This page explains exactly how a ChainSift Score is calculated, where the data comes from, what a machine does, what a human does, and where the method is weak. If any of it is unclear, write to [email protected].
Every project is analysed twice, independently — the site is collected again from scratch and scored again from scratch. If the two scores differ by more than five points out of a hundred, the report is not published at all.
Not published with a caveat. Not published with the average of the two. Not published. The page stays at its address and says the report was withheld, and why.
We do this because a risk score that changes when you run it twice is not a measurement — it is an opinion with a number attached. A reader has no way to tell the difference from the outside, so the check has to happen on our side, before anything is published.
The cost is visible and we would rather you see it: on our first fifteen reports, four did not survive this test and remain unpublished. Those four are not projects we are protecting or attacking. They are projects we could not measure twice and get the same answer, which means we have nothing trustworthy to say about them yet.
A ChainSift Score is a number from 0 to 100. It is the sum of five categories worth 20 points each.
A score is not a verdict. It is a summary of how many risk signals we found and how serious they are. Every point is traceable to a specific finding, with a source and a date.
When we cannot check something, we do not score it. There is a difference between "the project does not publish this" and "we could not retrieve it", and only the first is a finding about the project. If a page times out, blocks us, or fails to render on our side, the affected sub-signal is excluded from the score and from the maximum — so a score may read 79 out of 96 rather than out of 100. The gaps are listed on the report in plain language.
This rule exists because we broke it. On 19 August 2026 our collector did not execute JavaScript, read several live pages as empty, and we published reports stating that documents were missing when they were not. Those reports were withdrawn the same day, the collector now renders pages in a real browser, and a failure to collect can no longer cost a project points.
| Signal | Points |
|---|---|
| Identities verifiable and consistent across sources | 0–8 |
| Verifiable track record in previous work | 0–6 |
| Public presence and responsiveness | 0–6 |
An anonymous team is not automatically a fail. Many legitimate crypto projects are pseudonymous — so are we. What costs points is unverifiable claims: names and photographs that lead nowhere, or a history that cannot be confirmed.
| Signal | Points |
|---|---|
| Supply and emission clearly documented | 0–5 |
| Holder concentration | 0–6 |
| Unlock and vesting schedule disclosed | 0–5 |
| Token has a stated function beyond speculation | 0–4 |
| Signal | Points |
|---|---|
| Contract source verified on the block explorer | 0–4 |
| Independent security audit exists and is published | 0–5 |
| Repository activity consistent with claims | 0–6 |
| Product stage matches what is being promised | 0–5 |
| Signal | Points |
|---|---|
| Contract mechanics: honeypot, mint, pause, blacklist, transfer tax | 0–8 |
| Copied documentation or website content | 0–4 |
| Claims that cannot be true as stated | 0–4 |
| Signals of manufactured social activity | 0–4 |
| Signal | Points |
|---|---|
| Operating entity disclosed | 0–6 |
| Jurisdiction identified | 0–4 |
| Terms of service and privacy policy present and specific | 0–4 |
| Regulatory posture consistent with what is being offered | 0–6 |
The arithmetic is not left to a language model. The model scores each signal; our code sums the signals into a category, sums the categories into the score, and derives the risk level from it. A model that miscounts cannot inflate a score, because it never gets to decide the total.
We do not run our own blockchain infrastructure. We orchestrate public sources and add interpretation on top. This list is what we use today, not what we intend to use:
Where the two sources disagree, the chain wins. Three sub-signals — contract mechanics, holder concentration and source verification — are calculated directly from contract data, not inferred from the project's text. If a site says "liquidity locked forever" and the chain says otherwise, the score reflects the chain, and the report prints both.
This requires a contract address. Supply one with your order, or we will try to find it on the project's site. If no contract can be identified, the report says so in plain language and those three signals are assessed from published material only — a materially weaker report, and you should know when you are reading one.
Where a source disagrees with another, we say so on the report rather than silently picking one.
Every contract page on this site — /check/{chain}/{address} — shows an
On-chain Check. It is free, needs no account, and it is not the
ChainSift Score. It is worth 18 of the Score's 100 points, and this section explains what
those 18 points are and what they are not.
It is a purely mechanical read of the contract: which functions exist, whether a simulated transfer goes through, and what the code permits the owner or deployer to do. No human reads anything, no language model decides anything. Three sub-signals are counted — contract mechanics (8 points), holder concentration (6) and source verification (4).
Where the holder distribution is not available from the source, that sub-signal is not scored as zero. It is excluded, and the maximum drops to 12 — scoring a missing answer as a bad answer would punish the token for the silence of an API.
What the On-chain Check does not cover. Who the team is and whether their claims hold up, how the token is distributed and unlocked, and whether a legal entity exists behind the project — none of that is assessed. Those three categories are the other 82 points, and they need a written report.
A clean contract run by people who never intended to deliver is the most common way money is lost, and no automated check catches it. A high On-chain Check is not a recommendation and a low one is not an accusation; both are a count of mechanical facts on the date they were read.
The result is cached for 24 hours. Contract mechanics change rarely, and re-reading the same contract on every visit would spend an external quota without changing an answer. When a check does return a different result, the page keeps the previous score and the date it changed, so a change is visible rather than silently overwritten.
Automated, in seconds: contract mechanics, holder concentration, contract verification status, and the presence or absence of documents. These are read from the chain and scored by fixed rules — no language model is involved in deciding them, so they are reproducible: the same contract state always yields the same points.
Language model assisted: reading documentation, comparing claims against observable facts, detecting copied text, summarising findings. A language model is good at reading a lot quickly and bad at being certain. Everything it produces is attached to a source you can open yourself — and, as noted above, it does not control the arithmetic.
Human reviewed: only in reports marked human-verified. In those, a person checks each finding against its source before publication. Automatic reports are labelled as automatic. We do not blur the difference.
A score is a photograph, not a promise. A project that scores 78 today can score 40 next week if the owner enables minting or liquidity unlocks.
The history is the point. A single number is easy to produce; a year of dated observations is not.
Every report we produce is published on this site, free of charge, as soon as it is ready. There is no embargo period and no paid early access. The person who requested a report is never identified.
We would rather state these than have you discover them:
Not a security audit. Not investment advice. Not a guarantee. A high score means fewer risk signals were found on the date shown — nothing more.