Quantum Audit Logo

Is The PumpFun Heist a Scam?

Early-stage security check — honeypot & rug-pull analysis

Is this your token? Publish your own audit on this page →

The PumpFun Heist BANDIT
JCX5nD…f7Ah
Solana
Not verifiedThis record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked today 1 audit on record New Launch · 2d old
DexScreener ↗
How is this score calculated? → Low Risk
Executive SummaryAI Copilot

This audit of The PumpFun Heist (BANDIT) SPL token mint found no critical or high-severity risks based on available on-chain data and third-party security registries. Key authorities like Mint and Freeze are revoked, and liquidity is 100% burned. Holder distribution data was unavailable, preventing a full assessment of concentration risk.

6 Informational
! Early-stage analysis. This token has limited on-chain history (2d old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.
Volume 24h
$175.9K
Liquidity
$31.3K
Price
$0.0000773
Token Age
2d
Top 10 Holders
0.0%

Security Findings

6 Info
Info

No code-level findings — an SPL mint exposes no auditable program source

I-01This token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on mint/owner authority, mint capability, LP lock/burn state, which are read directly from chain state and from third-party risk registries.
IssueThis token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on mint/owner authority, mint capability, LP lock/burn state, which are read directly from chain state and from third-party risk registries.
FixRead the risk score breakdown below as the substance of this audit. For a code-level review, the token would need an accompanying verified program.
StatusAcknowledged
Info

Not listed by any independent source

QA-IDENTITYNot listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.
IssueNot listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.
FixMatch the contract address against the project's official channels before trading.
StatusAcknowledged
Info

Liquidity burned — cannot be withdrawn

QA-LIQUIDITY100.0% of the pool's LP is burned or time-locked. 100.0% of the pool's LP tokens are burned — that liquidity can never be withdrawn by anyone. This assessment covers the main pool, which holds 90% of the token's DEX liquidity; the other pools were not assessed.
Issue100.0% of the pool's LP is burned or time-locked. 100.0% of the pool's LP tokens are burned — that liquidity can never be withdrawn by anyone. This assessment covers the main pool, which holds 90% of the token's DEX liquidity; the other pools were not assessed.
FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.
StatusAcknowledged
Info

The market for this token

QA-MARKETLiquidity $35K (DexScreener, all pools). 24h trading volume $190K (DexScreener, all pools).
IssueLiquidity $35K (DexScreener, all pools). 24h trading volume $190K (DexScreener, all pools).
FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
StatusAcknowledged
Info

Asset class: Meme token

QA-PROFILEA community token whose value comes from attention rather than a product. Being a meme is not a risk in itself: it is scored on exactly the same contract and market facts as any other token. The class itself adds no points; the contract and market facts decide the score. Basis: launched on pump.fun (PumpSwap), a meme launchpad. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $35K of DEX liquidity across 4 pools. Launch: launched on pump.fun (PumpSwap), 2 days of market history.
IssueA community token whose value comes from attention rather than a product. Being a meme is not a risk in itself: it is scored on exactly the same contract and market facts as any other token. The class itself adds no points; the contract and market facts decide the score. Basis: launched on pump.fun (PumpSwap), a meme launchpad. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $35K of DEX liquidity across 4 pools. Launch: launched on pump.fun (PumpSwap), 2 days of market history.
FixExpect attention-driven volatility; the facts in this report say whether the contract itself can be used against holders.
StatusAcknowledged
Info

Recently launched — 2 days of market history

QA-RECENTThe token's oldest DEX pool is 2 days old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.
IssueThe token's oldest DEX pool is 2 days old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.
FixRe-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.
StatusAcknowledged

Category Ratings

TechnicalLow10/10

The token is implemented using the spl-token-2022 program. Both the Mint Authority and Freeze Authority have been revoked, preventing further token minting or freezing of accounts. No Token-2022 extensions such as a Transfer Hook or Default Account State Frozen are active, indicating standard token behavior without custom transfer logic or initial account restrictions.

GovernanceLow9/10

The token has a total DEX liquidity of $32,441. A significant positive is that 100.0% of the pool's LP tokens are burned, ensuring this liquidity cannot be withdrawn by any party. The 24-hour volume is $173,951, resulting in a Volume/Liquidity Ratio of 5.36. The pair is relatively new, at 2 days old. Holder concentration data was unavailable, so this aspect of economic risk could not be assessed.

UpgradesLow10/10

The token's core parameters are immutable due to the revocation of both Mint and Freeze authorities. Furthermore, the metadata is not mutable, meaning the token name, symbol, or image cannot be changed post-launch. There are no upgradable features like transfer fees or transfer hooks, ensuring the token's behavior remains consistent.

Security Checklist

4/4 checks passed
Contract VerifiedPass
No Mint FunctionPass
Liquidity LockedPass
Not a ProxyPass
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Liquidity Depth

$34.7K across 4 pairs
PumpswapSOLanalysed$31.3K90.2%Meteora DLMMSOL$3.1K8.9%Meteora DLMMSOL$2000.6%Meteora DLMMSOL$1090.3%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

What Raised This Score

1 factors
  • Liquidity < $50k ($34,719 across 4 pairs — thin market)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Make Aliens Great Again (MAGA)Low RiskOTCLow RiskMPP32 (M32)Low RiskMosaic (MOS)Low RiskArqen (ARQ)Low RiskPurpsLow Risk

Would You Like a More Detailed Audit of The PumpFun Heist?

This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.

Get Detailed Audit