Quantum Audit Logo
Launch App

Early-stage security check — honeypot & rug-pull analysis

Is Mule a Scam?

MULEBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Oct 20, 2026 · 1 audit on recordNew Launch · 5d old
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance4/10Upgrades4/10Checks passed4 of 7Findings1 High · 3 Medium · 1 Low · 6 Info11
SummaryAI Copilot

The Token contract is a highly centralized ERC-20 implementation featuring extensive administrative control over token economics, transfer logic, and fund distribution.

Read the full analysis
What raised the score
  • A privileged address can replace a contract every transfer depends on; held by deployer: Other-Contract
  • A privileged address controls a switch that decides whether transfers go through; held by factory: EOA
  • Owner can change the buy/sell tax; held by deployer: Other-Contract, factory: EOA
  • A privileged address can change transfer or wallet limits; held by factory: EOA
  • Mintable supply — no cap found, dilution unbounded; held by deployer: Other-Contract
Exact factors
  • A privileged address can replace a contract every transfer depends on; held by deployer: Other-Contract
  • A privileged address controls a switch that decides whether transfers go through; held by factory: EOA
  • Owner can change the buy/sell tax; held by deployer: Other-Contract, factory: EOA
  • A privileged address can change transfer or wallet limits; held by factory: EOA
  • Mintable supply — no cap found, dilution unbounded; held by deployer: Other-Contract

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Early-stage analysis. This token has limited on-chain history (5d old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.

Security Checklist

as of audit · Oct 204 of 7 checks passed
Contract verifiedVerified
OwnershipRetained
MintMintable
Liquidity lockLocked
UpgradeabilityFixed code
HoneypotNone found
Buy / sell tax3% / 3%

Holders

as of audit · Oct 20, 20265,708 holders
13.2%Wallets80.0%Burned5.7%
13.2%Wallets80.0%Burned5.7%
ContractsWalletsBurnedDEX poolsEveryone elseBubble area = share of supply
94.3%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking0.2%
  • Walletsanonymous holders, free to sell13.2%
  • Burnedout of circulation80.0%
  • DEX poolsthe pools' own liquidity0.8%
  • Everyone else5,698 holders5.7%
Effective concentrationwhat the score reads13.3%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Oct 20, 2026

Liquidity

as of audit · Oct 20$66.5K

The risk score reads depth across every pair.

LP tokensLocked

The LP tokens of the analysed pool are locked or burned.

Analysed pool$66.5KShare of depth100.0%
LP Burned100.0% · ≈ permanent lock
LP Locked100.0% · Null Address

Security Findings

1 High3 Medium1 Low6 Info
High

Centralized Control Over External Dependencies

The router address, which is critical for token transfers and liquidity operations, can be set by the deployer. This allows the controller to redirect token logic or potentially trap funds.CP-03

Issue

The router address, which is critical for token transfers and liquidity operations, can be set by the deployer. This allows the controller to redirect token logic or potentially trap funds.

Fix

Make the router address immutable after deployment or require a time-locked governance process for any changes.

Status

Unresolved

Medium

Privileged Minting Capability

The init function allows the deployer to define the total supply during initialization, effectively minting tokens. This can lead to supply dilution if not transparently managed.CP-01

Issue

The init function allows the deployer to define the total supply during initialization, effectively minting tokens. This can lead to supply dilution if not transparently managed.

Fix

Restrict minting capabilities or implement a hard cap on the total supply that cannot be exceeded by any administrative function.

Status

Unresolved

Medium

Transfer Circuit Breaker

The factory address can disable the swap mechanism via the resetSwap function, effectively halting trading or specific transfer paths at will.CP-05

Issue

The factory address can disable the swap mechanism via the resetSwap function, effectively halting trading or specific transfer paths at will.

Fix

Implement a time-lock or multi-signature requirement for disabling trading to prevent sudden, unauthorized halts.

Status

Unresolved

Medium

Arbitrary Fee Modification

Administrative roles can change the tax rates (marketing/platform) at any time, directly impacting the economic value and cost of trading for users.CP-07

Issue

Administrative roles can change the tax rates (marketing/platform) at any time, directly impacting the economic value and cost of trading for users.

Fix

Set a maximum fee cap in the contract code to prevent administrative abuse of the tax system.

Status

Unresolved

Low

Dynamic Transaction Limits

The swap threshold and other numeric limits can be adjusted by the factory, which may affect the liquidity and trading behavior of the token.CP-08

Issue

The swap threshold and other numeric limits can be adjusted by the factory, which may affect the liquidity and trading behavior of the token.

Fix

Ensure that any changes to transaction limits are communicated to the community and restricted to reasonable bounds.

Status

Unresolved

Info

Who holds the supply

The ten largest holders own 94.3% of supply. Of that, 80.0% burned, 0.8% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 13.2% in wallets, 0.2% in other contracts. The deployer/owner wallet itself holds 10.7%. 5,708 holders in total.QA-HOLDERS

Issue

The ten largest holders own 94.3% of supply. Of that, 80.0% burned, 0.8% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 13.2% in wallets, 0.2% in other contracts. The deployer/owner wallet itself holds 10.7%. 5,708 holders in total.

Fix

Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

Status

Acknowledged

Info

Not listed by any independent source

5,708 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.QA-IDENTITY

Issue

5,708 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.

Fix

Match the contract address against the project's official channels before trading.

Status

Acknowledged

Info

Liquidity burned — cannot be withdrawn

100.0% of the pool's LP is burned or time-locked. 100.0% of the LP tokens were sent to a burn address — that liquidity can never be withdrawn by anyone. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.QA-LIQUIDITY

Issue

100.0% of the pool's LP is burned or time-locked. 100.0% of the LP tokens were sent to a burn address — that liquidity can never be withdrawn by anyone. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.

Fix

Check the lock's end date and beneficiary on the locker's own page before relying on it.

Status

Acknowledged

Info

The market for this token

Liquidity $66K (DexScreener, all pools). 24h trading volume $59K (DexScreener, all pools).QA-MARKET

Issue

Liquidity $66K (DexScreener, all pools). 24h trading volume $59K (DexScreener, all pools).

Fix

Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

Status

Acknowledged

Info

Asset class: Project token

A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: deployer — a contract; factory — a single wallet (EOA). Code: not upgradeable (no proxy). Fees: 3% on buy, 3% on sell. Market: $66K of DEX liquidity across 1 pools. Launch: 5 days of market history.QA-PROFILE

Issue

A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: deployer — a contract; factory — a single wallet (EOA). Code: not upgradeable (no proxy). Fees: 3% on buy, 3% on sell. Market: $66K of DEX liquidity across 1 pools. Launch: 5 days of market history.

Fix

Check the project's own documentation for what the token is used for; this report covers what the contract allows.

Status

Acknowledged

Info

Recently launched — 5 days of market history

The token's oldest DEX pool is 5 days old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.QA-RECENT

Issue

The token's oldest DEX pool is 5 days old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.

Fix

Re-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.

Status

Acknowledged

Analysis

AI Copilotas of audit · Oct 20
Executive SummaryWhat the contract is and what the review found

The Token contract is a highly centralized ERC-20 implementation featuring extensive administrative control over token economics, transfer logic, and fund distribution. While the code follows standard ERC-20 patterns, the reliance on a factory-controlled architecture introduces significant trust requirements for token holders. The contract includes mechanisms for tax collection, emergency fund distribution, and circuit breakers, all of which are managed by privileged addresses.

Technical8/10Low risk

The contract implements standard ERC-20 functionality with custom logic for tax and swap management. 7.1 Architecture relies on a factory-pattern for administrative control. 7.2 Code Security is maintained through standard Solidity patterns, though 7.3 Access Control is highly centralized. 7.6 External dependencies are limited to the router, which is configurable by the deployer.

Governance4/10Medium risk

7.4 Economic and 7.5 Governance aspects are entirely controlled by the deployer and factory addresses. The ability to mint tokens and modify tax rates allows for arbitrary economic manipulation. These centralized controls pose a significant risk to token holders as they lack decentralized oversight.

Upgrades4/10Medium risk

7.7 Upgrades are not supported via proxy patterns; the contract is immutable. However, 7.8 Operations are highly flexible due to the extensive administrative functions provided. This allows for operational adjustments without requiring contract redeployment.

Final RecommendationWhat to do about this score

Investors should be aware that the contract is highly centralized, with the deployer and factory addresses possessing the ability to alter core token mechanics, including supply and tax structures.

It is recommended that the project transition to a multi-signature wallet or a decentralized governance model to mitigate the risk of single-point-of-failure administrative abuse. Furthermore, users should monitor the factory address for any changes to the router or swap logic, as these directly impact the ability to trade the token. The current architecture requires absolute trust in the entity controlling the factory and deployer roles.

Contract & Record

1 audit on record
TypeToken
NetworkBNB Chain
Token age5d
Contract0x5cbe…8888
Deployer0xd6b0…df1a
Badge for your website
Mule security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Oct 20, 202658Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
Concrete TokenCT · BNB Chain58MediumUnibaseUB · BNB Chain57MediumCapBNB Chain57MediumVELOBNB Chain57MediumSlap CatSLAP · BNB Chain59MediumUnitasUP · BNB Chain59Medium

Would You Like a More Detailed Audit of Mule?

This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.

Get Detailed Audit Is this your token? Publish your own audit on this page