Early-stage security check — honeypot & rug-pull analysis

Is Un1corn a Scam?

UN1

Ethereum

Not verified

This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →

Last checked Oct 21, 2026 · 1 audit on recordNew Launch · 8h old

Chart

84/ 100

High RiskHow is this score calculated?

How the score breaks downratings: 10 is safest

Technical2/10 Governance1/10 Upgrades3/10 Checks passed3 of 7 Findings3 High · 3 Medium · 2 Low · 5 Info13

SummaryAI Copilot

The UN1Token protocol implements a complex token system with integrated NFT-like card mechanics and reward distribution.

Read the full analysis

What raised the score

A privileged address can replace a contract every transfer depends on; held by deployer: Other-Contract
Owner can change the buy/sell tax; held by beacon: Other-Contract, deployer: Other-Contract, distributor: Other-Contract, mirror: Other-Contract
A privileged address can change transfer or wallet limits; held by beacon: Other-Contract, distributor: Other-Contract, hook: Other-Contract, mirror: Other-Contract
Mintable supply — no cap found, dilution unbounded; held by deployer: Other-Contract, mirror: Other-Contract
Ownership status UNKNOWN
Liquidity not locked
Liquidity < $50k
Top-10 concentration > 30%
Contract source not verified — its logic cannot be read
Code: Rounding Loss via Division Before Multiplication
Code: Uninitialized State Variables
Code: Predictable Randomness

Exact factors

A privileged address can replace a contract every transfer depends on; held by deployer: Other-Contract
Owner can change the buy/sell tax; held by beacon: Other-Contract, deployer: Other-Contract, distributor: Other-Contract, mirror: Other-Contract
A privileged address can change transfer or wallet limits; held by beacon: Other-Contract, distributor: Other-Contract, hook: Other-Contract, mirror: Other-Contract
Mintable supply — no cap found, dilution unbounded; held by deployer: Other-Contract, mirror: Other-Contract
Ownership status UNKNOWN (owner could not be resolved)
Liquidity NOT locked (100% of the pool; this pool is 100% of DEX liquidity) — held by independent providers — market-depth risk
Liquidity < $50k ($24,553 across 2 pairs — thin market)
Top-10 concentration > 30% (97.5% total → 45.3% effective; 10.4% in EOAs, 87.0% in contracts)
Contract source NOT verified — its logic cannot be read
Code: Rounding Loss via Division Before Multiplication (Low, static analysis)
Code: Uninitialized State Variables (High, static analysis)
Code: Predictable Randomness (High, static analysis)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Early-stage analysis. This token has limited on-chain history (8h old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.

Security Checklist

as of audit · Oct 213 of 7 checks passed

Contract verifiedNot verified

OwnershipUnknown

MintMintable

Liquidity lockNot locked

UpgradeabilityFixed code

HoneypotNone found

Buy / sell tax0% / 0%

Holders

as of audit · Oct 21, 202643 holders

ContractsWalletsEveryone elseBubble area = share of supply

97.5%of supply sits with the top 10 holders

Contractstreasury, vesting, bridge, staking87.0%
Walletsanonymous holders, free to sell10.4%
Everyone else33 holders2.5%

Effective concentrationwhat the score reads45.3%

How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Oct 21, 2026

Liquidity

as of audit · Oct 21$24.6K across 2 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$24.5KShare of depth99.9%

Top-1 Unlocked Holder100.0%

Top-3 Unlocked100.0%

Unlocked LP held by

0x629d…eb5c

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

3 High3 Medium2 Low5 Info

High

Uninitialized State Variables

Variables related to card management are used before being initialized, which can lead to undefined behavior or system failure.CD-02

Issue

Variables related to card management are used before being initialized, which can lead to undefined behavior or system failure.

Fix

Ensure all state variables are explicitly initialized in the constructor or the initialize function.

Status

Unresolved

High

Predictable Randomness

Randomness is derived from on-chain values that are predictable, allowing users to influence outcomes in the card system.CD-03

Issue

Randomness is derived from on-chain values that are predictable, allowing users to influence outcomes in the card system.

Fix

Use a verifiable randomness source like Chainlink VRF to ensure secure and unpredictable outcomes.

Status

Unresolved

High

Dependency Replacement Risk

The deployer can change the address of the external contract that governs token transfers, allowing a malicious actor to redirect or halt all token movements.CP-03

Issue

The deployer can change the address of the external contract that governs token transfers, allowing a malicious actor to redirect or halt all token movements.

Fix

Restrict the ability to change external dependencies to a multi-signature wallet with a mandatory delay period.

Status

Unresolved

Medium

Privileged Minting Capability

The deployer and mirror roles can increase the total token supply through initialize, mirrorTransfer, and compose functions, which may dilute existing holders.CP-01

Issue

The deployer and mirror roles can increase the total token supply through initialize, mirrorTransfer, and compose functions, which may dilute existing holders.

Fix

Implement a hard cap on total supply or require a time-locked governance vote for any minting operations.

Status

Unresolved

Medium

Centralized Fee Control

Privileged roles can arbitrarily modify transfer fees, which directly impacts the economic utility of the token.CP-07

Issue

Privileged roles can arbitrarily modify transfer fees, which directly impacts the economic utility of the token.

Fix

Define fee ranges in the contract logic and enforce them to prevent excessive or predatory fee adjustments.

Status

Unresolved

Medium

Liquidity not locked

0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a wallet, 0x629d…eb5c — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.QA-LIQUIDITY

Issue

Fix

Check the lock's end date and beneficiary on the locker's own page before relying on it.

Status

Acknowledged

Low

Rounding Loss via Division Before Multiplication

Calculations in _update and related functions perform division before multiplication, leading to precision loss.CD-01

Issue

Calculations in _update and related functions perform division before multiplication, leading to precision loss.

Fix

Reorder operations to perform multiplication before division to maintain precision.

Status

Unresolved

Low

Arbitrary Limit Modification

Privileged roles can change transaction and wallet limits, potentially leading to unexpected restrictions on user activity.CP-08

Issue

Privileged roles can change transaction and wallet limits, potentially leading to unexpected restrictions on user activity.

Fix

Hardcode reasonable limits or implement a transparent, public process for parameter adjustments.

Status

Unresolved

Info

Who holds the supply

The ten largest holders own 97.5% of supply. What remains: 10.4% in wallets, 87.0% in other contracts. 43 holders in total.QA-HOLDERS

Issue

The ten largest holders own 97.5% of supply. What remains: 10.4% in wallets, 87.0% in other contracts. 43 holders in total.

Fix

Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

Status

Acknowledged

Info

Not listed by any independent source

43 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.QA-IDENTITY

Issue

43 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.

Fix

Match the contract address against the project's official channels before trading.

Status

Acknowledged

Info

The market for this token

Liquidity $25K (DexScreener, all pools). 24h trading volume $95K (DexScreener, all pools).QA-MARKET

Issue

Liquidity $25K (DexScreener, all pools). 24h trading volume $95K (DexScreener, all pools).

Fix

Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

Status

Acknowledged

Info

Asset class: Project token

A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $25K of DEX liquidity across 2 pools. Launch: under a day of market history.QA-PROFILE

Issue

Fix

Check the project's own documentation for what the token is used for; this report covers what the contract allows.

Status

Acknowledged

Info

Recently launched — less than a day of market history

The token's oldest DEX pool is less than a day old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.QA-RECENT

Issue

Fix

Re-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.

Status

Acknowledged

Analysis

AI Copilotas of audit · Oct 21

Executive SummaryWhat the contract is and what the review found

The UN1Token protocol implements a complex token system with integrated NFT-like card mechanics and reward distribution. The architecture relies heavily on privileged roles (deployer, mirror, beacon, distributor) that possess significant control over token supply, transfer logic, and external contract dependencies. While the code structure is modular, the high degree of centralization and the presence of uninitialized state variables pose significant risks to system integrity.

Technical2/10High risk

The architecture utilizes a multi-role system to manage token lifecycle and reward distribution. 7.1 Architecture: Highly modular but complex, relying on external hooks and beacons. 7.2 Code Security: Significant issues identified including uninitialized state variables and predictable randomness. 7.3 Access Control: Centralized control allows privileged roles to modify core token mechanics, including supply and transfer rules.

Governance1/10High risk

7.4 Economic: Token supply is dynamic and controlled by privileged roles, creating potential for dilution. 7.5 Governance: No decentralized governance is present; all parameters are managed by specific addresses. 7.6 External: The protocol depends on external contracts (mirror, beacon) which can be updated, introducing supply chain risks.

Upgrades3/10High risk

7.7 Upgrades: The protocol lacks a formal proxy pattern but allows for the replacement of critical external dependencies via the initialize function. 7.8 Operations: Operational security is entirely dependent on the protection of the private keys associated with the privileged roles.

Final RecommendationWhat to do about this score

Immediate remediation of uninitialized state variables and the implementation of a secure, verifiable source of randomness are required.

We recommend transitioning from centralized privileged roles to a multi-signature wallet or a decentralized governance contract to mitigate the risk of single-point-of-failure exploits.

Contract & Record

1 audit on record

TypeUN1Token

NetworkEthereum

Token age8h

Contract0x03ed…f512

Deployer0x722f…4043

Badge for your website

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History

Oct 21, 202684High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the UN1 contract address?

The Un1corn (UN1) contract on Ethereum is 0x03edbab5c3a0456567d61ab7f34f3b7e490ef512. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.