Early-stage security check — honeypot & rug-pull analysis

Is ShopinX a Scam?

SHOPINX

BNB Chain

Not verified

This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →

Last checked Oct 27, 2026 · 1 audit on recordNew Launch · 5d old

Chart

93/ 100

Critical RiskHow is this score calculated?

How the score breaks downratings: 10 is safest

Technical4/10 Governance1/10 Upgrades2/10 Checks passed4 of 7 Findings2 High · 1 Medium · 1 Low · 5 Info9

SummaryAI Copilot

The ShopinXToken is an ERC-20 compliant token with integrated vesting and time-lock mechanisms.

Read the full analysis

What raised the score

Mintable supply — no cap found, dilution unbounded; held by distributor: EOA
Ownership status UNKNOWN
Liquidity not locked
Top-10 concentration > 70%
Code: Rounding Loss in Vesting Calculations
Code: Predictable Randomness in Vesting

Exact factors

Mintable supply — no cap found, dilution unbounded; held by distributor: EOA
Ownership status UNKNOWN (owner could not be resolved)
Liquidity NOT locked (100% of the pool) — withdrawable by the owner/deployer — rug-pull risk
Top-10 concentration > 70% (76.5% total → 76.5% effective; 76.5% in EOAs, 0.0% in contracts)
Code: Rounding Loss in Vesting Calculations (Low, static analysis)
Code: Predictable Randomness in Vesting (High, static analysis)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Early-stage analysis. This token has limited on-chain history (5d old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.

Security Checklist

as of audit · Oct 274 of 7 checks passed

Contract verifiedVerified

OwnershipUnknown

MintMintable

Liquidity lockNot locked

UpgradeabilityFixed code

HoneypotNone found

Buy / sell tax0% / 0%

Holders

as of audit · Oct 27, 20267,032 holders

WalletsEveryone elseBubble area = share of supply

76.5%of supply sits with the top 10 holders

Walletsanonymous holders, free to sell76.5%
Everyone else7,022 holders23.5%

Effective concentrationwhat the score reads76.5%

How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Oct 27, 2026

Liquidity

as of audit · Oct 27$64.6K

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$64.6KShare of depth100.0%

Top-1 Unlocked Holder100.0%

Top-3 Unlocked100.0%

Unlocked LP held by

0xd746…b5ba

A privileged address — the deployer, the owner, or the token contract itself — is among these holders, so that party can withdraw liquidity.

Security Findings

2 High1 Medium1 Low5 Info

High

Predictable Randomness in Vesting

The vestedAmount function relies on block timestamps and on-chain state that can be influenced or predicted by miners or the distributor, potentially affecting the timing and amount of token releases.CD-02

Issue

Fix

Avoid relying on on-chain values for critical financial calculations where possible, or implement a more robust time-based verification mechanism.

Status

Unresolved

High

Liquidity withdrawable by the owner/deployer

0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by the token's owner/deployer (0xd746…b5ba) — they can pull that liquidity at any moment. This is the rug-pull path. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.QA-LIQUIDITY

Issue

Fix

Check the lock's end date and beneficiary on the locker's own page before relying on it.

Status

Acknowledged

Medium

Centralized Minting and Allocation Control

The distributor role has the power to mint and allocate tokens via batchTransfer functions. This allows the controller to significantly alter the total supply and distribution, potentially diluting existing holders if not managed transparently.CP-01

Issue

Fix

Restrict the distributor role to a multi-signature wallet and provide public documentation of the intended distribution schedule.

Status

Unresolved

Low

Rounding Loss in Vesting Calculations

The functions _validateSchedule and vestedAmount perform division before multiplication, which can lead to precision loss and minor discrepancies in the amount of tokens vested to users.CD-01

Issue

The functions _validateSchedule and vestedAmount perform division before multiplication, which can lead to precision loss and minor discrepancies in the amount of tokens vested to users.

Fix

Refactor the arithmetic to perform all multiplications before divisions to maintain maximum precision.

Status

Unresolved

Info

Who holds the supply

The ten largest holders own 76.5% of supply. What remains: 76.5% in wallets, 0.0% in other contracts. 7,032 holders in total.QA-HOLDERS

Issue

The ten largest holders own 76.5% of supply. What remains: 76.5% in wallets, 0.0% in other contracts. 7,032 holders in total.

Fix

Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

Status

Acknowledged

Info

Listed, but not independently verified

Listed on CoinGecko as ShopinX (SHOPINX). 7,032 holders.QA-IDENTITY

Issue

Listed on CoinGecko as ShopinX (SHOPINX). 7,032 holders.

Fix

Match the contract address against the project's official channels before trading.

Status

Acknowledged

Info

The market for this token

Liquidity $65K (DexScreener, all pools). 24h trading volume $23K (CoinGecko, all markets, daily snapshot). 24h trading volume $35K (DexScreener, all pools).QA-MARKET

Issue

Liquidity $65K (DexScreener, all pools). 24h trading volume $23K (CoinGecko, all markets, daily snapshot). 24h trading volume $35K (DexScreener, all pools).

Fix

Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

Status

Acknowledged

Info

Asset class: Project token

A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $65K of DEX liquidity across 1 pools. Launch: 5 days of market history.QA-PROFILE

Issue

Fix

Check the project's own documentation for what the token is used for; this report covers what the contract allows.

Status

Acknowledged

Info

Recently launched — 5 days of market history

The token's oldest DEX pool is 5 days old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.QA-RECENT

Issue

Fix

Re-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.

Status

Acknowledged

Analysis

AI Copilotas of audit · Oct 27

Executive SummaryWhat the contract is and what the review found

The ShopinXToken is an ERC-20 compliant token with integrated vesting and time-lock mechanisms. The contract utilizes a centralized distribution model where a privileged 'distributor' role manages token allocation during an initial distribution phase. While the core ERC-20 logic is standard, the presence of administrative minting/distribution powers and potential rounding issues in vesting calculations present moderate risks to token holders.

Technical4/10Medium risk

The contract implements standard ERC-20 functionality with robust OpenZeppelin libraries. 7.1 Architecture is modular, separating distribution logic from standard transfers. 7.2 Code Security shows minor arithmetic risks, such as rounding errors in vesting calculations. 7.3 Access Control is strictly enforced via the 'onlyDuringDistribution' modifier, limiting administrative power to the initial phase.

Governance1/10High risk

7.4 Economic risks are centered on the centralized distributor's ability to influence supply during the distribution phase. 7.5 Governance is non-existent, relying entirely on the distributor address. The lack of decentralized control means holders must trust the distributor's adherence to the stated distribution schedule.

Upgrades2/10High risk

7.7 Upgrades are not supported as the contract is not a proxy. 7.8 Operations are limited to the distribution phase, after which the contract becomes immutable regarding distribution logic. This reduces long-term operational risk but limits flexibility.

Final RecommendationWhat to do about this score

It is recommended to implement a multi-signature wallet for the 'distributor' role to mitigate the risk of a single point of failure during the distribution phase.

Additionally, consider transitioning to a decentralized governance model or a time-locked contract to finalize the distribution phase automatically. For the vesting logic, refactor the math to perform multiplication before division to ensure precision. Ensure that all administrative actions are documented and transparently communicated to the community to maintain trust.

Contract & Record

1 audit on record

TypeShopinXToken

NetworkBNB Chain

Token age5d

Contract0x4f0e…0d6b

Deployer0xd746…b5ba

Badge for your website

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History

Oct 27, 202693Critical

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the SHOPINX contract address?

The ShopinX contract on BNB Chain is 0x4f0ed1f48beaa4797a62202a21804cadc2170d6b. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.