On-chain security analysis — is it a scam or legit?
BNB ChainThe WCNPY contract is a standard ERC-20 token with administrative minting capabilities and a redemption mechanism.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 31, 2026
The 10 remaining pairs hold $2.0K between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x3421…22aaNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The redeem function allows users to burn their own tokens to trigger a redemption request. While it only burns the caller's tokens, the reliance on an external address for off-chain processing introduces operational risk if the off-chain component fails to fulfill the request.
Ensure the off-chain redemption process is transparent and provide a clear SLA for fulfillment to protect users.
Unresolved
The owner can call the mint function to create new tokens at any time. This allows the controller to increase the total supply, which dilutes the value of existing holdings.
Implement a timelock on the mint function or transition to a decentralized governance model to approve supply increases.
Unresolved
0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a wallet, 0x3421…22aa — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The ten largest holders own 92.1% of supply. What remains: 76.7% in wallets, 15.4% in other contracts. 14,765 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Canopy (CNPY), market cap $22M, rank #790. 14,765 holders. Verified by: CoinGecko.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $1.2M (GeckoTerminal, all pools). 24h trading volume $2.2M (CoinGecko, all markets, daily snapshot). 24h trading volume $565K (GeckoTerminal, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: a 3-of-3 multisig. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $1.2M of DEX liquidity across 20 pools. Launch: 55 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The WCNPY contract is a standard ERC-20 token with administrative minting capabilities and a redemption mechanism. The protocol relies on a multisig owner for privileged operations, which mitigates single-point-of-failure risks. However, the ability for the owner to mint tokens and the specific implementation of the redemption process require careful monitoring by token holders.
The architecture follows standard OpenZeppelin patterns for ERC-20 and access control. 7.1 Architecture is modular, and 7.2 Code Security is high due to the use of established libraries. 7.3 Access Control is enforced via Ownable2Step, preventing accidental ownership transfers. 7.6 External dependencies are minimal and well-vetted.
7.4 Economic risks are present due to the owner's ability to mint supply, which can impact token value. 7.5 Governance is centralized under a 3-of-3 multisig, providing a balance between security and agility. Holders should monitor the minting activity to ensure it aligns with stated protocol objectives.
7.7 Upgrades are not supported as the contract is not a proxy. This ensures immutability of the logic, which is a strength for long-term trust. 7.8 Operations are straightforward, relying on standard owner-restricted functions for maintenance.
The protocol should maintain the current multisig configuration and ensure that all minting events are publicly communicated to the community to maintain transparency.
Users should be aware that the owner possesses the authority to increase the total supply. We recommend implementing a timelock on the mint function to provide the community with advance notice of supply changes.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
