On-chain security analysis — is it a scam or legit?
EthereumThe Groklet token is a standard ERC-20 implementation with added tax and swap functionality.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 27, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are locked or burned.
The _transfer function utilizes a state variable that is never initialized. This can lead to undefined behavior or transaction reverts during token transfers.
Ensure all state variables are properly initialized in the constructor before being accessed in the transfer path.
Unresolved
The taxwallet controls the manualSwap function, which acts as a switch for internal swap logic. This allows the controller to potentially halt or alter the token's ability to process transfers and liquidity swaps.
Implement a time-lock or multi-signature requirement for the taxwallet to prevent unilateral changes to the transfer mechanism.
Unresolved
The taxwallet can adjust buy and sell taxes via the reduceFee function. While this is intended for fee management, it grants the controller the ability to set arbitrary fee structures.
Hardcode fee limits or implement a maximum fee cap to protect users from sudden, excessive tax increases.
Unresolved
The removeLimit2 function allows for the modification of transaction and wallet limits. Since ownership has been renounced, these functions are currently unreachable and pose no active risk.
Remove these functions in future deployments to reduce contract size and eliminate dead code.
Unresolved
The ten largest holders own 43.9% of supply. Of that, 17.2% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 10.1% in wallets, 16.6% in other contracts. 477 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
477 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.
Match the contract address against the project's official channels before trading.
Acknowledged
100.0% of the pool's LP is burned or time-locked. 100.0% of the LP tokens were sent to a burn address — that liquidity can never be withdrawn by anyone. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
Liquidity $24K (DexScreener, all pools). 24h trading volume $37K (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $24K of DEX liquidity across 1 pools. Launch: 468 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The Groklet token is a standard ERC-20 implementation with added tax and swap functionality. Ownership has been renounced, effectively disabling administrative functions previously restricted to the owner. However, the 'taxwallet' remains a privileged entity with significant control over token economics and liquidity, and a critical initialization issue exists in the transfer logic.
The architecture follows a standard ERC-20 pattern with integrated tax logic. 7.1 Architecture is straightforward, though 7.2 Code Security reveals a critical uninitialized state variable in the transfer path. 7.3 Access Control is partially mitigated by ownership renouncement, yet the taxwallet retains excessive power over contract funds. 7.6 External interactions are limited to standard DEX swaps.
7.4 Economic controls are centralized under the taxwallet, which can manipulate fees and extract tokens. 7.5 Governance is non-existent due to renounced ownership, leaving the community with no recourse if the taxwallet acts maliciously. The economic model relies heavily on the taxwallet's discretion to manage liquidity and fees.
7.7 Upgrades are not supported as the contract is not a proxy. 7.8 Operations are static following the renouncement of ownership. The contract is immutable, preventing future logic changes.
The project should immediately address the uninitialized state variable to prevent potential transfer failures.
Given the centralization of power in the taxwallet, it is recommended to transition these functions to a multi-signature wallet or a decentralized governance contract to improve trust.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Groklet contract on Ethereum is 0xbe7e21746fad3f6f83e22d02910bec250a493feb. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Groklet is 60/100 (Medium risk) as of Oct 27, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Renounced; Mint: No mint; Liquidity lock: Locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Locked (as of Oct 27, 2026). Total DEX liquidity: $24.1K.
As of Oct 27, 2026, the 10 largest holders own 43.9% of the supply across 477 holders. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
