Early-stage security check — honeypot & rug-pull analysis
BNB ChainThe protocol implements a highly modular token architecture using EIP-1167 clones.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 20, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are locked or burned.
0x10e4…3b2bNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The postInitialize function allows the tokenModule to change the addresses of critical dependencies such as the quote, shareHolderManager, and tokenHelper. Because transfers depend on these contracts, the controller of the tokenModule can effectively redirect or break token functionality.
Implement a time-lock mechanism for changing critical dependency addresses to allow users to exit if they disagree with the changes.
Unresolved
Functions like onMigrate and onBondingTrade allow privileged modules to modify fee parameters (e.g., feeBurn, feeLiquidity). This allows the protocol to change the economic impact on users without prior notice.
Define hard caps on fee percentages within the contract to prevent excessive taxation by privileged modules.
Unresolved
In the _doDispatchFee function, performing division before multiplication can lead to precision loss, resulting in slightly inaccurate fee calculations.
Reorder arithmetic operations to perform multiplication before division, ensuring higher precision.
Unresolved
The 'swapping' state variable, which can be toggled by internal functions like _swapForQuoteWrapped, acts as a switch for transfer operations. Privileged modules can influence this state, potentially blocking transfers or sales. Ownership is renounced, so no one can call these functions now.
Restrict the ability to toggle transfer-blocking switches to a decentralized governance process rather than a single module address.
Unresolved
The ten largest holders own 91.0% of supply. Of that, 3.2% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 2.5% in wallets, 85.3% in other contracts. 913 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
913 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.
Match the contract address against the project's official channels before trading.
Acknowledged
99.8% of the pool's LP is burned or time-locked. 99.8% of the LP tokens were sent to a burn address — that liquidity can never be withdrawn by anyone. 0.2% is held, unlocked, by 1 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
Liquidity $52K (DexScreener, all pools). 24h trading volume $711K (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: 1% on buy, 1% on sell. Market: $52K of DEX liquidity across 3 pools. Launch: 4 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The token's oldest DEX pool is 4 days old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.
Re-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.
Acknowledged
The protocol implements a highly modular token architecture using EIP-1167 clones. While the core logic is immutable, the token relies heavily on external modules for transfer rules, fee management, and liquidity operations. The centralization of control in privileged modules presents significant trust requirements for token holders.
The architecture utilizes EIP-1167 minimal clones, ensuring the implementation logic cannot be altered post-deployment. 7.1 Architecture is robust for gas efficiency but relies on complex external dependencies. 7.2 Code Security shows standard implementation patterns, though 7.3 Access Control is highly fragmented across multiple modules. 7.6 External calls are frequent, creating potential points of failure if modules are misconfigured.
7.4 Economic parameters are entirely managed by external modules, allowing for dynamic fee adjustments and liquidity pool manipulation. 7.5 Governance is implicit, relying on the integrity of the addresses assigned to the tokenModule, taxVault, and migrateModule. This creates a high trust requirement for users, as these modules can effectively freeze or tax transfers at will.
7.7 Upgrades are not supported due to the EIP-1167 clone pattern, which fixes the implementation logic permanently. 7.8 Operations are stable, as the contract state is managed through internal setters rather than proxy logic. This eliminates risks associated with storage collisions or malicious implementation swaps.
Users should exercise caution regarding the high degree of centralization inherent in the module-based design.
Ensure that the addresses controlling the tokenModule and taxVault are transparent and governed by secure, multi-signature wallets or time-locked contracts to mitigate the risk of arbitrary fee or transfer rule changes.
This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.
Get Detailed Audit Is this your token? Publish your own audit on this page
