Is Humanity (H) a Scam? New Token Security Check

Critical Security Flags

1/5 checks passed

Contract VerifiedPass

Ownership RenouncedFail

No Mint FunctionFail

Liquidity LockedFail

Not a ProxyFail

Audit History

2 audits on record

Jul 23100

Every audit run adds a dated snapshot — history is append-only and cannot be edited.

Audit Summary

This audit focuses on a TransparentUpgradeableProxy contract, which utilizes standard OpenZeppelin libraries. A critical finding is that the implementation contract, identified as 'HToken' at address 0x85d0b85f290ba575c50a6be38f24f9e99f94e7d3, has unverified source code. This prevents a comprehensive security assessment of the core protocol logic. While the proxy's administrative control is secured by a 4-of-7 Gnosis Safe multisig, the unknown nature of the implementation's code introduces significant technical, economic, and upgrade risks.

Final Recommendation: The primary recommendation is to immediately verify the source code of the `HToken` implementation contract (0x85d0b85f290ba575c50a6be38f24f9e99f94e7d3) on Etherscan or a similar block explorer. A thorough security audit of this implementation contract is essential to identify and mitigate any vulnerabilities, assess its economic model, and understand its governance structure. Consider implementing a timelock for upgrade operations to provide a delay for community review and reaction before critical changes take effect.

Category Ratings

TechnicalMedium

4/10

The provided proxy contract utilizes well-audited OpenZeppelin `ERC1967Proxy` and `ERC1967Utils` for its upgradeability mechanism (7.1 Architecture). This ensures a robust and standard proxy implementation. However, the critical technical risk lies with the unverified source code of the `HToken` imp

GovernanceHigh

1/10

The proxy's administrative control is managed by a 4-of-7 Gnosis Safe multisig (7.3 Access Control), which enhances security by requiring multiple approvals for critical operations like upgrades. This setup mitigates single points of failure for administrative actions. However, the economic mod

UpgradesHigh

1/10

The contract employs the Transparent Proxy pattern, managed by an OpenZeppelin `ProxyAdmin` contract, whose owner is a Gnosis Safe multisig (7.7 Upgrades). This provides a secure and standard upgrade path, requiring multiple approvals for implementation changes. However, a significant risk is the ab

Proxy Upgrade Controls

Proxy TypeEip1967 Transparent

AdminOZ ProxyAdmin → Multisig 4-of-7

ImplementationVerified source

Upgrades (30d)0 · stable

LP Distribution

Top-1 Unlocked Holder100.0%

Top-3 Unlocked100.0%

What Raised This Score

12 factors

Ownership NOT renounced — strong Multisig (4-of-7)
Mintable supply — no cap found, dilution unbounded
Proxy contract (upgradeable — admin can replace logic)
Top-10 concentration > 70% (86.4% total → 86.4% effective; 86.4% in EOAs, 0.0% in contracts — extreme)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
Liquidity < $50k ($19,879 across 6 pairs — thin market)
LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 76% of DEX liquidity)
LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 76% of DEX liquidity)
Token age < 7 days (early, volatile)
1 Critical finding(s) from audit
1 High finding(s) from audit
1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Findings

5 total

1 Critical 1 High 1 Medium 2 Info

C-01CriticalUnresolved

Unverified Implementation Contract

The source code for the `HToken` implementation contract (0x85d0b85f290ba575c50a6be38f24f9e99f94e7d3) is not verified on the blockchain. This prevents any security analysis of the core logic and functionality of the protocol. Without verified source code, it is impossible to ascertain the contract's behavior, identify vulnerabilities, or confirm its adherence to stated specifications, posing an extreme risk to users and the protocol's integrity (7.2 Code Security).

Recommendation: Immediately verify the source code of the `HToken` implementation contract on Etherscan or the relevant block explorer. Conduct a comprehensive security audit of the implementation contract to identify and remediate any vulnerabilities before further operations.

H-01HighUnresolved

Centralized Upgrade Authority

While the proxy's admin is a 4-of-7 Gnosis Safe multisig, this still represents a centralized point of control for upgrades. The multisig owners have the power to upgrade the implementation contract to any arbitrary code, potentially introducing malicious logic or critical vulnerabilities without broader community consensus or review (7.3 Access Control, 7.7 Upgrades).

Recommendation: Consider decentralizing the upgrade mechanism further, potentially by integrating a governance module or a more distributed decision-making process. Ensure that all multisig signers are trusted, distinct entities, and that their private keys are secured with best practices.

M-01MediumUnresolved

Lack of Timelock for Upgrades

The current Transparent Proxy setup does not incorporate a timelock for upgrade operations. This means that once an upgrade transaction is approved by the multisig admin, it can be executed immediately. This lack of a delay period prevents users and the community from reviewing proposed changes or reacting to potentially malicious upgrades before they are deployed (7.7 Upgrades, 7.8 Operations).

Recommendation: Implement a timelock mechanism for all critical administrative actions, especially upgrades. This would introduce a mandatory delay between the approval of an upgrade and its actual execution, providing a window for scrutiny and emergency response.

I-01InformationalResolved

Use of Standard OpenZeppelin Contracts

The proxy contract leverages battle-tested and widely audited OpenZeppelin libraries for its core functionality, including `ERC1967Proxy` and `ERC1967Utils`. This significantly reduces the risk of vulnerabilities within the proxy's own code (7.1 Architecture, 7.2 Code Security).

Recommendation: Continue to rely on well-established and audited libraries for core functionalities. Regularly update to the latest stable versions of OpenZeppelin contracts to benefit from ongoing security improvements.

I-02InformationalResolved

Multisig Admin for Proxy

The administrative control over the proxy, including upgrade capabilities, is managed by a 4-of-7 Gnosis Safe multisig. This setup enhances security by requiring multiple independent approvals for critical operations, mitigating the risk of a single point of failure or compromise (7.3 Access Control, 7.8 Operations).

Recommendation: Ensure robust operational security practices for all multisig signers, including strong key management and phishing prevention. Regularly review the list of multisig owners to ensure it remains appropriate and active.

Frequently Asked Questions

Is Humanity a scam?

Based on the provided data, Humanity (H) does not exhibit overt scam indicators like a hidden mint function or unverified contract code. The contract is verified, and ownership is renounced. However, the severe token concentration (89.5% by top 10 holders) combined with unlocked liquidity ($854,223) presents a substantial risk of market manipulation or a liquidity rug pull, which are common characteristics associated with scam projects. Investors should proceed with extreme caution due to these structural vulnerabilities.

Is Humanity safe to buy?

Humanity (H) carries a High Risk score of 59/100, indicating it is not considered safe for investment without significant caution. Key safety concerns include the fact that 89.5% of the supply is held by the top 10 addresses, creating immense centralization risk. Furthermore, the project's $854,223 in liquidity is not locked, exposing investors to a potential rug pull. While contract verification and renounced ownership are positive, these severe structural risks undermine overall safety.

Has Humanity been audited?

The Humanity (H) contract is verified on Ethereum, making its code transparent and publicly viewable. While beneficial for scrutiny, this is distinct from a formal security audit. An independent third-party audit rigorously assesses code for vulnerabilities and exploits. The provided data does not indicate that Humanity has undergone a comprehensive security audit by an independent firm.

Is Humanity a Scam? H