On-chain security analysis — is it a scam or legit?
BNB ChainThe protocol implements an upgradeable ERC-20 token with minting and burning capabilities managed by a multisig owner.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 27, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x13f6…5e120x2ee3…55d50x72b2…839f0x41ad…f7ed0x8e0a…76c10x5e91…fac10xe320…e523The contract contains instances where local variables or inherited state variables shadow existing state, which can lead to unintended logic execution or incorrect state updates during contract interactions.
Rename shadowed variables to ensure clarity and prevent accidental overwriting of critical state data.
Unresolved
The mint(address,uint256) function allows addresses with the 'minter' role to create new tokens at will. This centralizes control over the total supply and allows for the dilution of existing token holders.
Restrict the minting role to a timelocked multisig or a decentralized governance contract to ensure transparency and prevent unilateral supply changes.
Unresolved
0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a contract, 0x13f6…5e12 — holds 99.9% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The ten largest holders own 78.2% of supply. What remains: 19.7% in wallets, 58.5% in other contracts. 15,865 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Janction (JCT), market cap $88M, rank #297. 15,865 holders. Verified by: CoinGecko.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $41K (DexScreener, all pools). 24h trading volume $49.6M (CoinGecko, all markets, daily snapshot). 24h trading volume $301K (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable, capped at 384.6% of supply per year. Control: a 5-of-7 multisig. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $41K of DEX liquidity across 2 pools. Launch: 351 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The protocol implements an upgradeable ERC-20 token with minting and burning capabilities managed by a multisig owner. The architecture follows standard UUPS proxy patterns and utilizes OpenZeppelin's Ownable2Step for secure ownership transfers. While the code is well-structured, the centralization of minting authority poses a significant economic risk to token holders.
The implementation utilizes robust, battle-tested libraries for proxy management and token standards (7.1 Architecture, 7.2 Code Security). Access control is strictly enforced via modifiers like onlyMinter and onlyOwner (7.3 Access Control). The codebase is clean and follows modern Solidity patterns, though the complexity of the upgradeable structure requires careful management of storage layouts.
The economic model relies on centralized minting authority, which allows for potential supply inflation (7.4 Economic). Governance is managed via a 5-of-7 multisig, providing a reasonable balance between security and operational agility (7.5 Governance). External dependencies are limited to standard ERC-20 interfaces, reducing external integration risks (7.6 External).
The contract employs the UUPS proxy pattern, which is the industry standard for upgradeable contracts (7.7 Upgrades). The implementation includes necessary safety checks to prevent bricking the proxy during upgrades. Operational procedures for upgrades are well-defined through the multisig owner (7.8 Operations).
The protocol should implement a timelock controller for all privileged functions, including minting and contract upgrades, to provide transparency and a window for community response.
Additionally, consider setting a hard cap on the total supply if not already enforced to mitigate the risk of excessive dilution.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
