Honeypot, rug-pull and ownership checks
SolanaThis audit of the PunchCard (PUNCH) SPL Token Mint found no critical or high-severity risks based on the available on-chain data and security registries.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Solana holder types come from the account itself: a program-derived account (no private key — vaults, vesting, pools) counts as a contract; anything else is a wallet. DEX pools are matched to the token's own pools and left out of the concentration the score reads.
Holder balances as recorded by the audit of Oct 19, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are locked or burned.
This token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on mint/owner authority, mint capability, LP lock/burn state, holder concentration, which are read directly from chain state and from third-party risk registries.
Read the risk score breakdown below as the substance of this audit. For a code-level review, the token would need an accompanying verified program.
Acknowledged
The ten largest holders own 38.8% of supply. Of that, 16.1% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 22.8% in wallets, 0.0% in other contracts. 545 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as PunchCard (PUNCH), rank #6196. 545 holders.
Match the contract address against the project's official channels before trading.
Acknowledged
100.0% of the pool's LP is burned or time-locked. 100.0% of the pool's LP tokens are burned — that liquidity can never be withdrawn by anyone.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
Liquidity $25K (DexScreener, all pools). 24h trading volume $178K (CoinGecko, all markets, daily snapshot). 24h trading volume $203K (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A community token whose value comes from attention rather than a product. Being a meme is not a risk in itself: it is scored on exactly the same contract and market facts as any other token. The class itself adds no points; the contract and market facts decide the score. Basis: launched on pump.fun (PumpSwap), a meme launchpad. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $25K of DEX liquidity across 1 pools. Launch: launched on pump.fun (PumpSwap), 17 days of market history.
Expect attention-driven volatility; the facts in this report say whether the contract itself can be used against holders.
Acknowledged
The token's oldest DEX pool is 17 days old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.
Re-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.
Acknowledged
This audit of the PunchCard (PUNCH) SPL Token Mint found no critical or high-severity risks based on the available on-chain data and security registries. The mint and freeze authorities are revoked, and liquidity is fully burned. Third-party risk registry data was unavailable, which limits a comprehensive external risk assessment.
The PunchCard (PUNCH) token is an SPL Token-2022 mint with a total supply of 970,217,786.814352 tokens. Both the mint authority and freeze authority have been revoked, preventing further token creation or account freezing. No transfer hook is active, and new accounts are not created in a frozen state, indicating standard token transfer behavior. The token's balance mutability, closability, and non-transferability features are all disabled.
The token exhibits a low concentration of holdings, with the top 10 holders that can sell accounting for 22.75% of the supply. Total DEX liquidity stands at $24,231, with 100% of the pool's LP tokens burned, ensuring liquidity cannot be withdrawn. The 24-hour volume is $203,826, resulting in a Volume/Liquidity Ratio of 8.41, which is moderate for a pair aged 17 days.
The token's core parameters are immutable, as both the mint and freeze authorities are revoked. Furthermore, the metadata (name, symbol, image) is not mutable, ensuring branding consistency. Extensions like transfer fee and transfer hook are not present and are not upgradable, indicating a fixed and predictable token configuration.
Holders should verify on-chain that the mint and freeze authorities remain revoked.
Monitor the token's liquidity and trading volume for any significant changes, especially given the moderate volume-to-liquidity ratio. Be aware that third-party risk registry data was unavailable, so consider this a partial assessment regarding external risk signals.
Paste the contract address into our AI-powered scanner for a deeper real-time report — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
