On-chain security analysis — is it a scam or legit?
The ClankerToken is a standard ERC-20 implementation with cross-chain capabilities via the Superchain Token Bridge.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 28, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xca9f…1a8bNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a wallet, 0xca9f…1a8b — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The crosschainMint function allows the Superchain Token Bridge to create new tokens at will. This increases the total supply and dilutes the value of existing holdings. Ownership is renounced, so no one can call these functions now.
Document the minting policy clearly and ensure the bridge contract is secured by a multi-signature or decentralized governance mechanism.
Unresolved
The crosschainBurn function allows the Superchain Token Bridge to remove tokens from any user's balance. This grants the bridge controller the power to effectively seize or destroy user assets. Ownership is renounced, so no one can call these functions now.
Implement strict circuit breakers or timelocks on the bridge's ability to burn tokens to prevent unauthorized mass-burning of user funds.
Unresolved
The ten largest holders own 100.0% of supply. What remains: 2.0% in wallets, 98.0% in other contracts. 4,834 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
4,834 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $10.2M (DexScreener, all pools). 24h trading volume $61.3M (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $10.2M of DEX liquidity across 3 pools. Launch: 63 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The ClankerToken is a standard ERC-20 implementation with cross-chain capabilities via the Superchain Token Bridge. The architecture relies on the bridge contract for minting and burning, which introduces centralized control over the token supply. While the code follows standard OpenZeppelin patterns, the ability for the bridge to manipulate user balances represents a significant trust requirement.
The contract utilizes robust OpenZeppelin libraries for ERC-20, Votes, and Permit functionality. 7.1 Architecture is modular, leveraging standard cross-chain interfaces. 7.2 Code Security is high, with clean logic and minimal complexity. 7.3 Access Control is strictly enforced via the Superchain Token Bridge for cross-chain operations.
7.4 Economic risks are centered on the centralized minting/burning authority. 7.5 Governance is currently limited to a single admin address for metadata updates. The protocol lacks decentralized oversight for supply changes, creating a single point of failure regarding token inflation or balance manipulation.
7.7 Upgrades are not implemented in this contract, as it is a non-proxy deployment. The contract logic is immutable, which provides security against hidden logic changes. 7.8 Operations are straightforward, relying on the bridge for cross-chain state synchronization.
Users should be aware that the Superchain Token Bridge holds the authority to mint and burn tokens, which is a necessary feature for cross-chain functionality but requires trust in the bridge's security.
We recommend implementing a multi-signature wallet for the admin role to mitigate risks associated with single-key compromise for metadata updates. Ensure that the bridge contract address is correctly configured and monitored. Regular audits of the bridge infrastructure are essential, as the token's integrity is directly tied to the security of the cross-chain messaging protocol.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
