Honeypot, rug-pull and ownership checks
EthereumThe HarryPotterObamaSonic10Inu (BITCOIN) token contract exhibits severe centralization risks and potential for malicious actions by the owner.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are locked or burned.
0x74a7…f26e0xb52f…0af10x41ae…94550x443f…fcf70x0a6b…5286No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
setTaxes function allows the contract owner to set _initialBuyTax, _initialSellTax, _finalBuyTax, and _finalSellTax to arbitrary values. This includes the ability to set taxes to 100%, which would effectively prevent users from selling their tokens (100% sell tax) or buying new tokens (100% buy tax). This constitutes a direct rug pull vector, allowing the owner to drain liquidity or freeze user funds.C-01The setTaxes function allows the contract owner to set _initialBuyTax, _initialSellTax, _finalBuyTax, and _finalSellTax to arbitrary values. This includes the ability to set taxes to 100%, which would effectively prevent users from selling their tokens (100% sell tax) or buying new tokens (100% buy tax). This constitutes a direct rug pull vector, allowing the owner to drain liquidity or freeze user funds.
Remove or significantly restrict the owner's ability to modify tax percentages. If taxes are a core part of the tokenomics, they should be immutable or subject to a decentralized governance mechanism with a timelock. If mutable, implement strict upper bounds (e.g., max 25%) to prevent malicious exploitation.
Unresolved
setBots function allows the contract owner to add or remove any address from the bots mapping. Addresses marked as 'bots' are prevented from transferring tokens in the _transfer function. This grants the owner the power to arbitrarily blacklist any user, effectively freezing their tokens and preventing them from participating in trading. This is a severe centralization and censorship risk.C-02The setBots function allows the contract owner to add or remove any address from the bots mapping. Addresses marked as 'bots' are prevented from transferring tokens in the _transfer function. This grants the owner the power to arbitrarily blacklist any user, effectively freezing their tokens and preventing them from participating in trading. This is a severe centralization and censorship risk.
Remove the setBots function entirely. Decentralized tokens should not have the ability to arbitrarily freeze user funds or prevent transfers. If anti-bot measures are desired, they should be implemented in a non-custodial and transparent manner, ideally without direct owner intervention on individual addresses.
Unresolved
openTrading function, callable only by the owner, initializes the Uniswap router and pair, and enables trading. This gives the owner complete control over when trading starts. Furthermore, the owner can update _maxTxAmount, _maxWalletSize, _taxSwapThreshold, and _maxTaxSwap at any time. This allows the owner to manipulate market conditions, prevent large transactions, or even halt trading by setting prohibitive limits, leading to potential market manipulation and denial of service for users.C-03The openTrading function, callable only by the owner, initializes the Uniswap router and pair, and enables trading. This gives the owner complete control over when trading starts. Furthermore, the owner can update _maxTxAmount, _maxWalletSize, _taxSwapThreshold, and _maxTaxSwap at any time. This allows the owner to manipulate market conditions, prevent large transactions, or even halt trading by setting prohibitive limits, leading to potential market manipulation and denial of service for users.
Decentralize or remove the openTrading function. Once trading is enabled, critical parameters like transaction limits and swap thresholds should be immutable or controlled by a decentralized governance mechanism with a timelock. If mutable, implement reasonable bounds and timelocks for changes.
Unresolved
excludeFromFee function allows the owner to exempt any address from paying transaction fees. While the owner, contract, and tax wallet are initially excluded, the ability to add arbitrary addresses to this exclusion list introduces a significant centralization risk. The owner could exclude favored addresses or even themselves from all taxes, creating an unfair advantage or enabling further manipulation.H-01The excludeFromFee function allows the owner to exempt any address from paying transaction fees. While the owner, contract, and tax wallet are initially excluded, the ability to add arbitrary addresses to this exclusion list introduces a significant centralization risk. The owner could exclude favored addresses or even themselves from all taxes, creating an unfair advantage or enabling further manipulation.
Limit fee exclusion to essential protocol addresses (e.g., the contract itself, the liquidity pair). If other exclusions are necessary, they should be immutable or subject to a transparent, decentralized governance process.
Unresolved
setTransferDelayEnabled function allows the owner to enable or disable the transferDelayEnabled mechanism at will. This mechanism, when active, prevents holders from transferring tokens within a certain timeframe after their last transfer. While intended as an anti-dump measure, the owner's unilateral control over its activation/deactivation can be used to selectively hinder trading for certain periods, potentially impacting market stability or user liquidity without warning.H-02The setTransferDelayEnabled function allows the owner to enable or disable the transferDelayEnabled mechanism at will. This mechanism, when active, prevents holders from transferring tokens within a certain timeframe after their last transfer. While intended as an anti-dump measure, the owner's unilateral control over its activation/deactivation can be used to selectively hinder trading for certain periods, potentially impacting market stability or user liquidity without warning.
If a transfer delay is a core feature, its activation and deactivation should be immutable or controlled by a decentralized governance mechanism with a timelock. Arbitrary owner control over such a significant trading restriction is a high risk.
Unresolved
swapAndLiquifyswapAndLiquify function, after swapTokensForEth is called, the contract attempts to add liquidity and then transfer the remaining ETH to _taxWallet. If the addLiquidity call fails (e.g., due to slippage, insufficient ETH, or external router issues), the remaining ETH might not be fully utilized for liquidity. While _taxWallet.transfer attempts to send the remaining balance, if _taxWallet is a contract that rejects ETH, or if there's an unexpected revert, some ETH could become stuck in the contract, requiring manual rescueETH by the owner.M-01In the swapAndLiquify function, after swapTokensForEth is called, the contract attempts to add liquidity and then transfer the remaining ETH to _taxWallet. If the addLiquidity call fails (e.g., due to slippage, insufficient ETH, or external router issues), the remaining ETH might not be fully utilized for liquidity. While _taxWallet.transfer attempts to send the remaining balance, if _taxWallet is a contract that rejects ETH, or if there's an unexpected revert, some ETH could become stuck in the contract, requiring manual rescueETH by the owner.
Implement more robust error handling or fallback mechanisms within swapAndLiquify. Consider adding checks for successful liquidity addition and potentially a retry mechanism or a more explicit way to handle leftover ETH if addLiquidity fails. Ensure _taxWallet is capable of receiving ETH or add a fallback for rejected transfers.
Unresolved
// SPDX-License-Identifier: NONE. While technically valid, it's generally recommended to use a standard SPDX license identifier (e.g., MIT, GPL-3.0) to clarify the licensing terms of the code. Using 'NONE' can lead to ambiguity regarding intellectual property rights and usage permissions.L-01The contract uses // SPDX-License-Identifier: NONE. While technically valid, it's generally recommended to use a standard SPDX license identifier (e.g., MIT, GPL-3.0) to clarify the licensing terms of the code. Using 'NONE' can lead to ambiguity regarding intellectual property rights and usage permissions.
Replace // SPDX-License-Identifier: NONE with a standard and appropriate SPDX license identifier, such as // SPDX-License-Identifier: MIT.
Unresolved
The HarryPotterObamaSonic10Inu (BITCOIN) token contract exhibits severe centralization risks and potential for malicious actions by the owner. While standard ERC-20 functionality is present, the extensive administrative control over taxes, trading, and user blacklisting poses critical security and economic threats to token holders. The contract is not upgradeable, making these risks permanent.
The contract implements a standard ERC-20 token with additional features like transaction taxes, anti-whale limits, and anti-bot mechanisms (7.2 Code Security). It utilizes SafeMath for arithmetic operations, mitigating basic integer overflow/underflow risks. A reentrancy guard (lockTheSwap) is present for the swapAndLiquify function, which is a good practice. However, the extensive use of owner-controlled parameters, such as the ability to set arbitrary taxes and blacklist users, introduces significant technical risks (7.3 Access Control). The swapAndLiquify mechanism, while common, could face issues if external calls fail, potentially leaving funds stuck or preventing liquidity additions.
The contract's economic model is highly centralized and vulnerable to owner manipulation (7.4 Economic). The owner has absolute control over critical parameters, including the ability to set buy and sell taxes to any value, including 100%, effectively enabling a rug pull. The owner can also update _maxTxAmount and _maxWalletSize at will, potentially freezing user funds or preventing trading. Furthermore, the owner can blacklist any address using the setBots function, leading to arbitrary fund freezing (7.3 Access Control). The openTrading function, controlled solely by the owner, dictates when trading can commence, creating a single point of failure and potential for market manipulation (7.5 Governance).
The contract is not designed with an upgrade mechanism (7.7 Upgrades). This means that once deployed, its logic cannot be altered. While this eliminates upgrade-related risks, it also means that any identified vulnerabilities or design flaws, particularly the severe centralization issues, are permanent and cannot be patched without a new deployment and migration.
Given the critical centralization risks, it is strongly recommended that the project team consider a complete redesign of the token contract to decentralize control over critical parameters.
Implement multi-signature wallets for sensitive administrative functions, or better yet, remove the ability to unilaterally modify taxes, transaction limits, and user blacklists. If such extensive control is deemed necessary, transparent communication and robust governance mechanisms should be established to ensure community oversight and prevent malicious actions. Users should be made fully aware of the inherent risks associated with such a highly centralized token.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Paste the contract address into our AI-powered scanner for a deeper real-time report — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
