| Risk factor | Finding | Evidence | Date |
|---|---|---|---|
| Sellable | Yes — our sale went through; GoPlus reports a honeypot | ChainSift simulation | 29 Oct 2026 |
| Buy tax | 0% | ChainSift simulation | 29 Oct 2026 |
| Sell tax | 0% | ChainSift simulation | 29 Oct 2026 |
| Admin mint | Enabled | Implementation code | 29 Oct 2026 |
| Transfers pausable | Not found | Implementation code | 29 Oct 2026 |
| Address blacklist | Not found | Implementation code | 29 Oct 2026 |
| Upgradeable proxy | Yes — a single wallet can replace the code | Proxy contract | 29 Oct 2026 |
| Source verified | Yes | Block explorer | 29 Oct 2026 |
| Top-10 holders | 7% | Holder distribution | 29 Oct 2026 |
| Liquidity locked | No | LP holders | 29 Oct 2026 |
| Holders | 53762 | Token contract | 29 Oct 2026 |
| Deployed by | 0x199db7…2d48f3 |
| Code can be replaced by | 0xdf0b4e…65372c — a single wallet |
| Current code | 0x52b8b5…4ea911 |
| Holders | 53,762 |
| Rank | Address | Share |
|---|---|---|
| #1 | 0x1eddb3…bb437b | 2.22% |
| #2 | 0x838204…8fa724 | 1.68% |
| #3 · PancakeV2 · contract | 0x38c306…fabf77 | 0.59% |
| #4 | 0x29b67e…6d8d77 | 0.58% |
| #5 | 0xa68db9…8f871c | 0.50% |
This automated check reads X Token's contract mechanics on BNB Chain and found a mixed picture. One data source flagged the contract as a honeypot — meaning a contract that lets people buy in but blocks them from selling — but ChainSift's own simulation completed both a buy and a sale an hour later without issue, so it has not been scored as one here. That conflicting signal is worth sitting with rather than dismissing. Separately, the contract owner retains the ability to mint new tokens at will, which can dilute existing holders' share of supply. More significantly, the contract uses an upgradeable proxy, which means a single wallet can replace the underlying contract code at any time — including the mint function, the sell logic, and every other mechanic listed in this report. In practice, this means today's findings describe the contract as it stands now, not as it could be after a future code swap. On the positive side, the contract source is verified on the block explorer, meaning the published code can be read and checked, and the top 10 holders currently control 7% of supply, which is a relatively low concentration across 53,762 holders. Liquidity is not locked, so funds backing the ability to trade the token on a decentralised exchange could be withdrawn by whoever controls it.
It's worth being clear about what this check does not cover. It only reads what the contract code technically allows — it says nothing about who is behind the project, whether the team's plans match its stated goals, how tokens are allocated or vested, whether there's any legal entity standing behind the token, or what the people controlling the owner wallet and upgrade keys intend to do with those powers. A contract can be mechanically unremarkable and still be part of a project with poor fundamentals or bad actors behind it, and the reverse is also possible.
Before putting any money in, it would be worth looking into who holds the owner and proxy-admin wallets, and whether those keys sit with a multisig, a timelock, or a single individual — that materially changes how much trust is being placed in one party. Check whether the liquidity pool is locked elsewhere or held in a renounced/burned state despite what's shown here, review the project's own documentation and social channels for how they describe their own admin powers, and look at the holder list for any single large wallet beyond the top 10 that isn't obvious from the aggregate figure. Because minting and code-replacement powers exist here, any decision should account for the possibility that contract behaviour changes after today's check was run.
Contracts change after they are checked. Tell us where to reach you and we will say when this one does. Free for three contracts, no account.
We checked 18 points out of 100.
The other 82 are where money is usually lost: who the team is, where the tokens sit, what the documents actually say, and what the project chose not to put on its front page.