On-chain security analysis — is it a scam or legit?
BNB ChainThe TRX contract is a standard ERC-20 implementation with meta-transaction support and role-based access control.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 30, 2026
The 20 remaining pairs hold $13.1K between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xb81d…185c0x7557…f7ab0xbf6d…16010x3a70…02fa0xde10…21a90xe07b…3e1e0x2be2…0afa0x7ae4…6ee30x2ace…c77a0x1f97…20acThe contract includes meta-transaction functionality which may lead users to send ETH to the contract address. There is no mechanism to withdraw these funds, resulting in permanent loss of any ETH sent to the contract.
Add a function to allow the contract owner to withdraw any accidentally sent ETH or native tokens from the contract balance.
Unresolved
The mint(address,uint256) function allows any address with the PREDICATE_ROLE to create new tokens at will. This can lead to significant supply inflation and dilution of existing token holder value if the role is compromised or misused.
Restrict the minting capability to a multi-signature wallet or a governance contract with a timelock to ensure transparency and prevent unilateral supply changes.
Unresolved
0.0% of the pool's LP is burned or time-locked. 98.5% is held, unlocked, by 10 address(es) other than the owner/deployer. One of them — a contract, 0xb81d…185c — holds 68.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 7% of the token's DEX liquidity; the other pools were not assessed.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The ten largest holders own 90.8% of supply. Of that, 85.1% burned, 0.1% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 2.9% in wallets, 2.7% in other contracts. 109,329 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as TRON (BSC) (TRX). Traded on Binance. 109,329 holders. Verified by: exchange listings.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $4.6M (DexScreener, all pools). 24h trading volume $189K (CoinGecko, all markets, daily snapshot). 24h trading volume $1.3M (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $4.6M of DEX liquidity across 30 pools. Launch: 1655 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The TRX contract is a standard ERC-20 implementation with meta-transaction support and role-based access control. The architecture is robust for standard token operations, but the presence of an unrestricted minting capability and trapped ETH in the meta-transaction handler presents moderate risks to token holders.
The contract utilizes standard OpenZeppelin libraries for ERC-20 and AccessControl, ensuring 7.1 Architecture and 7.2 Code Security standards are met. 7.3 Access Control is correctly implemented via roles, though 7.6 External interactions via meta-transactions lack a withdrawal mechanism for trapped funds. 7.8 Operations are stable, but the lack of a sweep function for ETH is a minor operational oversight.
7.4 Economic risks are present due to the minting function, which allows for supply inflation. 7.5 Governance is centralized under the PREDICATE_ROLE, which can unilaterally alter the token supply. This centralization is typical for bridge-minted tokens but requires high trust in the operator.
7.7 Upgrades are not applicable as the contract is not a proxy. The logic is immutable, providing certainty to users regarding the token's behavior. No upgrade path exists, which eliminates risks associated with malicious logic changes.
Implement a withdrawal function restricted to the owner to recover any ETH accidentally sent to the contract.
Additionally, consider implementing a timelock or a multi-signature wallet for the PREDICATE_ROLE to mitigate the risk of unauthorized or excessive token minting.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
