TetherToken
Scanned October 31, 2026 · Check a different contract →
TetherToken
How the owner could rug you
6 owner powers found that could be used against holders. Each is a capability the code grants — not proof of intent.
Owner can increase total supply and allocate newly minted tokens to themselves, diluting all other holders.
Code: function issue(uint amount) public onlyOwner
Owner can halt trading at any time, preventing holders from moving or selling their tokens.
Code: function pause() onlyOwner whenNotPaused public; modifier whenNotPaused used in transfer and transferFrom
Owner can block specific accounts from sending/receiving and can burn their balances.
Code: function addBlackList(address _evilUser) public onlyOwner; require(!isBlackListed[msg.sender]) in transfer; function destroyBlackFunds(address _blackListedUser) public onlyOwner
Owner can raise the fee taken on each transfer up to the capped limits, diverting a portion of every transaction to themselves.
Code: function setParams(uint newBasisPoints, uint newMaxFee) public onlyOwner with require(newBasisPoints < 20) and require(newMaxFee < 50)
Owner can switch the token logic to a new contract that could alter balances, fees, or seize tokens.
Code: function deprecate(address _upgradedAddress) public onlyOwner sets deprecated=true and upgradedAddress; transfer functions forward to UpgradedStandardToken when deprecated
Owner continues to hold all administrative abilities such as minting, pausing, blacklisting, fee changes, and upgrading.
Code: owner variable in Ownable; onlyOwner modifier used throughout; transferOwnership can change but not renounce ownership by default
This checks only what the code can do. It cannot see whether liquidity is locked, how concentrated holders are, or what the team intends — those need live on-chain data. Absence of these mechanisms is not proof a token is safe.
What this could cost you
How much money would you put into this? We'll show you what you could actually lose — in dollars, not just a scary word like "risk."
Enter an amount above to see it in real dollars instead of just labels.
What the code allows
Evidence: function issue(uint amount) public onlyOwner mints new tokens
This allows: Allows the owner to create additional supply after deployment.
Evidence: onlyOwner used on pause, unpause, addBlackList, removeBlackList, destroyBlackFunds, setParams, deprecate, issue, redeem, transferOwnership
This allows: Owner can control trading, fees, blacklisting, upgrades, and token supply.
Evidence: whenNotPaused modifier on transfer/transferFrom; require(!isBlackListed[msg.sender]) checks
This allows: Transfers can be halted globally or for specific addresses.
Evidence: fee calculation in BasicToken.transfer and StandardToken.transferFrom using basisPointsRate and maximumFee
This allows: A portion of each transfer is sent to the owner.
Evidence: function deprecate(address) public onlyOwner sets deprecated flag and upgradedAddress; subsequent calls delegate to UpgradedStandardToken
This allows: Owner can replace the token logic after deployment.
Evidence: contract Pausable with pause() and unpause() functions restricted to onlyOwner
This allows: Owner can stop all token activity temporarily.
Evidence: owner is set in Ownable constructor and can be transferred but never renounced in the code
This allows: Privileged powers remain with a controllable address.
Worth reading yourself
- ›setParams caps fees: newBasisPoints < 20 (0.2%) and newMaxFee < 50 tokens
- ›deprecate function enables upgrade to UpgradedStandardToken
- ›destroyBlackFunds allows burning of blacklisted users' balances
What this did not check
- ›Liquidity lock status, holder concentration, and actual on‑chain balances are NOT visible in source and were not checked.
Automated review of verified source only. Not an audit. Does not cover on-chain state, holder distribution, liquidity, or deployer behavior. It cannot tell you whether a token is safe or whether to buy it. Absence of a finding is not evidence that a contract is sound — it may mean the relevant code was not readable, not verified, or not reached.
Want more than the free read?
A real security researcher personally reads this contract's verified source — not an automated re-run of the free check.
What's checked
The same 7 owner-power categories as the free check — mint authority, ability to disable trading, blacklist power, mutable fees, upgradeability, privileged withdrawal, and whether ownership is still active — plus 4 categories the free tier doesn't cover: exact current fee values and where they're set, whether ownership itself can be transferred (and to whom), any hardcoded or owner-settable exceptions to fees/limits/blacklist, and external contracts this one calls out to and trusts.
How it's done
I read the contract's actual verified source directly — no token-window truncation, since a person isn't limited by an LLM's context size the way the free tier is. Every finding cites the specific function or modifier it comes from; if the code doesn't determine something, the report says so instead of guessing.
What you get
A written report emailed to you within 24 hours: a plain-English summary, every finding with its evidence, and what the review could not determine from source alone.
Disclaimer: this is a capability review of verified source code, not a formal security audit and not investment advice. It reports what the contract's owner/admin technically CAN do — it does not check on-chain state, liquidity depth, holder concentration, or deployer behavior, and it does not certify a contract as safe.
Building something that needs this programmatically?
By purchasing, you agree to our Terms of Service and Privacy Policy.
This report documents observable code capabilities only. It is not investment advice, a safety rating, or an endorsement of any kind. Capabilities listed as present do not indicate intent to misuse them. This analysis covers verified source code only — it does not assess on-chain state, liquidity, holder concentration, or deployer behavior.
nexustrinity.io · Report ID: NXT-2026-11-06-1EC7 · 2026-11-06 14:42:43 UTC
This is a surface read
It reports capabilities visible in source. It does not model economics, test exploit paths, or reason about how contracts interact. A real review does — with runnable proofs for anything it claims.
Request a security review →Paid reviews go further than this free scan: every finding is signed, timestamped, and hash-chained into a record — self-scored 16/20 against an independent standard →