h trading volume $1.7M (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
The contract lets its controller — the freeze authority — mint new supply; change any holder's balance (seize or credit tokens); freeze or blacklist individual addresses; destroy the contract; change the token's name, symbol and image. These are the issuer's controls by design; for a verified issuer they are counterparty risk — the issuer can act on any holder, including you.
Check who holds these powers and whether a timelock or multisig stands between them and holders.
Acknowledged
A token designed to hold a fixed value (usually $1). Its safety rests on what backs it and on who can mint, freeze or pause it. Scored as an established reference asset: its identity is verified, so the issuer's or protocol's controls (listed as findings) are real and are priced once as counterparty risk, and LP locks and holder concentration are not scored — its pools belong to market makers and its largest holders are exchanges, bridges and custody. Basis: CoinGecko category: Stablecoins. Tokenomics — Supply: issued and redeemed by the issuer against its backing. Control: the freeze authority. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $7.0M of DEX liquidity across 9 pools. Launch: 421 days of market history.
Check what backs the peg and who controls supply: reserve attestations for an issuer-backed coin, collateral and governance for a protocol coin.
Acknowledged
The CASH token exhibits significant centralization risks due to active mint, freeze, and permanent delegate authorities. The top 10 holders control 77.30% of the supply, creating high concentration risk. All requested data sources were successfully retrieved, confirming these administrative privileges remain enabled.
The token utilizes the Token-2022 program with several sensitive extensions enabled. 7.1 Architecture is defined by the SPL standard, while 7.3 Access Control is compromised by active mint and freeze authorities. 7.2 Code Security is not applicable as this is a configuration-based mint. The presence of a permanent delegate allows for arbitrary fund movement, representing a significant custodial risk.
7.4 Economic analysis shows high holder concentration with the top 10 holders controlling 77.30% of supply. 7.5 Governance is centralized under the current authority holders. Liquidity is robust at $6.9M, and the 421-day pair age indicates a mature market presence. 7.6 External signals confirm high-risk flags regarding developer control.
7.7 Upgrades are not applicable in the EVM sense, but 7.8 Operations are impacted by mutable metadata and the ability to update transfer hook logic. The mint authority and freeze authority remain active, allowing for ongoing changes to token supply and account status. Metadata mutability allows for branding changes post-launch.
Investors should exercise extreme caution due to the presence of a permanent delegate and active freeze authority.
Verify the current status of these authorities on-chain before interacting with the token. Monitor the top 10 holder wallets for significant movement and track the activity of the mint and freeze authority addresses. Avoid holding large positions unless the project provides a clear roadmap for the revocation of these administrative privileges.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
