Early-stage security check — honeypot & rug-pull analysis
BNB ChainThe SecuritiesToken is an upgradeable ERC-20 implementation designed for regulated asset issuance.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 20, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x2422…647d0x8145…09920xcda1…5c3a0x7db4…10ba0x5053…2be10xae47…3d800xe577…95110xc770…01700x0043…d4070xcba9…27dfNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The contract allows a privileged role to change the addresses of the Compliance and PauseManager contracts. Because all token transfers depend on these external contracts, an administrator can effectively halt all transfers or bypass compliance checks at will.
Implement a multi-signature wallet for the administrative role and consider adding a timelock to any function that updates critical external contract dependencies.
Unresolved
The setUIMultiplier function allows privileged roles to modify the transfer fee structure. This gives the administrator the ability to change the cost of moving tokens without prior notice to token holders.
Document the fee adjustment policy clearly and implement a notice period or a cap on how frequently or drastically fees can be adjusted.
Unresolved
0.0% of the pool's LP is burned or time-locked. 96.4% is held, unlocked, by 10 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
Privileged roles can modify numeric limits related to transaction sizes or wallet thresholds via the setUIMultiplier function. This allows the administrator to restrict or enable specific transfer behaviors arbitrarily.
Ensure that any changes to transfer limits are communicated to the community and governed by a transparent policy.
Unresolved
The ten largest holders own 99.4% of supply. Of that, 1.2% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 96.3% in wallets, 1.9% in other contracts. 3,658 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as iShares MSCI South Korea ETF (bStocks Tokenized Stock) (EWYB), market cap $10M, rank #1193. 3,658 holders.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $222K (DexScreener, all pools). 24h trading volume $5.0M (CoinGecko, all markets, daily snapshot). 24h trading volume $1.2M (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token backed by an off-chain asset (a stock, gold, treasury bills, a fund share) held by a named issuer or custodian. Issuance, redemption and transfer restrictions are the issuer's by design. The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Tokenized Exchange-Traded Funds (ETFs). Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $222K of DEX liquidity across 30 pools. Launch: 5 days of market history.
Treat the issuer or custodian as the counterparty: check its custody reports and who may hold or redeem the token.
Acknowledged
The token's oldest DEX pool is 5 days old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.
Re-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.
Acknowledged
The SecuritiesToken is an upgradeable ERC-20 implementation designed for regulated asset issuance. It utilizes a robust role-based access control system and modular compliance/pause logic. While the architecture is modular, the high degree of administrative control over core transfer logic and external dependencies introduces significant centralization risks.
The contract follows standard OpenZeppelin upgradeable patterns (7.1 Architecture) and implements secure ERC-20 logic (7.2 Code Security). Access control is strictly enforced via AccessControlEnumerable (7.3 Access Control). However, the reliance on external compliance and pause manager contracts (7.6 External) creates a single point of failure if those addresses are compromised.
Governance is centralized under administrative roles (7.5 Governance). Economic parameters like transfer fees and UI multipliers are fully adjustable by privileged roles (7.4 Economic). This allows for dynamic regulation but requires high trust in the administrative keys.
The contract utilizes a Beacon proxy pattern (7.7 Upgrades), allowing for standardized upgrades across multiple instances. Operations (7.8 Operations) are well-defined through explicit setter functions. The upgradeability mechanism is standard and well-implemented.
To mitigate centralization risks, it is recommended to transition administrative roles to a multi-signature wallet or a decentralized governance contract.
This ensures that critical changes to compliance, pause managers, and economic multipliers require consensus rather than a single point of failure. Additionally, implement a timelock mechanism for all sensitive administrative functions. This provides transparency and allows users to react to significant changes in token logic or economic parameters before they take effect.
This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.
Get Detailed Audit Is this your token? Publish your own audit on this page
