Is Exfil.fun (EXFIL) a Scam? Security Analysis

Security Findings

7 Info

Info

No code-level findings — an SPL mint exposes no auditable program source

I-01This token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on mint/owner authority, mint capability, LP lock/burn state, holder concentration, which are read directly from chain state and from third-party risk registries.

IssueThis token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on mint/owner authority, mint capability, LP lock/burn state, holder concentration, which are read directly from chain state and from third-party risk registries.

FixRead the risk score breakdown below as the substance of this audit. For a code-level review, the token would need an accompanying verified program.

StatusAcknowledged

Info

Who holds the supply

QA-HOLDERSThe ten largest holders own 29.7% of supply. Of that, 6.1% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 23.6% in wallets, 0.0% in other contracts. 656 holders in total.

IssueThe ten largest holders own 29.7% of supply. Of that, 6.1% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 23.6% in wallets, 0.0% in other contracts. 656 holders in total.

FixWatch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

StatusAcknowledged

Info

Not listed by any independent source

QA-IDENTITY656 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.

Issue656 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.

FixMatch the contract address against the project's official channels before trading.

StatusAcknowledged

Info

Liquidity burned — cannot be withdrawn

QA-LIQUIDITY100.0% of the pool's LP is burned or time-locked. 100.0% of the pool's LP tokens are burned — that liquidity can never be withdrawn by anyone.

Issue100.0% of the pool's LP is burned or time-locked. 100.0% of the pool's LP tokens are burned — that liquidity can never be withdrawn by anyone.

FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.

StatusAcknowledged

Info

The market for this token

QA-MARKETLiquidity $88K (DexScreener, all pools). 24h trading volume $104K (DexScreener, all pools).

IssueLiquidity $88K (DexScreener, all pools). 24h trading volume $104K (DexScreener, all pools).

FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

StatusAcknowledged

Info

Asset class: Meme token

QA-PROFILEA community token whose value comes from attention rather than a product. Being a meme is not a risk in itself: it is scored on exactly the same contract and market facts as any other token. The class itself adds no points; the contract and market facts decide the score. Basis: launched on pump.fun, a meme launchpad. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $88K of DEX liquidity across 2 pools. Launch: launched on pump.fun, 10 days of market history.

IssueA community token whose value comes from attention rather than a product. Being a meme is not a risk in itself: it is scored on exactly the same contract and market facts as any other token. The class itself adds no points; the contract and market facts decide the score. Basis: launched on pump.fun, a meme launchpad. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $88K of DEX liquidity across 2 pools. Launch: launched on pump.fun, 10 days of market history.

FixExpect attention-driven volatility; the facts in this report say whether the contract itself can be used against holders.

StatusAcknowledged

Info

Recently launched — 10 days of market history

QA-RECENTThe token's oldest DEX pool is 10 days old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.

IssueThe token's oldest DEX pool is 10 days old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.

FixRe-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.

StatusAcknowledged

Category Ratings

TechnicalLow10/10

The Exfil.fun (EXFIL) token is implemented using the spl-token-2022 program. Both the mint authority and freeze authority have been revoked, ensuring that no new tokens can be minted and no holder accounts can be frozen. No Token-2022 extensions like a transfer hook or default account state frozen are active, indicating standard token behavior. The token's balance mutability, closability, and non-transferability are all set to False, as confirmed by an on-chain security registry.

GovernanceLow10/10

The token's economic profile appears robust. The top 10 holders that can sell collectively hold 23.64% of the supply, which does not indicate high concentration risk. Total DEX liquidity stands at $89,793, with a healthy 24-hour volume of $104,974, resulting in a normal Volume/Liquidity Ratio of 1.17. Crucially, 100.0% of the pool's LP tokens are burned, meaning the liquidity can never be withdrawn by anyone, providing strong assurance against rug pulls.

UpgradesLow10/10

The token's upgradeability and mutability aspects are minimal, contributing to its stability. The mint and freeze authorities are revoked, preventing any post-launch changes to supply or account states. Furthermore, the metadata is immutable, meaning the token name, symbol, or image cannot be altered after launch. No transfer hook or transfer fee upgradability is present, reinforcing the fixed nature of the token's parameters.

Security Checklist

4/4 checks passed

Contract VerifiedPass

No Mint FunctionPass

Liquidity LockedPass

Not a ProxyPass

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Liquidity Depth

$88.0K across 2 pairs

PumpswapSOLanalysed$86.9K Meteora DLMMSOL$1.1K

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

1 factors

Top-10 concentration > 20% (29.7% total → 23.6% effective; 23.6% in EOAs, 0.0% in contracts; 6.1% burned, locked or in pools excluded)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Not Signed In

Is Exfil.fun a Scam?

Security Findings

No code-level findings — an SPL mint exposes no auditable program source

Who holds the supply

Not listed by any independent source

Liquidity burned — cannot be withdrawn

The market for this token

Asset class: Meme token

Recently launched — 10 days of market history

Category Ratings

Security Checklist

Liquidity Depth

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of Exfil.fun?