Is claus a Scam? New Token Security Check

Security Findings

1 Med1 Low9 Info

Medium

tx.origin Vulnerability in Transfer Logic

CD-02The `_transfer` and `balanceOf` functions use `tx.origin` to determine certain rules or authorizations. `tx.origin` refers to the original external account that initiated a transaction, not necessarily the immediate caller. A malicious contract could trick a user into interacting with it, and then that malicious contract could call the token's `_transfer` function, making it appear as if the user (the `tx.origin`) initiated the transfer directly, potentially bypassing intended access controls or rules.

IssueThe `_transfer` and `balanceOf` functions use `tx.origin` to determine certain rules or authorizations. `tx.origin` refers to the original external account that initiated a transaction, not necessarily the immediate caller. A malicious contract could trick a user into interacting with it, and then that malicious contract could call the token's `_transfer` function, making it appear as if the user (the `tx.origin`) initiated the transfer directly, potentially bypassing intended access controls or rules.

FixFor security-critical operations, `msg.sender` should always be used instead of `tx.origin`. `msg.sender` refers to the immediate caller, preventing intermediary contracts from impersonating the original transaction initiator. Users should exercise caution when interacting with unknown or untrusted contracts.

StatusUnresolved

Low

Minor Rounding Loss in Transfers

CD-01The `_transfer` function performs a division operation before a multiplication when calculating amounts. This order of operations can lead to small rounding losses, meaning a tiny fraction of tokens might be lost during certain calculations, though typically negligible.

IssueThe `_transfer` function performs a division operation before a multiplication when calculating amounts. This order of operations can lead to small rounding losses, meaning a tiny fraction of tokens might be lost during certain calculations, though typically negligible.

FixWhile the impact is usually minor, it's best practice to perform multiplication before division to maintain precision and avoid rounding errors. For future contracts, ensure arithmetic operations are ordered to minimize precision loss.

StatusUnresolved

Info

Dormant Control Over Transfer Switches

CP-05The contract *had* functions like `enableTrading`, `removeLimits`, `updateSwapEnabled`, and `disableTransferDelay` that could turn on or off various transfer rules, affecting whether tokens could be bought, sold, or moved. However, because the contract's ownership has been permanently given up (renounced), no one can call these functions anymore. They are now inactive.

IssueThe contract *had* functions like `enableTrading`, `removeLimits`, `updateSwapEnabled`, and `disableTransferDelay` that could turn on or off various transfer rules, affecting whether tokens could be bought, sold, or moved. However, because the contract's ownership has been permanently given up (renounced), no one can call these functions anymore. They are now inactive.

FixNo action is required as ownership is renounced, rendering these controls permanently inactive. This reduces centralized control risk.

StatusUnresolved

Info

Dormant Control Over Transfer Fees

CP-07The contract *had* functions such as `updateSellFees` and `updateBuyFees` that allowed the owner to change the fees applied to token transfers. These fees could impact the amount of tokens received by users. However, since the contract's ownership has been renounced, these functions can no longer be called by anyone. The current fee structure is permanently fixed.

IssueThe contract *had* functions such as `updateSellFees` and `updateBuyFees` that allowed the owner to change the fees applied to token transfers. These fees could impact the amount of tokens received by users. However, since the contract's ownership has been renounced, these functions can no longer be called by anyone. The current fee structure is permanently fixed.

FixNo action is required as ownership is renounced, rendering these controls permanently inactive. This ensures fee stability.

StatusUnresolved

Info

Dormant Control Over Transfer and Wallet Limits

CP-08The contract *had* functions like `updateSwapTokensAtAmount`, `updateMaxTxnAmount`, and `updateMaxWalletAmount` that allowed the owner to set limits on transaction sizes or the maximum amount of tokens a wallet could hold. These limits could restrict how users interact with their tokens. However, because the contract's ownership has been renounced, these functions are now permanently inactive and cannot be changed.

IssueThe contract *had* functions like `updateSwapTokensAtAmount`, `updateMaxTxnAmount`, and `updateMaxWalletAmount` that allowed the owner to set limits on transaction sizes or the maximum amount of tokens a wallet could hold. These limits could restrict how users interact with their tokens. However, because the contract's ownership has been renounced, these functions are now permanently inactive and cannot be changed.

FixNo action is required as ownership is renounced, rendering these controls permanently inactive. This ensures stability of transaction and wallet limits.

StatusUnresolved

Info

Who holds the supply

QA-HOLDERSThe ten largest holders own 3.5% of supply. Of that, 2.2% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 1.2% in wallets, 0.0% in other contracts. 2,287 holders in total.

IssueThe ten largest holders own 3.5% of supply. Of that, 2.2% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 1.2% in wallets, 0.0% in other contracts. 2,287 holders in total.

FixWatch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

StatusAcknowledged

Info

Not listed by any independent source

QA-IDENTITY2,287 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.

Issue2,287 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.

FixMatch the contract address against the project's official channels before trading.

StatusAcknowledged

Info

Liquidity burned — cannot be withdrawn

QA-LIQUIDITY97.1% of the pool's LP is burned or time-locked. 97.1% of the LP tokens were sent to a burn address — that liquidity can never be withdrawn by anyone. 2.9% is held, unlocked, by 1 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool.

Issue97.1% of the pool's LP is burned or time-locked. 97.1% of the LP tokens were sent to a burn address — that liquidity can never be withdrawn by anyone. 2.9% is held, unlocked, by 1 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool.

FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.

StatusAcknowledged

Info

The market for this token

QA-MARKETLiquidity $402K (DexScreener, all pools). 24h trading volume $3.4M (DexScreener, all pools).

IssueLiquidity $402K (DexScreener, all pools). 24h trading volume $3.4M (DexScreener, all pools).

FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

StatusAcknowledged

Info

Asset class: Project token

QA-PROFILEA token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $402K of DEX liquidity across 1 pools. Launch: 5 days of market history.

IssueA token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $402K of DEX liquidity across 1 pools. Launch: 5 days of market history.

FixCheck the project's own documentation for what the token is used for; this report covers what the contract allows.

StatusAcknowledged

Info

Recently launched — 5 days of market history

QA-RECENTThe token's oldest DEX pool is 5 days old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.

IssueThe token's oldest DEX pool is 5 days old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.

FixRe-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.

StatusAcknowledged

Category Ratings

TechnicalLow10/10

The contract implements standard ERC-20 functionality. A significant strength is the renounced ownership, which has permanently deactivated numerous powerful administrative functions such as `enableTrading`, `updateBuyFees`, and `blacklistAccount`, thereby enhancing decentralization and reducing central point of failure risks (7.3 Access Control). However, the `_transfer` function's reliance on `tx.origin` for rule determination introduces a potential vulnerability that could be manipulated by malicious intermediary contracts (7.2 Code Security). Additionally, a division-before-multiplication error in `_transfer` may lead to minor rounding losses (7.2 Code Security).

GovernanceLow10/10

A key strength is that the renounced ownership prevents any single entity from unilaterally altering critical economic parameters such as transfer fees (`updateBuyFees`, `updateSellFees`), transaction limits (`updateMaxTxnAmount`), or activating/deactivating trading (`enableTrading`, `updateSwapEnabled`). This eliminates potential economic manipulation by an owner (7.4 Economic, 7.5 Governance). While the contract was initially designed with extensive owner controls over these economic parameters and transfer rules, these are now dormant due to the renounced ownership, mitigating the associated risks.

UpgradesLow10/10

The Claus contract is not implemented as a proxy and does not include any upgrade mechanisms. This design choice eliminates the risks typically associated with upgradeability, such as malicious upgrade execution, proxy misconfiguration, or governance-related upgrade delays (7.7 Upgrades). As a non-upgradeable contract, its logic cannot be modified or patched after deployment, meaning any discovered vulnerabilities would necessitate a new deployment and token migration (7.7 Upgrades).

Security Checklist

5/5 checks passed

Contract VerifiedPass

Ownership RenouncedPass

No Mint FunctionPass

Liquidity LockedPass

Not a ProxyPass

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

3.5% in top 10

1.2% in wallets0.0% in contracts

Effective Concentration1.2%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$401.8K

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

LP Burned97.1% · ≈ permanent lock

LP Locked97.1% · Null Address

Key Addresses

3 addresses

Deployer

0xb288…d7fe

Unlocked LP Held By

0xf385…5f850x9fa5…f377

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

3 factors

Trading cooldown between transactions
Code: Minor Rounding Loss in Transfers (Low, static analysis)
Code: tx.origin Vulnerability in Transfer Logic (Medium, static analysis)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Not Signed In

Is claus a Scam?

Security Findings

tx.origin Vulnerability in Transfer Logic

Minor Rounding Loss in Transfers

Dormant Control Over Transfer Switches

Dormant Control Over Transfer Fees

Dormant Control Over Transfer and Wallet Limits

Who holds the supply

Not listed by any independent source

Liquidity burned — cannot be withdrawn

The market for this token

Asset class: Project token

Recently launched — 5 days of market history

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of claus?