Early-stage security check — honeypot & rug-pull analysis
The ClankerToken contract is an ERC-20 token implementation with additional features for cross-chain operations and administrative control.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 14, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xffa3…0762crosschainBurn function allows the SuperchainTokenBridge address to burn tokens from any account. This means the privileged address can arbitrarily reduce or zero out any token holder's balance without their consent, effectively confiscating their tokens.CP-02The crosschainBurn function allows the SuperchainTokenBridge address to burn tokens from any account. This means the privileged address can arbitrarily reduce or zero out any token holder's balance without their consent, effectively confiscating their tokens.
The SuperchainTokenBridge address must be protected with the most stringent security protocols, ideally a multi-signature wallet with a high threshold of signers. Implement comprehensive monitoring and alerting for all crosschainBurn operations. Clearly communicate the intended use and limitations of this power to the community, and consider if such a direct balance manipulation capability is strictly necessary or if alternative, less centralized mechanisms could be used.
Unresolved
crosschainMint function allows the SuperchainTokenBridge address to mint any amount of new ClankerToken. This capability means that a single privileged entity can increase the total supply of tokens at will, which directly dilutes the value of tokens held by all other token holders.CP-01The crosschainMint function allows the SuperchainTokenBridge address to mint any amount of new ClankerToken. This capability means that a single privileged entity can increase the total supply of tokens at will, which directly dilutes the value of tokens held by all other token holders.
Ensure that the SuperchainTokenBridge address is secured with the highest possible standards, such as a robust multi-signature wallet. Implement strict operational policies and monitoring for all minting activities. Consider adding a rate limit or a time-lock for large minting operations, or requiring a governance vote for significant supply increases.
Unresolved
0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a contract, 0xffa3…0762 — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The ten largest holders own 100.0% of supply. What remains: 1.0% in wallets, 99.0% in other contracts. 4,811 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
4,811 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $10.2M (DexScreener, all pools). 24h trading volume $61.7M (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner key. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $10.2M of DEX liquidity across 2 pools. Launch: under a day of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The token's oldest DEX pool is less than a day old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.
Re-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.
Acknowledged
The ClankerToken contract is an ERC-20 token implementation with additional features for cross-chain operations and administrative control. The audit identified significant centralized control points, specifically the ability for a privileged address to mint new tokens and directly burn tokens from any holder's balance. These capabilities introduce high technical and economic risks.
The ClankerToken contract implements the ERC-20 standard, including burnable, votes, and permit functionalities. The contract includes several privileged functions: updateAdmin, updateImage, and updateMetadata are restricted to an _admin address (7.3 Access Control). Critically, the crosschainMint and crosschainBurn functions are restricted to the SuperchainTokenBridge address. The crosschainBurn function allows this privileged address to directly reduce any holder's balance, posing a high technical risk (7.2 Code Security). The crosschainMint function allows arbitrary token creation, impacting supply (7.2 Code Security).
The economic model of ClankerToken is highly centralized due to the SuperchainTokenBridge's ability to mint and burn tokens. The crosschainMint function allows this address to increase the total supply at will, directly diluting all existing token holders (7.4 Economic). Furthermore, the crosschainBurn function enables the SuperchainTokenBridge to arbitrarily decrease any user's token balance, which represents a severe economic risk as it allows for direct confiscation of funds (7.4 Economic). The _admin address can also transfer its administrative control via updateAdmin (7.5 Governance).
The ClankerToken contract is not designed as an upgradeable proxy. It is a standard implementation contract, meaning its logic cannot be changed after deployment. This design choice eliminates upgrade-related risks (7.7 Upgrades) but also means any discovered vulnerabilities would require a new deployment and migration.
It is crucial to implement robust security measures for the SuperchainTokenBridge address, as it holds significant power over the token supply and individual balances.
Consider implementing multi-signature control or a time-locked governance mechanism for these critical functions to mitigate the risk of a single point of failure or compromise. Additionally, ensure transparent communication with token holders regarding the capabilities of privileged addresses and the intended use of cross-chain minting and burning functionalities.
This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.
Get Detailed Audit Is this your token? Publish your own audit on this page
