| Risk factor | Finding | Evidence | Date |
|---|---|---|---|
| Sellable | Yes | ChainSift simulation | 26 Oct 2026 |
| Buy tax | 0% | Contract | 26 Oct 2026 |
| Sell tax | 0% | Contract | 26 Oct 2026 |
| Admin mint | Not found | Implementation code | 26 Oct 2026 |
| Transfers pausable | Not found | Implementation code | 26 Oct 2026 |
| Address blacklist | Enabled | Implementation code | 26 Oct 2026 |
| Upgradeable proxy | Yes — a single wallet can replace the code | Proxy contract | 26 Oct 2026 |
| Source verified | Yes | Block explorer | 26 Oct 2026 |
| Liquidity locked | No | LP holders | 26 Oct 2026 |
| Deployed by | 0x1bd07d…8c4715 |
| Code can be replaced by | 0x4446e5…cee800 — a single wallet |
| Current code | 0xd5675e…166d30 |
This automated check scanned the contract code for Kimchi (Aura Final Boss) and found a few mechanics worth understanding before anything else. The contract includes a blacklist function, which means the address with owner privileges can block specific wallets from transferring or selling the token at any time. More significantly, this contract uses an upgradeable proxy, which means a single wallet has the power to swap out the underlying contract code entirely — including turning on new taxes, pausing transfers, minting new supply, or anything else, even if none of those behaviours are present today. In effect, the current code's good behaviour is not a permanent guarantee, because the rules can be changed later by whoever holds that upgrade key. Separately, the liquidity pool backing this token was not found to be locked, which means whoever controls that liquidity could withdraw it from the pool, directly affecting the ability to sell at a reasonable price. On the positive side, no honeypot behaviour was detected at the time of this check: the simulation found the token sellable, with buy and sell tax both at 0%, and no admin mint or transfer-pause function was found in the code that was reviewed.
It is important to be clear about what this check does not cover. This is an automated read of contract mechanics only — it looks at what the code technically allows, not who controls it, why, or what they intend to do with that control. It does not assess the team behind the project, their track record, the token's distribution or supply schedule, any legal structure, marketing claims, or community activity. A contract can show no risky flags and still be tied to an unreliable team, just as a contract with flags like these can be operated responsibly. No human has reviewed this project; the findings above come entirely from automated analysis of the contract's code.
Given the upgradeable proxy and unlocked liquidity, it would be reasonable to look into who holds the proxy's admin key and whether that wallet is a multisig, a timelock, or a single private key, since this materially changes how much control one party has. It is also worth checking the current liquidity pool balance and its largest holders directly on the block explorer, reviewing the token's holder distribution for concentration, and searching for any public information about the team or audit history outside of this contract-level check. None of this constitutes investment advice, and nothing here indicates that this token is safe or unsafe to hold.
Contracts change after they are checked. Tell us where to reach you and we will say when this one does. Free for three contracts, no account.
We checked 12 points out of 100.
The other 88 are where money is usually lost: who the team is, where the tokens sit, what the documents actually say, and what the project chose not to put on its front page.