On-chain security analysis — is it a scam or legit?
EthereumThis report details the security posture of the FiatTokenV2_1 contract, an ERC-20 token implementation.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 17, 2026
The 20 remaining pairs hold $6.51M between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x639c…70de0x9006…10cc0xb03e…cf220x21ac…f2d60xa928…faea0xd9e6…ce4f0xd9c2…ede80xe763…ac810x8719…bfe10xb3ec…bdeeNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
mint function allows an authorized minter to create new tokens and add them to any address. This increases the total supply of tokens, which can dilute the value of existing tokens held by users.CP-01The mint function allows an authorized minter to create new tokens and add them to any address. This increases the total supply of tokens, which can dilute the value of existing tokens held by users.
Token holders should be aware that the supply of this token is not fixed and can be increased by the designated minters. Transparency around minting policies and a clear communication strategy for any supply changes are crucial.
Unresolved
pause function, callable by the pauser, can halt all token transfers. This means that at any time, the pauser can prevent token holders from moving or selling their tokens, effectively freezing all activity on the token. The unpause function can resume transfers.CP-04The pause function, callable by the pauser, can halt all token transfers. This means that at any time, the pauser can prevent token holders from moving or selling their tokens, effectively freezing all activity on the token. The unpause function can resume transfers.
Token holders should understand that their ability to transfer tokens can be unilaterally suspended by the pauser. The project should clearly define the circumstances under which pausing would occur and ensure the pauser role is secured with strong access controls.
Unresolved
blacklist function allows the blacklister to prevent specific addresses from sending or receiving tokens. This means that chosen token holders can be blocked from moving or selling their tokens, effectively freezing their assets. The unBlacklist function can remove an address from the blacklist.CP-06The blacklist function allows the blacklister to prevent specific addresses from sending or receiving tokens. This means that chosen token holders can be blocked from moving or selling their tokens, effectively freezing their assets. The unBlacklist function can remove an address from the blacklist.
Token holders should be aware that their tokens can be frozen by the blacklister. The project should establish clear, publicly available policies for blacklisting and ensure the blacklister role is managed with the highest security standards.
Unresolved
The ten largest holders own 81.1% of supply. What remains: 11.8% in wallets, 69.3% in other contracts. 89,403 holders in total. For a verified reference asset the largest holders are custodians, exchanges and bridges; concentration is reported, not scored.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Coinbase Wrapped BTC (CBBTC), market cap $7.7B. 89,403 holders. Verified by: CoinGecko.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $143.1M (DexScreener, all pools). 24h trading volume $297.5M (CoinGecko, all markets, daily snapshot). 24h trading volume $9.3M (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token representing another asset's units 1:1, backed by a wrapping contract, a custodian or a bridge. Scored as an established reference asset: its identity is verified, so the issuer's or protocol's controls (listed as findings) are real and are priced once as counterparty risk, and LP locks and holder concentration are not scored — its pools belong to market makers and its largest holders are exchanges, bridges and custody. Basis: CoinGecko category: Wrapped-Tokens. Tokenomics — Supply: mintable with no on-chain cap found. Control: a single wallet (EOA). Code: upgradeable proxy. Fees: no buy or sell tax. Market: $143.1M of DEX liquidity across 30 pools. Launch: 771 days of market history.
The backing is the risk: check who holds the underlying asset and how redemption works.
Acknowledged
This report details the security posture of the FiatTokenV2_1 contract, an ERC-20 token implementation. The contract exhibits a high degree of centralized control, allowing specific privileged roles to mint new tokens, pause all transfers, and blacklist individual addresses. These capabilities introduce significant governance and economic risks for token holders.
The FiatTokenV2_1 contract is an ERC-20 token with additional features inherited from various FiatToken versions. It includes standard token functionalities and robust mechanisms for emergency recovery via rescueERC20. However, the contract design incorporates several centralized control points (7.3 Access Control), such as the mint function for supply management, pause for transfer control, and blacklist for address restrictions, which are controlled by specific roles (minters, pauser, blacklister).
The economic stability and governance of the FiatTokenV2_1 are heavily reliant on the integrity of its privileged roles (7.5 Governance, 7.4 Economic). The minters role can mint new tokens, potentially diluting existing holders. The pauser can halt all token transfers, impacting liquidity and user access to funds. Furthermore, the blacklister can blacklist specific addresses, effectively freezing their tokens and preventing any movement. These centralized controls pose a significant risk to token holders.
The contract is deployed behind a Zeppelin OS Legacy proxy, making it upgradeable (7.7 Upgrades). This allows the owner to deploy new implementation logic, which can introduce new features or fix bugs. While upgradeability offers flexibility, it also means the contract's behavior can be fundamentally altered by the owner, introducing a centralized point of control over the contract's future functionality.
It is crucial for token holders to understand the extensive centralized control inherent in the FiatTokenV2_1 contract.
The project team should implement robust multi-signature wallets for all privileged roles (owner, masterminter, pauser, blacklister, rescuer) to mitigate single points of failure. Additionally, transparent communication regarding any planned minting, pausing, blacklisting, or upgrade actions is essential to maintain trust and inform the community.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
