FiatTokenV2_2
Scanned October 7, 2026 · Check a different contract →
FiatTokenV2_2
How the owner could rug you
None of the common owner-side rug mechanisms were found in the code. That is not a clean bill of health — see the limits below.
Code: No se encontró ninguna función pública o interna llamada mint, _mint, increaseSupply, etc., en el código visible.
Code: Se usa el modificador whenNotPaused en varias funciones, pero no se vio ninguna función pública que active o desactive la pausa.
Code: Existe la función interna _setBlacklistState y el modificador notBlacklisted, pero no se encontró una función pública que permita al propietario cambiar el estado de la lista negra.
Code: No se observó lógica de tarifas, impuestos o comisiones en el código disponible.
Code: Las funciones initializeV2, initializeV2_1 e initializeV2_2 y la variable interna _initializedVersion indican un patrón de contrato upgradable, pero no se vio ninguna función de upgrade en el código visible.
Code: No se encontró ninguna función pública que permita al propietario transferir ether o tokens del contrato a su propia cuenta.
Code: No se encontró una variable owner ni un modificador onlyOwner en el fragmento de código proporcionado.
This checks only what the code can do. It cannot see whether liquidity is locked, how concentrated holders are, or what the team intends — those need live on-chain data. Absence of these mechanisms is not proof a token is safe.
What this could cost you
How much money would you put into this? We'll show you what you could actually lose — in dollars, not just a scary word like "risk."
None of the common rug mechanisms were found, so there's nothing to calculate against here. That's not the same as "safe" — see the limits above.
This is a proxy contract. The findings below describe the implementation at 0x43506849d7c04f9138d1a2050bbf3a0c054402dd. The implementation can be swapped for different code by whoever controls the upgrade mechanism.
This contract's code is 36,135 characters (after removing comments and whitespace) — only the first 9,000 were analyzed, so parts of it were not examined. That's the real reason, not a vague size limit: 27,135 characters were cut off the end. The contract's own code was read first, so what was cut is mostly shared library code.
What the code allows
Evidence: Los modificadores whenNotPaused y notBlacklisted se aplican en funciones como transferWithAuthorization, permit y approve.
This allows: Permiten que el contrato bloquee transferencias cuando está pausado o cuando una cuenta está en la lista negra.
Evidence: Funciones initializeV2, initializeV2_1, initializeV2_2 y la variable _initializedVersion indican que el contrato está pensado para ser actualizado mediante un proxy.
This allows: Un contrato actualizable puede cambiar su lógica después del despliegue.
Evidence: El modificador whenNotPaused se usa en la mayoría de las funciones externas que mueven tokens.
This allows: Permite que el contrato detenga temporalmente todas las transferencias.
Evidence: No se detectó ninguna función de mint en el código visible.
This allows: La capacidad de crear tokens permite diluir a los tenedores.
Evidence: No se observó el modificador onlyOwner ni una variable owner en el fragmento disponible.
This allows: Los privilegios del propietario pueden usarse para cambiar reglas críticas.
Evidence: No se encontró lógica de cálculo o cobro de tarifas en el código disponible.
This allows: Las tarifas pueden ser usadas para confiscar parte de los tokens transferidos.
Evidence: No se encontró una variable owner ni funciones de renuncia en el fragmento proporcionado.
This allows: Si la propiedad no ha sido renunciada, el propietario mantiene sus poderes.
Worth reading yourself
- ›El estado de blacklist se almacena en el bit más alto del entero que representa el balance (balanceAndBlacklistStates), una técnica poco común.
- ›La función initializeV2_2 permite blacklistear una lista de cuentas y luego elimina su registro en _deprecatedBlacklisted.
What this did not check
- ›El código está truncado y no se revisó la totalidad del contrato; por lo tanto, muchos mecanismos podrían estar definidos fuera del fragmento visible.
- ›No se pudo determinar la existencia de funciones de pausa, blacklist pública, mint, withdraw o de control de propietario porque podrían estar en la parte faltante del código.
- ›Los análisis de liquidez bloqueada, concentración de tenedores y saldos reales en la cadena no se pueden inferir del código fuente y no fueron verificados.
Automated review of verified source only. Not an audit. Does not cover on-chain state, holder distribution, liquidity, or deployer behavior. It cannot tell you whether a token is safe or whether to buy it. Absence of a finding is not evidence that a contract is sound — it may mean the relevant code was not readable, not verified, or not reached.
Want more than the free read?
A real security researcher personally reads this contract's verified source — not an automated re-run of the free check.
What's checked
The same 7 owner-power categories as the free check — mint authority, ability to disable trading, blacklist power, mutable fees, upgradeability, privileged withdrawal, and whether ownership is still active — plus 4 categories the free tier doesn't cover: exact current fee values and where they're set, whether ownership itself can be transferred (and to whom), any hardcoded or owner-settable exceptions to fees/limits/blacklist, and external contracts this one calls out to and trusts.
How it's done
I read the contract's actual verified source directly — no token-window truncation, since a person isn't limited by an LLM's context size the way the free tier is. Every finding cites the specific function or modifier it comes from; if the code doesn't determine something, the report says so instead of guessing.
What you get
A written report emailed to you within 24 hours: a plain-English summary, every finding with its evidence, and what the review could not determine from source alone.
Disclaimer: this is a capability review of verified source code, not a formal security audit and not investment advice. It reports what the contract's owner/admin technically CAN do — it does not check on-chain state, liquidity depth, holder concentration, or deployer behavior, and it does not certify a contract as safe.
Building something that needs this programmatically?
By purchasing, you agree to our Terms of Service and Privacy Policy.
This report documents observable code capabilities only. It is not investment advice, a safety rating, or an endorsement of any kind. Capabilities listed as present do not indicate intent to misuse them. This analysis covers verified source code only — it does not assess on-chain state, liquidity, holder concentration, or deployer behavior.
nexustrinity.io · Report ID: NXT-2026-11-06-EB48 · 2026-11-06 14:42:43 UTC
This is a surface read
It reports capabilities visible in source. It does not model economics, test exploit paths, or reason about how contracts interact. A real review does — with runnable proofs for anything it claims.
Request a security review →Paid reviews go further than this free scan: every finding is signed, timestamped, and hash-chained into a record — self-scored 16/20 against an independent standard →