PoolManager
Scanned September 15, 2026 · Check a different contract →
PoolManager
How the owner could rug you
None of the common owner-side rug mechanisms were found in the code. That is not a clean bill of health — see the limits below.
Code: No mint function found in the visible portion of PoolManager.sol; mint capability could be present in inherited contracts (e.g., ERC6909Claims) that are not shown
Code: The contract does not contain a pausable flag, transfer gate, or any function that can globally block transfers in the visible code; such logic might exist in inherited contracts
Code: No blacklist mapping or function restricting specific addresses appears in the visible code; could be implemented elsewhere
Code: Fees are read from key.fee.getInitialLPFee() during initialization, but no function to modify fees after deployment is visible; fee‑changing logic might reside in inherited contracts
Code: No proxy pattern or admin‑only upgrade function is present in the shown code; upgradeability could be introduced in a parent contract or in the omitted tail
Code: No withdraw or sweep function appears in the visible snippet; such capability might be defined in inherited contracts (e.g., ProtocolFees)
Code: Constructor stores an initialOwner via ProtocolFees(initialOwner) but no onlyOwner modifiers are visible; ownership powers may be defined in ProtocolFees or elsewhere
This checks only what the code can do. It cannot see whether liquidity is locked, how concentrated holders are, or what the team intends — those need live on-chain data. Absence of these mechanisms is not proof a token is safe.
What this could cost you
How much money would you put into this? We'll show you what you could actually lose — in dollars, not just a scary word like "risk."
None of the common rug mechanisms were found, so there's nothing to calculate against here. That's not the same as "safe" — see the limits above.
This contract's source is 208,619 characters — only the first 9,000 were analyzed, so parts of it were not examined. That's the real reason, not a vague size limit: 199,619 characters were cut off the end.
What the code allows
Evidence: No mint function in the visible portion; minting could be provided by inherited contracts
This allows: Ability to increase total token supply, leading to dilution
Evidence: Constructor sets an initialOwner but no explicit onlyOwner checks are visible; privileges may be in ProtocolFees or other inherited contracts
This allows: Owner may control critical functions such as fee settings or withdrawals
Evidence: No pausable flag, blacklist, or transfer gate is present in the shown code
This allows: Restrictions could be used to block users from moving tokens
Evidence: Fees are derived from key.fee during pool initialization; no mutable fee function is visible
This allows: Changing fees can affect the economics of trades and potentially extract value
Evidence: No proxy pattern or upgrade function appears in the visible snippet
This allows: Upgradeability allows future changes to contract logic, including malicious ones
Evidence: OnlyWhenUnlocked modifier checks a global Lock, but no function to toggle the lock is shown
This allows: Ability to pause contract operations can freeze user activity
Evidence: Initial owner is set in constructor; no renounceOwnership call is visible
This allows: If ownership is not renounced, the owner may still exercise privileged powers
Worth reading yourself
- ›modifier onlyWhenUnlocked() { if (!Lock.isUnlocked()) ManagerLocked.selector.revertWith(); _; }
- ›constructor(address initialOwner) ProtocolFees(initialOwner) {}
- ›extensive ASCII art comment at the top of the file
What this did not check
- ›Source code was truncated at 9000 characters; analysis is limited to the visible portion of PoolManager.sol and does not include inherited contracts (ProtocolFees, ERC6909Claims, etc.). Therefore any mechanisms defined outside the shown snippet could not be assessed. Liquidity lock status, holder concentration, and actual on‑chain balances are NOT visible in source and were not checked.
Automated review of verified source only. Not an audit. Does not cover on-chain state, holder distribution, liquidity, or deployer behavior. It cannot tell you whether a token is safe or whether to buy it. Absence of a finding is not evidence that a contract is sound — it may mean the relevant code was not readable, not verified, or not reached.
Want more than the free read?
A real security researcher personally reads this contract's verified source — not an automated re-run of the free check.
What's checked
The same 7 owner-power categories as the free check — mint authority, ability to disable trading, blacklist power, mutable fees, upgradeability, privileged withdrawal, and whether ownership is still active — plus 4 categories the free tier doesn't cover: exact current fee values and where they're set, whether ownership itself can be transferred (and to whom), any hardcoded or owner-settable exceptions to fees/limits/blacklist, and external contracts this one calls out to and trusts.
How it's done
I read the contract's actual verified source directly — no token-window truncation, since a person isn't limited by an LLM's context size the way the free tier is. Every finding cites the specific function or modifier it comes from; if the code doesn't determine something, the report says so instead of guessing.
What you get
A written report emailed to you within 24 hours: a plain-English summary, every finding with its evidence, and what the review could not determine from source alone.
Disclaimer: this is a capability review of verified source code, not a formal security audit and not investment advice. It reports what the contract's owner/admin technically CAN do — it does not check on-chain state, liquidity depth, holder concentration, or deployer behavior, and it does not certify a contract as safe.
Building something that needs this programmatically?
By purchasing, you agree to our Terms of Service and Privacy Policy.
This is a surface read
It reports capabilities visible in source. It does not model economics, test exploit paths, or reason about how contracts interact. A real review does — with runnable proofs for anything it claims.
Request a security review →Paid reviews go further than this free scan: every finding is signed, timestamped, and hash-chained into a record — self-scored 16/20 against an independent standard →