Early-stage security check — honeypot & rug-pull analysis

Is Cysic Token a Scam?

CYS

BNB Chain

Not verified

This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →

Last checked Sep 4, 2026 · 1 audit on recordNew Launch · 20h old

Chart

77/ 100

High RiskHow is this score calculated?

How the score breaks downratings: 10 is safest

Technical6/10 Governance1/10 Upgrades4/10 Checks passed2 of 5 Findings1 High · 2 Medium · 3 Info6

SummaryAI Copilot

The CYS token contract is an ERC20 implementation with standard OpenZeppelin extensions for burnable, pausable, and access control features.

Read the full analysis

What raised the score

Ownership not renounced — strong Multisig
Mintable supply — no cap found, dilution unbounded
Top-10 concentration > 30%
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
Liquidity < $50k
LP top1 unlocked holder = 72.2%
LP top3 unlocked holders = 100.0%
Token age < 24h
1 High finding(s) from audit
2 Medium finding(s) from audit

Exact factors

Ownership NOT renounced — strong Multisig (3-of-5)
Mintable supply — no cap found, dilution unbounded
Top-10 concentration > 30% (89.1% total → 43.4% effective; 12.9% in EOAs, 76.2% in contracts — moderate)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
Liquidity < $50k ($11,784 across 6 pairs — thin market)
LP top1 unlocked holder = 72.2% (independent LP — depth risk, pool = 67% of DEX liquidity)
LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 67% of DEX liquidity)
Token age < 24h (brand new — bot activity, unproven)
1 High finding(s) from audit
2 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Early-stage analysis. This token has limited on-chain history (20h old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.

Security Checklist

as of audit · Sep 42 of 5 checks passed

Contract verifiedVerified

OwnershipRetained

MintMintable

Liquidity lockNot locked

UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026

ContractsWalletsEveryone elseBubble area = share of supply

89.1%of supply sits with the top 10 holders

Contractstreasury, vesting, bridge, staking76.2%
Walletsanonymous holders, free to sell12.9%
Everyone elsethe rest of the supply10.9%

Effective concentrationwhat the score reads43.4%

How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$11.8K across 6 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$7.8KShare of depth66.6%

Top-1 Unlocked Holder72.2%

Top-3 Unlocked100.0%

Unlocked LP held by

0x3410…73910xda13…946b

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High2 Medium3 Info

High

Centralized Control Over Critical Functions

The contract grants significant power to the owner role (inherited from Ownable) and the BRIDGE_ROLE (managed by AccessControl). The owner can pause/unpause transfers, add/remove addresses from a blacklist, and grant/revoke the BRIDGE_ROLE. The BRIDGE_ROLE can mint new tokens and burn existing ones. This high degree of centralization means that a compromise of the owner's keys or the bridge's keys could lead to severe consequences, including freezing user funds, arbitrary token minting/burning, or halting all token operations. (7.3 Access Control, 7.4 Economic, 7.8 Operations)H-01

Issue

Fix

Ensure the owner address is a robustly secured multisig wallet with a high threshold. Implement strict operational procedures and key management for both the owner and the BRIDGE_ROLE to minimize the risk of compromise. Consider a timelock for critical administrative actions if feasible for the project's operational needs.

Status

Unresolved

Medium

Owner's Ability to Blacklist Accounts

The onlyOwner functions addToBlacklist and removeFromBlacklist allow the contract owner to prevent specific addresses from sending or receiving CYS tokens. The _update internal function enforces this blacklist for all transfers. While this feature can be useful for compliance or mitigating stolen funds, it introduces a single point of control that could be misused to censor legitimate users or arbitrarily freeze funds. (7.3 Access Control, 7.4 Economic)M-01

Issue

Fix

Clearly document the policy and criteria for blacklisting accounts. Implement a transparent process for blacklisting decisions, potentially involving community governance or a public announcement period. Consider adding a mechanism for users to appeal blacklisting decisions if appropriate for the project's design.

Status

Unresolved

Medium

Privileged Minting and Burning Authority

The mint and burnFromAddress functions are protected by the BRIDGE_ROLE. This role has the exclusive ability to increase the total supply of CYS tokens and to reduce the supply by burning tokens from any address. This is a common pattern for bridged tokens, but it means the security of the bridge mechanism and the management of the BRIDGE_ROLE are paramount. An exploit in the bridge or a compromise of the BRIDGE_ROLE key could lead to uncontrolled inflation or arbitrary fund destruction. (7.3 Access Control, 7.4 Economic, 7.6 External)M-02

Issue

Fix

Implement robust security measures for the bridge system, including multi-signature approvals for bridge operations, rate limits on minting/burning, and continuous monitoring. The private keys associated with the BRIDGE_ROLE should be secured with the highest industry standards, potentially using hardware security modules (HSMs) or multi-party computation (MPC).

Status

Unresolved

Info

Non-Upgradeable Contract

The CYS contract is deployed directly and does not implement any proxy pattern (e.g., UUPS, Transparent) for upgradeability. This means that any future bug fixes, feature enhancements, or protocol changes would require deploying an entirely new contract and migrating all token holders and liquidity, which is a complex and costly process. (7.1 Architecture, 7.7 Upgrades)I-01

Issue

Fix

Acknowledge that the contract is not upgradeable. For future projects, consider using an upgradeable proxy pattern if the project anticipates needing flexibility for future changes or bug fixes. For this contract, ensure thorough testing and auditing to minimize the need for future changes.

Status

Unresolved

Info

Potential High Gas Costs for Batch Transfers

The batchTransfer function allows transferring tokens to up to MAX_BATCH (100) recipients in a single transaction. While the MAX_BATCH limit prevents excessively large arrays, processing 100 transfers in a single transaction can still incur significant gas costs, especially on networks like Ethereum or during periods of high network congestion. This could lead to transaction failures if the gas limit is exceeded or make the function economically unfeasible for users. (7.2 Code Security, 7.8 Operations)I-02

Issue

Fix

Inform users about potential gas costs for large batch transfers. Consider providing alternative methods for distributing tokens or advise users to split very large distributions into smaller batches if gas costs become prohibitive. Monitor gas usage in production.

Status

Unresolved

Info

Initial Bridge Role Assignment

The constructor allows the bridge address to be address(0). If bridge is address(0), the BRIDGE_ROLE is not granted during deployment. While this might be an intentional design choice to allow the owner to grant the role later, it means that minting and burning capabilities would be unavailable until the owner explicitly grants the role to a valid address. (7.3 Access Control, 7.8 Operations)I-03

Issue

Fix

Ensure that the deployment script correctly provides a valid bridge address if minting/burning functionality is required immediately after deployment. If the intention is to grant the role later, ensure the owner is aware of this operational step.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4

Executive SummaryWhat the contract is and what the review found

The CYS token contract is an ERC20 implementation with standard OpenZeppelin extensions for burnable, pausable, and access control features. It includes a blacklisting mechanism and a bridge role for minting/burning. The contract exhibits a high degree of centralization, with the owner and bridge role possessing significant control over token supply, transfers, and user funds. While the code quality is high and standard security practices are followed, the centralized nature introduces inherent risks related to key management and operational security.

Technical6/10Medium risk

The contract leverages well-audited OpenZeppelin libraries, ensuring a solid foundation for ERC20 functionality and extensions like burning and pausing. The _update override correctly integrates the blacklisting mechanism, preventing transfers to/from blacklisted addresses (7.2 Code Security). The batchTransfer function includes robust input validation, checking array lengths, zero addresses, and non-zero amounts, and limits batch size to 100, mitigating potential attack vectors and gas issues (7.2 Code Security). However, the centralized control over critical functions like minting, burning, pausing, and blacklisting introduces a technical risk, as the security of the owner and bridge role keys is paramount (7.3 Access Control).

Governance1/10High risk

The economic model is highly centralized, with the owner having extensive control over the token's operational state and user access. The owner can pause all transfers, effectively halting the token's utility, and can blacklist individual accounts, freezing their funds (7.4 Economic, 7.5 Governance). Furthermore, the BRIDGE_ROLE has the exclusive ability to mint new tokens and burn existing ones, directly impacting the total supply and potentially devaluing existing tokens if misused (7.4 Economic). The security and governance of the owner and BRIDGE_ROLE are critical to the economic stability and trustworthiness of the CYS token (7.5 Governance).

Upgrades4/10Medium risk

The CYS contract is deployed directly and does not implement any upgradeability pattern (e.g., UUPS, Transparent proxies). This means the contract's logic is immutable once deployed. While this eliminates risks associated with upgrade mechanisms, it also means that any future bug fixes or feature enhancements would require a new contract deployment and a complex token migration process (7.7 Upgrades).

Final RecommendationWhat to do about this score

Prioritize the robust security of the owner and BRIDGE_ROLE private keys, ideally utilizing a multi-signature wallet with a high threshold and secure operational procedures.

Clearly define and communicate the policies for blacklisting and pausing, ensuring transparency and accountability. Implement continuous monitoring for all privileged actions and consider rate limits or timelocks for critical administrative functions to mitigate potential risks associated with centralized control.

Contract & Record

1 audit on record

TypeToken

NetworkBNB Chain

Token age20h

Contract0x0c69…07c7

Deployer0x66a5…3e2b

Badge for your website

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History

Sep 4, 202677High
Aug 14, 202668High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the CYS contract address?

The Cysic Token (CYS) contract on BNB Chain is 0x0c69199c1562233640e0db5ce2c399a88eb507c7. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.