On-chain security analysis — is it a scam or legit?
PolygonCloutArtToken is a standard ERC-20 implementation with centralized administrative controls for minting and pausing.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 24, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x3b1c…65d60x8c04…3ab30xad59…44c10xa5d8…b2b00x2b85…a3a00x109f…aaffNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The mint(address,uint256) function allows an address with the MINTER_ROLE to increase the total supply of tokens. This can lead to significant dilution of existing token holders' value if the role is compromised or misused.
Restrict the MINTER_ROLE to a multi-signature wallet or a time-locked governance contract to prevent unauthorized or sudden supply inflation.
Unresolved
The pause and unpause functions allow an administrator to halt all token transfers globally. This creates a dependency on the administrator's availability and honesty, as they can effectively freeze user assets at will.
Implement a time-lock mechanism for the pause functionality to provide the community with notice before transfers are halted, or remove the pause functionality if it is not strictly required for business operations.
Unresolved
0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a wallet, 0x3b1c…65d6 — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 43% of the token's DEX liquidity; the other pools were not assessed.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
Liquidity $32K (DexScreener, all pools). 24h trading volume $11K (CoinGecko, all markets, daily snapshot). 24h trading volume $143K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.258 on 2021-10-20; the price is now 99.825% below it.
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
The ten largest holders own 90.1% of supply. Of that, 4.0% burned, 6.5% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 29.1% in wallets, 50.5% in other contracts. 1,333 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Sway Social (SWAY), rank #8032. 1,333 holders.
Match the contract address against the project's official channels before trading.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $32K of DEX liquidity across 5 pools. Launch: 1843 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
CloutArtToken is a standard ERC-20 implementation with centralized administrative controls for minting and pausing. The architecture follows OpenZeppelin standards, ensuring robust base functionality. While the contract is secure in its logic, the centralization of power via AccessControl roles presents a trust-based risk for token holders.
The contract utilizes well-audited OpenZeppelin libraries for ERC-20 and AccessControl. 7.1 Architecture is standard, 7.2 Code Security is high due to 0.8.0 compiler usage, and 7.3 Access Control is correctly implemented. No reentrancy or overflow issues were identified in the core transfer logic.
7.4 Economic and 7.5 Governance risks are centralized. The MINTER_ROLE allows for supply expansion, which directly impacts token value. 7.6 External dependencies are minimal, relying only on standard OpenZeppelin contracts.
7.7 Upgrades are not supported as this is a non-proxy contract. 7.8 Operations are managed via standard role-based access control. The immutability of the contract logic provides a high degree of operational certainty.
The protocol should consider transitioning the DEFAULT_ADMIN_ROLE and MINTER_ROLE to a multi-signature wallet or a decentralized governance contract to mitigate single-point-of-failure risks.
Ensure that the private keys associated with these roles are stored in hardware security modules or institutional-grade custody solutions. Regularly monitor the total supply and minting events to ensure transparency for the community. No further code changes are required for the current logic, as the identified risks are inherent to the chosen administrative model.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
