On-chain security analysis — is it a scam or legit?
PolygonThe MEBT contract is a standard ERC-20 token with added tax and minting capabilities.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 20, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are locked or burned.
0xe54a…13340x9808…3348No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The functions setBuyRates and setSellRates contain redundant checks and logic structures that could be simplified to reduce the attack surface.
Refactor the tax rate setting logic into a single internal function to ensure consistency and reduce code duplication.
Unresolved
The mint function allows the oracle or rbs addresses to create new tokens at any time, which can dilute the value of existing holdings.
Implement a hard cap on the total supply or move the minting authority to a decentralized governance process.
Unresolved
The governance role can change the tax rates for buys and sells at any time via setBuyRates and setSellRates, potentially impacting user liquidity.
Introduce a maximum fee cap or a time-lock delay for any changes to the tax rates.
Unresolved
The ten largest holders own 99.8% of supply. Of that, 6.5% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 0.3% in wallets, 93.1% in other contracts. 7,545 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
7,545 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.
Match the contract address against the project's official channels before trading.
Acknowledged
92.7% of the pool's LP is burned or time-locked. 44.0% is locked in PinkLock02 until 30 Jun 2029 (984 days). Until then nobody — the project included — can withdraw it unless the locker contract itself is flawed; after that date the lock's owner can. 16.1% is locked in PinkLock02 until 31 Jul 2029 (1015 days). Until then nobody — the project included — can withdraw it unless the locker contract itself is flawed; after that date the lock's owner can. 12.3% is locked in PinkLock02 until 31 Jul 2029 (1015 days). Until then nobody — the project included — can withdraw it unless the locker contract itself is flawed; after that date the lock's owner can. 10.6% is locked in PinkLock02 until 31 Aug 2029 (1045 days). Until then nobody — the project included — can withdraw it unless the locker contract itself is flawed; after that date the lock's owner can. 9.7% is locked in PinkLock02 until 31 Oct 2029 (1106 days). Until then nobody — the project included — can withdraw it unless the locker contract itself is flawed; after that date the lock's owner can. 7.3% is held, unlocked, by 1 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
Liquidity $475K (DexScreener, all pools). 24h trading volume $67K (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: 0% on buy, 5% on sell. Market: $475K of DEX liquidity across 1 pools. Launch: 137 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The MEBT contract is a standard ERC-20 token with added tax and minting capabilities. It relies on centralized governance and oracle roles to manage supply and transfer fees. While the code is clean and follows standard OpenZeppelin patterns, the high degree of centralization poses significant risks to token holders.
The contract utilizes standard OpenZeppelin libraries for ERC-20, Burnable, and Permit functionality, ensuring 7.1 Architecture and 7.2 Code Security standards are met. 7.3 Access Control is implemented via custom modifiers, though it grants extensive power to the governance and oracle roles. 7.8 Operations are straightforward, with clear event logging for all state-changing functions.
7.4 Economic and 7.5 Governance aspects are highly centralized. The governance role can arbitrarily modify transfer fees and whitelist addresses, directly impacting 7.6 External interactions. The ability to mint tokens via the oracle role creates a risk of supply dilution for existing holders.
The contract is not a proxy and does not support 7.7 Upgrades. The logic is immutable, which provides security against hidden logic changes but prevents patching if vulnerabilities are discovered.
To improve security, consider implementing a multi-signature wallet or a time-lock mechanism for the governance role to prevent immediate, unilateral changes to token economics.
Additionally, consider replacing the single oracle/rbs minting authority with a more decentralized mechanism or a hard-capped supply to protect holders from unexpected dilution.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
