Evidence, with
the limits attached.

Token contract checks

Token checks are currently unavailable. Our provider is declining requests from this service. The rules below describe how a usable response would be interpreted; they do not mean live token data is available. What to check when data is unavailable →

The scanner queries GoPlus Security for the selected network and address. It displays eleven selected fields covering selling restrictions, contract visibility and controls, and reported buy/sell taxes. It does not run its own transaction simulation.

Only the documented string values “0” and “1” are accepted for binary fields. Missing or unexpected values are unknown. Tax fields must be numeric values between zero and one. Capability flags require context and do not, on their own, establish malicious intent.

How the labels are assigned

• High-risk signals reported: at least one selected indicator suggests a selling restriction, hidden control, balance modification, or a reported tax of 50% or more.
• Caution signals found: at least one other selected indicator is flagged, including a positive reported tax.
• Inconclusive: required selected fields are unknown without a stronger flagged finding, or the check is limited to URL patterns.
• No selected flags reported: all eleven selected token fields returned usable values and none met our flag rules. This does not rule out other risks.

These labels are our triage rules, not provider risk scores or a probability of loss. Unknown fields are still shown when other fields trigger a stronger label.

Website URL checks

Analysis runs in your browser. We look for a login-style prefix, brand-like hostname, internationalized encoding, HTTP, an IP address, selected shorteners, and deeply nested hostname labels. We do not visit the submitted URL or use a phishing database.

The brand-pattern rule currently references trezor.io, ledger.com, metamask.io, uniswap.org, revoke.cash, and etherscan.io. This is a small heuristic list, not a comprehensive directory or endorsement. A hostname match does not verify the page. False positives and false negatives are possible.

Freshness and availability

The report records when we retrieved or calculated its findings. A provider’s underlying observations may be older; we do not have a guaranteed age for every field. If the provider fails, we show an unavailable result instead of substituting a passing result. The beta shares a limit of ten token requests per minute.

Independence and corrections

Security findings are determined by the rules above. Buying a product or a future subscription cannot change a result. Educational pages use AI assistance and link to their sources. We do not claim independent audits or hands-on hardware testing. The current rules are intentionally narrow and may be revised as evidence improves.