| Risk factor | Finding | Evidence | Date |
|---|---|---|---|
| Sellable | Yes | ChainSift simulation | 29 Oct 2026 |
| Buy tax | 0% | Contract | 29 Oct 2026 |
| Sell tax | 0% | Contract | 29 Oct 2026 |
| Admin mint | Not found | Implementation code | 29 Oct 2026 |
| Transfers pausable | Not found | Implementation code | 29 Oct 2026 |
| Address blacklist | Enabled | Implementation code | 29 Oct 2026 |
| Upgradeable proxy | Yes — a single wallet can replace the code | Proxy contract | 29 Oct 2026 |
| Source verified | Yes | Block explorer | 29 Oct 2026 |
| Top-10 holders | 90.2% | Holder distribution | 29 Oct 2026 |
| Liquidity locked | No | LP holders | 29 Oct 2026 |
| Holders | 585 | Token contract | 29 Oct 2026 |
| Deployed by | 0x38aaad…d0f3e0 |
| Code can be replaced by | 0x79dc64…ba75ab — a single wallet |
| Current code | 0xc68b50…5695c1 |
| Holders | 585 |
| Rank | Address | Share |
|---|---|---|
| #1 | 0x79dc64…ba75ab | 69.15% |
| #2 · Uniswap v4 pool · contract | 0x8366a3…e40951 | 16.20% |
| #3 | 0xcacf7d…b3532c | 1.11% |
| #4 | 0x3ebd20…201569 | 0.58% |
| #5 | 0x96df97…5197a0 | 0.57% |
This automated check found that PIZZA's contract includes a blacklist function, meaning the contract owner retains the ability to block specific wallet addresses from transferring or selling the token at any time. More significantly, the contract uses an upgradeable proxy pattern, which means a single wallet can replace the underlying contract code entirely — including removing or altering any of the mechanics described in this report, such as taxes, mint limits, or the blacklist itself. In practice, this means the rules governing this token today are not guaranteed to be the rules governing it tomorrow. On the positive side, no honeypot behaviour was detected in simulation (the token was sellable), no minting function was found in the implementation code, and buy/sell taxes were both read as 0% at the time of the check. However, top-10 wallets were found to hold 90.2% of the total supply, which is a high concentration, and the liquidity pool was not found to be locked, meaning it could be withdrawn by whoever controls it.
It's important to be clear about what this check does not cover. This is an automated read of the contract's mechanical code and on-chain data only — it has not been reviewed by a person, and it says nothing about who the team behind PIZZA is, whether their stated plans or roadmap are realistic, how the token's supply and incentives are structured economically, or whether any legal or regulatory obligations apply to it. A contract can pass every mechanical check here and still be associated with undisclosed risks that no code scan can detect, since intent and conduct aren't things a contract scanner can measure.
Before considering any transaction, it would be worth independently verifying who controls the upgrade and blacklist permissions — ideally through a multisig or timelock rather than a single wallet, since neither was indicated here. It's also worth checking whether the liquidity pool tokens are held by a known locking contract or sit in an individual wallet, and researching the holder list to understand whether the top-10 concentration reflects exchange wallets, team allocations, or unrelated individual holders. Looking into the project's public communications, any audits by named third parties, and the history of the deploying wallet on a block explorer would also add useful context that this mechanical check cannot provide on its own.
Contracts change after they are checked. Tell us where to reach you and we will say when this one does. Free for three contracts, no account.
We checked 18 points out of 100.
The other 82 are where money is usually lost: who the team is, where the tokens sit, what the documents actually say, and what the project chose not to put on its front page.