On-chain security analysis — is it a scam or legit?
PolygonThe EFI token is a standard ERC-20 implementation with integrated AccessControl for administrative functions.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 28, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x770b…edd60x9808…33480x27d0…d49b0x0de0…fcf80xd82d…8382The burnFromStakingContract function allows a privileged role to burn tokens from any user's wallet, effectively allowing the controller to seize or destroy user funds.
Remove the ability to burn tokens from arbitrary addresses and restrict burning to the owner's own balance.
Unresolved
The mint function allows a privileged role to create new tokens at will, which can dilute the holdings of all existing token holders.
Restrict the minting capability to a decentralized governance process or cap the total supply to prevent arbitrary inflation.
Unresolved
0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a contract, 0x770b…edd6 — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The _taxedTransfer function performs division before multiplication, which can lead to precision loss and minor discrepancies in tax collection.
Refactor the math logic to perform all multiplications before divisions to maintain precision.
Unresolved
The ten largest holders own 95.7% of supply. Of that, 2.2% burned, 6.1% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 84.5% in wallets, 2.9% in other contracts. 101,450 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as ElevateFi (EFI), market cap $2M, rank #2170. 101,450 holders.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $386K (DexScreener, all pools). 24h trading volume $24K (CoinGecko, all markets, daily snapshot). 24h trading volume $37K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $117.96 on 2026-05-19; the price is now 97.2791% below it.
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: not upgradeable (no proxy). Fees: 0% on buy, 5% on sell. Market: $386K of DEX liquidity across 2 pools. Launch: 433 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The EFI token is a standard ERC-20 implementation with integrated AccessControl for administrative functions. The contract includes centralized control mechanisms that allow privileged roles to mint tokens and burn tokens from arbitrary addresses. While the code follows standard OpenZeppelin patterns, the high level of centralization poses significant risks to token holders.
The architecture utilizes standard OpenZeppelin AccessControl for role-based permissions. 7.1 Architecture and 7.2 Code Security are generally sound, utilizing well-tested libraries. However, 7.3 Access Control is overly permissive, granting the policy role the ability to manipulate user balances directly. 7.6 External dependencies are limited to standard Uniswap V2 interfaces.
7.4 Economic and 7.5 Governance risks are elevated due to the centralized nature of the token. The ability to mint new tokens allows for arbitrary supply inflation, directly impacting token value. Furthermore, the burn function allows administrators to remove liquidity or holdings from any user, creating a significant trust requirement.
7.7 Upgrades are not implemented as this is a standard non-proxy contract. 7.8 Operations are managed via role-based access control, which is immutable regarding the contract structure itself. No upgradeability risks are present.
It is recommended to implement a multi-signature wallet or a timelock controller for all privileged administrative functions to mitigate the risk of single-point-of-failure compromises.
Additionally, the burn function should be restricted to user-initiated actions or strictly defined staking contract interactions to prevent unauthorized balance manipulation. For future iterations, consider moving away from centralized minting and balance-burning capabilities to increase trustless decentralization. Ensure that any future changes to the tax logic account for precision loss by performing multiplication before division.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
