The smart contract security audit market is broken. Manual audits cost $5,000 to $150,000 and take weeks. Meanwhile, thousands of new tokens launch every single day – and the vast majority of retail investors check exactly nothing before they buy. Five weeks ago, ChainAware published the first Token Audit study: 127 automated security checks run against the top 10,000 tokens on CoinGecko by market capitalization. The results were alarming – 55.2% high risk, 131 confirmed honeypots, 13.2% upgradeable proxy contracts. Read the original study: Token Audit Launched – 10,000 CoinGecko Tokens.

Two weeks after that article published, CoinGecko’s tracked token count dropped from roughly 10,000 to about 8,845. We do not know whether our findings played any role in that cleanup – correlation is not causation, and CoinGecko does not publish the reasoning behind individual delistings. What we do know is that relying on a single data provider’s market-cap ranking leaves a study vulnerable to exactly this kind of shift. So this time, we did not rely on one provider.

This is the expanded study: every EVM-based token listed on CoinGecko combined with every EVM-based token listed on CoinMarketCap, deduplicated into a single joint set. The result is 15,008 individual contract audits – larger than the original study, built from two independent sources instead of one, and run across all seven chains Token Audit supports. We also expanded liquidity lock detection significantly since the last study, added near-complete proxy contract classification, and this article explains exactly what changed and why it matters – both for the numbers that moved and the ones that stayed remarkably consistent.

The Study: 15,008 Audits, Two Data Sources, Seven Chains

The dataset combines every EVM-compatible token listed on CoinGecko with every EVM-compatible token listed on CoinMarketCap as of August 2026, deduplicated into a joint set. Because the same token frequently exists on multiple chains simultaneously – and because CoinGecko and CoinMarketCap each track tokens the other does not – the combined approach produces meaningfully broader coverage than either source alone. The total reaches 15,008 individual contract audits across seven chains. As before, each deployment receives an independent audit: the same token contract on Ethereum and BSC gets two separate results, because liquidity structure, ownership configuration, and even contract bytecode can differ between deployments.

Each audit runs 127 checks across 11 modules (8 currently active, 3 coming soon), including Ownership, Supply, Liquidity, Transfer, Approve, Permit, Pausability, Reentrancy, and Proxy Analysis. Three detection layers underpin every audit: deep code analysis for semantic, code-level findings that trace execution paths rather than matching surface patterns; direct on-chain RPC calls for live state verification; and ChainAware’s behavioral database for creator and LP trust scoring, drawing on the same infrastructure covered in What Are Web3 Personas.

Chain Distribution

Ethereum still leads by audit count, but BSC’s share grew from 26.7% in the original study to 28.4% here – a byproduct of pulling from CoinMarketCap in addition to CoinGecko, which surfaces a wider tail of BSC-native tokens that market-cap-only rankings tend to exclude. Avalanche appears for the first time in a Token Audit study dataset; it was not yet supported when the original 10,000-token study ran. For background on why BSC consistently produces the riskiest token population, see Best Web3 Rug Pull Detection Tools 2026.

The Headline Results: 57.7% High Risk

Among the combined CoinGecko and CoinMarketCap EVM token universe, 57.7% receive a HIGH RISK verdict from ChainAware Token Audit – up from 55.2% in the original top-10,000-only study. For the full criteria behind each verdict tier, see the Token Audit Verdict Methodology.

Only 16.3% of audited tokens receive a CLEAN verdict, down slightly from 18.7% in the original study. This is the expected direction of movement: broadening the dataset beyond a strict top-10,000-by-market-cap cutoff pulls in more of the long tail, and the long tail skews riskier. It is a useful cross-check on the original finding rather than a contradiction of it – a wider net catches more risk, not less, which is consistent with market cap rank offering some (limited) protective signal while still leaving the majority of tokens exposed.

156 confirmed honeypots appear in this dataset, up from 131. Sixty-six of those honeypots were found on Ethereum – more than any other chain, and a reminder that the assumption “top-ranked = safe” does not hold even on the chain most associated with institutional-quality deployments. This finding is consistent with the wider pattern documented in Chainalysis’s Crypto Scam Revenue research, which tracks scam sophistication rising even as detection tools improve.

Results by Chain: BSC Remains the Most Dangerous

BSC’s position is unchanged from the original study – still the worst-performing chain in the dataset, with only 7.5% clean and 67.4% high risk. Combined with suspicious findings, 91.6% of BSC tokens in this expanded dataset carry some meaningful security concern. This tracks with Chainalysis research identifying BSC as hosting roughly 71% of rug pull scams globally, driven by transaction fees low enough to make fraudulent deployment nearly free. For weekly-updated BSC rug pull statistics, see the ChainAware Rug Pull Tracker.

Avalanche debuts as the cleanest chain in this study at 29.9% clean – ahead of Base’s 22.1%, which held the top spot in the original study. With only 231 audits, the Avalanche sample is the smallest in the dataset, so this ranking should be read with appropriate caution until the sample grows.

What’s New Since the Last Study: Liquidity Lock Detection, Rebuilt

The most significant methodology change since the original study is not a new check – it is a substantial expansion of an existing one. LP lock detection in the original study covered Uniswap V2-style pools on Ethereum and BSC only, and it was conservative by necessity: where the system could not confirm lock status with confidence, those tokens were excluded from the unlocked-LP finding entirely rather than risk a false positive.

That constraint is gone. LP lock detection now covers both V2 (ERC-20 LP token) and V3 (NFT position) pool structures, across six chains – Ethereum, BSC, Base, Polygon, Arbitrum, and Avalanche – and across the major DEX families on each: Uniswap, PancakeSwap, QuickSwap, SushiSwap, and Trader Joe. Recognized locker contracts (PinkLock, UniCrypt, Team Finance, and chain-specific lockers) are checked directly, alongside burn-address and permanent-lock detection.

The practical result is that far more tokens now receive a definitive locked-or-unlocked determination instead of being excluded from the check. That is the primary reason the unlocked-LP percentage in this study (49.5%) is substantially higher than in the original (25.7%) – broader, more confident detection surfaces cases the earlier, more conservative version could not classify. It reflects better measurement, not a sudden deterioration in token quality.

Optimism is not included in liquidity lock detection – Token Audit has not built locker registry support for Optimism’s DEX ecosystem, so lock status is not evaluated there. Avalanche is included in the check, but the study found zero confirmed locks on Avalanche tokens to date, which is a finding in itself worth noting alongside the chain’s otherwise-clean profile on other checks.

A related product change: liquidity lock status is no longer a static, cached figure. Anyone can now trigger a real-time recalculation on any token through the free Token Audit tool – the check re-verifies current lock status directly against on-chain state, typically completing in 20 seconds to 5 minutes depending on how many pools the token has. This matters because lock status is not static in practice: locks expire, new pools get created, and liquidity moves. A cached “locked” verdict from a week ago is not the same claim as a verdict confirmed right now.

Liquidity Findings

Liquidity remains the single largest driver of risk verdicts in the dataset, and by a wider margin than before: the Liquidity module now drives 46.8% of all verdicts, up from 42.0% in the original study – a direct consequence of the expanded lock detection surfacing more definitive findings rather than leaving them unclassified.

What Drives the Risk: Mint Cap and Timelock, Still Dominant

The same two findings that drove most high-risk verdicts in the original study remain the two largest sources of risk here – at almost identical rates, which is a useful consistency check across an independently-sourced, 15% larger dataset.

No Mint Cap (INV_S2_NO_MINT_CAP): 35.3%

5,305 tokens – 35.3% of the dataset – have a mint function with no enforceable supply cap, nearly unchanged from 35.9% in the original study. The separation from CLEAN verdicts remains perfect: zero CLEAN tokens carry NO_MINT_CAP in this dataset, exactly as in the original. Every CLEAN token either lacks a mint function entirely or has one with an immutable, verifiable on-chain cap. Of the 5,305 flagged tokens, 5,051 land in HIGH RISK and 89 in HONEYPOT, with only 165 in SUSPICIOUS.

No Timelock (INV_O6_NO_TIMELOCK): 35.8%

5,373 tokens – 35.8% – have privileged administrative functions with no timelock protection, close to the original study’s 34.4%. Without a timelock, a single transaction from a compromised or malicious admin key can drain a protocol or convert a functioning token into a honeypot with no warning to holders. According to the OWASP Smart Contract Top 10, privileged-function abuse remains one of the most exploited categories in production DeFi contracts.

Together, these two findings continue to drive the overwhelming majority of high-risk verdicts. Liquidity and Supply modules combined now account for 77.4% of all primary-signal verdicts, up from 76% in the original study. Both findings remain invisible to honeypot-simulation-only tools; for how ChainAware’s approach differs structurally, see Web3 Wallet Auditing Providers in 2026.

Proxy Analysis: 34.9% of Tokens Are Upgradeable Contracts

This is the largest directional change from the original study, and it deserves a direct explanation rather than a footnote. The original study found 13.2% of tokens used proxy contracts. This study finds 34.9% – 5,235 of 15,008 tokens. That increase is real, but it is not a claim that upgradeable proxies have become dramatically more common among EVM tokens in five weeks. It reflects a detection fix: earlier proxy classification only ran through a separate backfill process and left the majority of audited tokens without any recorded proxy status at all. That gap has since been closed, so this study’s proxy figure reflects near-complete coverage (99.9% of tokens have a determination either way) rather than the partial coverage the original number was built on. The original 13.2% likely understated true proxy prevalence; 34.9% is the more reliable figure going forward.

118 tokens are upgradeable by a single private key with no multisig, no governance vote, and no timelock delay – one transaction from one address can replace the entire contract implementation. That figure is lower in absolute terms than the original study’s 139, despite the much larger overall proxy count, because near-complete detection this time correctly sorts most proxies into contract-controlled or unknown-authority tiers rather than defaulting ambiguous cases into the highest-risk bucket. The EIP-2612 permit and proxy upgrade patterns referenced here follow the same specification tracked in EIP-2612.

Honeypot Signals: What Predicts a Confirmed Honeypot

156 confirmed honeypots appear in this dataset – contracts where Token Audit’s simulation module confirmed a buy transaction succeeds but a sell reverts, using the same forked-blockchain simulation methodology detailed in the Simulation Module documentation. The strongest predictive signals are consistent with the original study, with custom transfer entry points remaining the top predictor:

Custom transfer entry points and layered transfer delegation remain the two most reliable predictors, matching the original study’s finding that professional honeypot developers route sell-blocking logic through non-standard function paths specifically to evade rule-based scanners that only inspect the standard _transfer implementation. This class of vulnerability is documented more broadly in the Smart Contract Weakness Classification Registry.

Pausability and Supply: The Smaller but Sharper Findings

718 tokens (4.8%) allow minting to continue while the token is paused for everyone else – an admin can freeze investor transfers while continuing to dilute their own holdings, functionally trapping and diluting holders at once. 30 tokens in this dataset are actively paused right now. One token exhibits the asymmetric pause pattern that blocks sells while permitting buys – the same pattern that causes Honeypot.is to return a false CLEAN, because it tests sells using the function that remains open in that scenario.

On the supply side, 980 tokens (6.5%) show hidden mint functions that inflate supply through mechanisms not labeled mint() – invisible to any scanner that only checks function names rather than tracing every path that modifies totalSupply(). 330 tokens show fake burns: transfers to the zero address that do not actually reduce reported total supply, meaning apparent scarcity from burn history may not be real. For platform-level compliance implications of supply and mint integrity, see DeFi Compliance Tools Comparison 2026.

Risk Score Distribution and Audit Coverage

97.3% of tokens in this dataset have verified source code, consistent with the original study’s 98.4%. For unverified contracts, Token Audit’s Liquidity, Simulation, and Behavioral Trust Score modules continue to operate on bytecode and on-chain state rather than source, so a lack of verification does not mean a lack of coverage.

Two Studies, One Consistent Picture

*Original-study LP unlock and proxy figures were measured under narrower detection coverage than this study’s; see the sections above for what changed and why the two numbers are not directly comparable as an apples-to-apples trend.

The headline verdict distribution held steady within a few points across two independently-sourced datasets five weeks apart – that consistency is itself a meaningful validation of the original findings. The market cap ranking did not meaningfully change the risk picture; broadening past it if anything made things look slightly worse, which is the expected direction.

Implications for Investors, Platforms, and Builders

For Individual Investors

The core finding holds across both studies and a larger, more independent dataset: whether a token appears on a market-cap leaderboard is not a security signal. Before committing capital to any token, check whether the LP is locked – and check it in real time, not from a cached figure – whether the mint function has an enforceable cap, and whether the contract is upgradeable by a single EOA. ChainAware Token Audit checks all three, plus 124 other things, free, in under 60 seconds.

For DeFi Platforms and DEX Aggregators

The expanded proxy detection and real-time liquidity lock recalculation are both available through the same REST API and MCP integration used for the original Token Audit launch. Platforms embedding Token Audit at the listing or interaction point now get more complete proxy classification and on-demand lock verification rather than a cached snapshot. For AI agents specifically, see The Web3 Agentic Economy for how automated due diligence fits into agent-driven trading workflows.

For Token Builders

Running Token Audit against a deployed contract costs nothing and takes under a minute. It surfaces the same findings investors, security researchers, and automated tools will eventually find – with enough detail to fix them before that happens. Builders working in the ERC-8004 agentic commerce space should also see Agent Trust Score, ChainAware’s parallel trust-scoring system for on-chain AI agents.

Frequently Asked Questions

Why does this study use CoinGecko and CoinMarketCap combined instead of just CoinGecko?

The original Token Audit study used CoinGecko’s top 10,000 tokens by market cap. Two weeks after publication, CoinGecko’s tracked token count dropped to roughly 8,845 – we cannot confirm whether the original study contributed to that cleanup, but it illustrated the risk of depending on a single provider’s list. Combining CoinGecko and CoinMarketCap into one deduplicated EVM token set produces broader, more resilient coverage than either source alone.

Why did the unlocked-LP percentage nearly double?

Liquidity lock detection expanded from V2-only, two-chain coverage to V2 and V3 across six chains and five major DEX families. The original study excluded tokens it could not confidently classify; this study classifies nearly all of them. The increase reflects more complete measurement, not a sudden change in token quality.

Why did the proxy contract percentage increase from 13.2% to 34.9%?

A gap in the original detection pipeline left most audited tokens without a recorded proxy classification. That gap is now closed, so this study’s 34.9% reflects near-complete coverage rather than a real-world increase in proxy usage.

Can I check a token’s liquidity lock status in real time?

Yes. The free Token Audit tool now supports on-demand liquidity lock recalculation – it re-verifies current lock status directly against on-chain state across V2 and V3 pools on Uniswap, PancakeSwap, QuickSwap, SushiSwap, and Trader Joe, typically completing in 20 seconds to 5 minutes depending on how many pools the token has.

Which chains does Token Audit cover, and are all checks available everywhere?

Token Audit covers seven chains: Ethereum, BNB Smart Chain, Base, Polygon, Arbitrum, Optimism, and Avalanche. All 127 checks run on all seven. Liquidity lock detection is the one exception: it covers six chains and does not currently support Optimism, where locker registry support has not been built.

How is this different from GoPlus, TokenSniffer, or Honeypot.is?

Those tools primarily check honeypot simulation and basic mint capability. ChainAware runs 127 checks including timelock absence, approve() call graph analysis, transfer conservation invariants, permit() correctness, and reentrancy detection – none of which competing scanners currently offer. See the full comparison in the original Token Audit Launched study.

Sources: Chainalysis Crypto Scam Revenue · Chainalysis Crypto Crime Report · OWASP Smart Contract Top 10 · Smart Contract Weakness Classification Registry · EIP-2612: Permit Extension for ERC-20

Related ChainAware Reading: Token Audit Launched: 10,000 CoinGecko Tokens · Best Rug Pull Detection Tools 2026 · Rug Pull Tracker Report · Web3 Wallet Auditing Providers in 2026 · DeFi Compliance Tools Comparison · KYT and AML Guide for DeFi · What Are Web3 Personas · Prediction MCP for AI Agents · The Web3 Agentic Economy · Agent Trust Score: On-Chain Trust Scoring for ERC-8004

The post Token Audit at Scale: 15,000 EVM Tokens Across CoinGecko + CoinMarketCap (2026) first appeared on ChainAware.ai.

55.2% of the top 10,000 tokens are HIGH RISK. 131 are confirmed honeypots – tokens where you can buy but cannot sell. 1,865 are upgradeable proxy contracts, of which 139 are controlled by a single private key that can silently replace the entire token implementation in one transaction. Only 18.7% pass all 127 security checks and receive a CLEAN verdict.

What Token Audit Found

BNB Smart Chain is the most dangerous chain in the dataset: 68.3% high risk and only 7.6% clean. Ethereum shows 59 confirmed honeypots – tokens that passed as legitimate long enough to enter the CoinGecko top 10,000, then trapped every buyer inside. The two most widespread risk patterns: 35.9% of tokens have no enforceable supply cap (unlimited inflation possible), and 34.4% have no timelock on privileged admin functions (instant malicious governance possible, no delay, no warning).

What Other Tools Miss

Token Audit runs 127 checks across 11 modules (8 currently active, 3 coming soon), including Ownership, Supply, Liquidity, Transfer, Approve, Permit, Pausability, Reentrancy, and Proxy Analysis. The checks that matter most are the ones competitors cannot run: transitive approve() call graph analysis, phantom balanceOf detection, EIP-2612 permit preload, reentrancy invariants, and asymmetric pause detection (pause that blocks sells but not buys). These threats are invisible to GoPlus, CertiK Skynet Token Scan, TokenSniffer, and Honeypot.is – which together cover fewer than 40 checks, all at the interface level. The 599 verdicts in this dataset driven by Approve and Reentrancy findings represent tokens that every competing tool would have passed as clean. This same deployer-behavioral approach powers ChainAware’s token launch auditor agent, which combines contract risk with deployer wallet screening in a single call.

Co-Founder Statement

“We assumed the top 10,000 by market cap would be the safer end of the market. What we found is that more than half carry meaningful risk vectors – and roughly 600 of those are threats that no other automated tool would detect. The sophisticated operators know exactly which checks existing tools run, and they design around them. Token Audit was built to catch what they build.” – Martin Ploom, Co-Founder, ChainAware.ai

Proxy Risk: 139 Tokens One Transaction Away From a Honeypot

Token Audit’s proxy classification goes beyond detecting whether a contract is upgradeable. It identifies who controls the upgrade – and the answer matters enormously. Of 1,865 proxy contracts in the top 10,000, 139 are EOA-controlled: a single unprotected private key can replace the entire implementation in one block, with no timelock, no multisig, no governance vote. BSC carries the highest concentration – 75 of those 139 EOA-controlled proxies are on BSC, where the tactic is a known professional rug pull pattern. On the positive side, 153 UUPS proxies have permanently locked or renounced their upgrade path – Token Audit surfaces this as an explicit positive signal rather than treating all proxies as equally risky. This deployer-level behavioral scoring is the same methodology behind ChainAware’s Wallet Auditor, applied here to contract creators and LP providers instead of individual users.

For the full methodology, chain-by-chain breakdown, finding frequency analysis, honeypot signal correlations, and the complete competitive comparison against GoPlus, TokenSniffer, CertiK Skynet, and Honeypot.is, read the deep-dive: ChainAware Token Audit Launched – We Tested 10,000 CoinGecko Tokens. Here Are the Results. →

ChainAware.ai is the Web3 Agentic Growth Infrastructure – 20M+ wallet personas, 98% fraud detection accuracy, 127-check Token Audit, Agent Trust Score for 274,000+ ERC-8004 agents available via the Prediction MCP. Named in CB Insights’ AI Fraud Prevention Market Map. chainaware.ai

The post 55% of the Top 10,000 CoinGecko Tokens Are High Risk. ChainAware Token Audit Shows Why. first appeared on ChainAware.ai.

The smart contract security audit market is broken. Manual audits cost $5,000 to $150,000 and take weeks. Meanwhile, thousands of new tokens launch every single day – and the vast majority of retail investors check exactly nothing before they buy. On Binance Smart Chain alone, 95% of new liquidity pools end in rug pulls. The tools that exist – GoPlus, TokenSniffer, Honeypot.is – catch the obvious scams. They completely miss the sophisticated ones.

Today, ChainAware is changing that. Token Audit is live: 127 automated security checks across 11 analysis modules (8 currently active, 3 coming soon), powered by deep code analysis and ChainAware’s behavioral intelligence layer. To validate the system, we ran it against the top 10,000 tokens on CoinGecko, sorted by market capitalization. Those are not random memecoins – they are the most-traded, most-held tokens in crypto. The results are alarming.

This article presents every finding. Specifically, you will learn what the most dangerous patterns look like at scale, which chains produce the highest risk concentrations, and why the tools you are currently using are systematically missing the threats that matter most.

The Study: 10,000 CoinGecko Tokens, 13,000 Audits, 6 Chains

The dataset covers the top 10,000 tokens by market capitalization on CoinGecko as of July 2026. Because many tokens exist simultaneously on multiple blockchains – USDT, for example, runs on Ethereum, BSC, Polygon, Base, and Arbitrum – the total audit count reaches 12,998 individual contract audits across 6 chains. Consequently, each audit is independent: the same token contract deployed on ETH and BSC receives two separate audits, because the contract code, liquidity structure, and ownership configuration can differ significantly between deployments.

Furthermore, this is not a random sample of newly launched tokens. These are established, widely-traded assets – the tokens that appear in your wallet app, on DeFi dashboards, and in portfolio trackers. If findings this severe appear in the top 10,000 by market cap, the situation in the broader universe of hundreds of thousands of tokens is considerably worse.

Each audit runs 127 checks across 11 modules (8 currently active, 3 coming soon), including Ownership, Supply, Liquidity, Transfer, Approve, Permit, Pausability, Reentrancy, and Proxy Analysis. Three detection layers underpin each audit: deep code analysis for semantic code-level findings, direct on-chain RPC calls for live state verification, and ChainAware’s behavioral database for creator and LP trust scoring. Results are stored in a structured database with one scalar column per finding – enabling the statistical analysis below.

Chain Distribution

Token classification matters for accurate results. Reflection tokens, rebasing tokens, ERC-4626 vault tokens, and bridge tokens all have non-standard transfer mechanics that would trigger false positives in a naive static analysis tool. Token Audit identifies these token types using dedicated classifiers and adjusts its findings accordingly – for example, a reflection token legitimately fails the transfer conservation check by design, and Token Audit documents this distinction rather than incorrectly flagging it as a theft vector. Accurate false-positive management at scale is essential for a tool that will be embedded in high-volume platform integrations, where a false positive on a major legitimate token destroys user trust far faster than a false negative on an obscure scam.

Ethereum leads by audit count, reflecting the concentration of established DeFi protocols on the oldest EVM chain. BSC’s 26.7% share is notable: despite hosting a smaller share of top-10,000 market cap tokens, it accounts for a disproportionate share of the worst findings – as the chain-by-chain breakdown below demonstrates.

The Headline Results: 55% of the Top 10,000 Tokens Are High Risk

The single most important finding from this study is also the most unsettling one. Among the top 10,000 tokens by market cap – the most established, most liquid, most widely held tokens in the entire crypto market – 55.2% receive a HIGH RISK verdict from ChainAware Token Audit.

Only 18.7% of audited tokens receive a CLEAN verdict – meaning they pass all critical security checks, have no meaningful rug pull vectors, and carry no significant code-level risks. Put another way, more than 4 in every 5 tokens in the top 10,000 carry some level of meaningful security concern.

These numbers require context. HIGH RISK does not automatically mean the token is a scam. Many HIGH RISK findings reflect architectural choices that are widespread in legitimate DeFi protocols: uncapped mint functions controlled by governance contracts, upgradeable proxy architectures managed by multisigs, or LP positions not locked because the team chose a different treasury structure. However, HIGH RISK does mean that the token contract contains mechanisms a malicious actor could use to harm investors – and that investors deserve to know about them before committing capital.

Moreover, 131 confirmed honeypots in the top 10,000 is not a small number. These are tokens where the Token Audit’s simulation analysis module confirmed that you can buy – but cannot sell. Twelve of those honeypots were found on Ethereum, the chain most associated with institutional quality and regulatory oversight. The assumption that “top 10,000 by market cap = safe” is demonstrably false.

Results by Chain: BSC Is the Most Dangerous

BSC stands out dramatically. Only 7.6% of BSC token deployments in the top 10,000 are clean – the lowest of any chain in the study. Meanwhile, 68.3% are high risk and another 23.0% are suspicious. Combined, that means 91.3% of top-10,000 BSC tokens carry some security concern. This finding is consistent with BSC’s broader reputation: Chainalysis research identifies BSC as hosting approximately 71% of all rug pull scams globally, driven by lower transaction fees that make deploying fraudulent contracts nearly cost-free.

Base, by contrast, is the cleanest chain in the study at 22.5% clean. Its 40.0% high risk rate reflects a newer, more curated DeFi ecosystem. Nevertheless, 40% high risk across Base’s top tokens is not a reassuring figure.

What Drives the Risk: The Two Dominant Findings

Two findings appear far more frequently than any other in the dataset, together driving 76% of all HIGH RISK verdicts. Understanding them is essential to understanding why so many established tokens carry elevated risk scores.

Finding #1: 35.9% of Tokens Have No Mint Cap (INV_S2_NO_MINT_CAP)

The most common single finding across the entire dataset: 4,668 tokens – 35.9% of all audited contracts – have a mint function with no enforceable supply cap. This means the token’s owner, governance contract, or admin address can create unlimited new tokens at any time, diluting every existing holder’s position to zero.

Critically, this finding appears almost exclusively in HIGH RISK verdicts. Cross-referencing the two columns shows that zero CLEAN tokens carry NO_MINT_CAP – a perfect separation. Every CLEAN token in the dataset either has no mint function at all or has a mint function with an immutable, on-chain cap. The 4,668 NO_MINT_CAP tokens are split between HIGH RISK (4,439) and HONEYPOT (75), with only 154 in the SUSPICIOUS tier.

For investors, the implication is straightforward: a token with an uncapped mint function carries a structural risk that no amount of team credibility or market cap size eliminates. The inflation vector exists regardless of whether the team currently intends to use it.

Finding #2: 34.4% of Tokens Have No Timelock on Privileged Functions (INV_O6_NO_TIMELOCK)

The second-most common finding: 4,470 tokens – 34.4% – have privileged administrative functions (ownership transfer, fee modification, upgrade execution, mint authorization) with no timelock. A timelock requires that any privileged action be announced on-chain and delayed by a minimum period – typically 24 to 72 hours – giving the community time to react if a malicious or compromised admin executes a dangerous change.

Without a timelock, a single administrative transaction can drain a protocol, rug liquidity, or convert a functioning token into a honeypot in a single block. The attacker’s advantage is complete: investors cannot react to changes they cannot anticipate. Adding a timelock costs developers essentially nothing but a few lines of Solidity – which makes its absence in 34.4% of the top-10,000 tokens particularly striking.

Together, NO_MINT_CAP and NO_TIMELOCK account for the overwhelming majority of high-risk verdicts in this dataset. Both findings are invisible to honeypot simulation tools like Honeypot.is – which only checks whether a sell transaction reverts. Furthermore, both are absent from the GoPlus Security API’s detection layer. ChainAware’s Ownership and Supply modules specifically scan for these patterns using deep code analysis, which can trace through function call chains to confirm whether an enforceable cap or delay mechanism actually exists – not merely whether the contract declares one.

Liquidity Risk: 25.7% of Tokens Have Completely Unlocked LP

Beyond the supply and ownership findings, the Liquidity module produced the study’s most operationally urgent results. Liquidity is the primary signal that drives 42% of all verdicts – more than any other module – because liquidity risk is both the most directly dangerous and the most immediately verifiable.

The 25.7% unlocked LP figure is particularly significant. When LP tokens remain in the deployer’s wallet, the entire liquidity backing the token can be removed in a single transaction. Every investor who holds the token is exposed to total loss within one block. The deployer may have committed publicly to never removing liquidity – but without an on-chain lock, that commitment is entirely unenforceable. For how ChainAware detects LP lock status across both V2 (ERC-20 LP tokens) and V3 (NFT positions), see the Liquidity Verification module documentation.

Notably, liquidity lock expiry detection – finding INV_L3_LOCK_EXPIRED – currently has zero hits in the dataset. This finding detects LP locks that have already expired but the associated tokens have not yet been removed. Its absence likely reflects the study’s population: tokens with expired locks often appear after rug pulls have occurred, meaning the token may have been delisted or the pool may have been drained before it entered the CoinGecko top-10,000 dataset.

Confirmed Honeypots: 131 Tokens Where You Can Buy But Cannot Sell

Token Audit’s simulation analysis module forks the relevant blockchain, executes a real buy transaction inside the fork, then attempts a sell. When the sell reverts – meaning the token architecture actively prevents investors from exiting their positions – the verdict is HONEYPOT. This study confirmed 131 honeypots across the top 10,000 CoinGecko tokens.

Ethereum’s 59 confirmed honeypots deserve special attention. The assumption that Ethereum’s higher gas costs and more sophisticated user base filter out honeypot contracts is not supported by this data. Sophisticated honeypots on Ethereum often work precisely because they look legitimate: verified source code, reasonable tax rates, functioning buy mechanics, and professional-looking documentation. The sell block is implemented deep in the transfer call graph – typically using assembly instructions or layered delegation patterns that simple rule-based scanners do not detect.

What Makes a Honeypot: The Three Strongest Signals

Signal 1: hp_CUSTOM_TRANSFER_ENTRY_POINT – Present in 63% of confirmed honeypots (correlation +0.34). This finding fires when the token contract routes transfer calls through a non-standard function before reaching the standard _transfer implementation. Custom entry points are the primary mechanism honeypot developers use to insert sell-blocking logic while keeping the standard ERC-20 interface intact.

Signal 2: hp_UNEXPECTED_EVENTS_IN_TRANSFER – The single highest-correlation honeypot predictor at +0.46, present in 50% of confirmed honeypots. When a transfer function emits events beyond the standard Transfer(from, to, amount) required by ERC-20, it almost always indicates hidden logic inserting itself into the transfer path.

Signal 3: hp_LAYERED_TRANSFER_DELEGATION – Present in 53% of confirmed honeypots and 10.2% of all tokens. Layered delegation means the transfer function calls internal functions that call further internal functions, each potentially adding conditions. Professional honeypots use five or six levels specifically to bury the sell-blocking condition deep enough that automated scanners trace only the outer layers. For how ChainAware’s transfer invariant checking works, see the Transfer Verification documentation.

What Only ChainAware Finds: The Sophisticated Threats

The most significant contribution of this study is not the headline numbers – it is the class of threats that appear in this dataset and cannot be detected by any competing automated tool. ChainAware Token Audit runs 127 checks. Competitors like GoPlus run approximately 40. CertiK Skynet’s free Token Scan runs 19. The gap between those check counts corresponds directly to classes of threat that are invisible to current market-standard tools.

Transfer Conservation Analysis: The Silent Value Drain

Token Audit’s most technically distinctive check is Transfer Conservation (INV_T1_CONSERVATION_FAIL): the invariant that when Alice transfers 100 tokens to Bob, Alice’s balance decreases by exactly 100 and Bob’s balance increases by exactly 100. If sender_lost does not equal recipient_gained, value is being silently diverted – typically to a hidden fee recipient not disclosed anywhere in the token’s interface. Conservation-failing tokens pass every honeypot simulation test. Honeypot.is returns CLEAN. GoPlus returns CLEAN. The investor loses capital on each trade while the token technically allows selling.

The Phantom Balance variant (INV_T5_PHANTOM_BALANCEOF) – found in 5 tokens – is even more sophisticated. The token maintains two separate balance mappings: one that balanceOf() reads and displays to the investor, and a different one that _transfer() actually debits. Your wallet shows you holding 10,000 tokens while the transfer mechanism has already marked your real balance as zero. For the full invariant specification, see the Transfer Invariants documentation.

Permit Correctness: The EIP-2612 Attack Surface

EIP-2612 permit() is implemented in 30% of tokens in this dataset (3,903 tokens). No automated scanner other than ChainAware checks whether the permit implementation is actually correct. Finding INV_P7_PRELOADED_PERMIT – a constructor-time unlimited approval grant – appears in 21 tokens. These 21 tokens allow the deployer to drain any holder’s position at any time using a signature created before any investor bought the token. For how ChainAware detects permit vulnerabilities, see the Permit Verification module.

Approve Security: The Transitive Attack

ChainAware’s Approve module traces the complete call graph of approve() – catching tokens where calling approve(spender, 1000) also silently writes the caller’s balance to zero as a hidden side effect. Finding INV1_EXTRA_STATE_WRITE appears in 63 tokens. INV3_EXTERNAL_CALL_IN_APPROVE appears in 28 tokens. Both require deep code analysis. Neither GoPlus, TokenSniffer, CertiK Skynet, nor De.Fi Scanner runs this analysis. See the Approve Verification documentation.

Reentrancy Analysis

ChainAware is the only automated token scanner that includes reentrancy detection. This study found 540 tokens with no reentrancy guard (INV_R2_NO_REENTRANCY_GUARD), 485 tokens using legacy ETH transfer patterns vulnerable to callback exploitation (INV_R6_ETH_TRANSFER_LEGACY), and 48 tokens with read-only reentrancy exposure (INV_R5_READONLY_REENTRANCY). According to the OWASP Smart Contract Top 10, reentrancy remains one of the most exploited vulnerability categories in DeFi. See the Reentrancy Verification documentation.

Proxy Analysis: 13.2% of Tokens Are Upgradeable Contracts

Token Audit detected proxy contracts in 1,865 tokens – 14.3% of all audited contracts. More importantly, it classifies each proxy by who controls the upgrade function, producing a six-tier risk assessment for the upgrade authority.

Tier	Upgrade Control	Tokens	% of Proxies	Risk
EOA-Controlled	Single private key	139	7.5%	🔴 Critical
Unknown Auth	Cannot be resolved	383	20.5%	🟠 High
Contract-Controlled	DAO / protocol governance	1,152	61.8%	🟡 Medium
Multisig-Controlled	Multiple required signers	29	1.6%	🟢 Low
Timelock-Controlled	Delayed on-chain execution	9	0.5%	🟢 Lowest
UUPS Locked / Renounced	Upgrade permanently disabled	153	8.2%	Immutable

Among all proxy findings, the 139 EOA-controlled proxies represent the most urgent concern. These tokens are upgradeable by a single private key – no multisig, no governance vote, no timelock delay. One transaction from one address can replace the entire contract implementation. BSC accounts for 75 of the 139 EOA-controlled proxies – 54% of the most dangerous proxy tier on less than a third of the token count. For how ChainAware classifies proxy types, see the Ownership Verification module documentation.

Risk Score Analysis: What the Numbers Say at Scale

Liquidity and Supply together drive 76% of all verdicts. The 2.8% driven by Approve and 1.8% by Reentrancy represent high-value findings that no competitor detects. Those 599 verdicts cover the sophisticated operators who invest in clean-looking code specifically to pass GoPlus and TokenSniffer while hiding more subtle attack vectors.

How Token Audit Compares to Existing Tools

Security Check	GoPlus	TokenSniffer	CertiK Skynet	Honeypot.is	ChainAware
Honeypot simulation
Mint capability				❌	+ hidden mint + cap quality
LP lock status			❌	❌	(V2 + V3 NFT positions)
Timelock absence check	❌	❌	❌	❌	Unique
Approve() call graph analysis	❌	❌	❌	❌	Unique
Transfer conservation invariant	❌	❌	❌	❌	Unique
Phantom balanceOf detection	❌	❌	❌	❌	Unique
Permit() correctness (EIP-2612)	❌	❌	❌	❌	Unique
Reentrancy analysis	❌	❌	❌	❌	Unique
Creator behavioral Trust Score	❌	❌	❌	❌	Unique
LP provider Trust Scores	❌	❌	❌	❌	Unique

GoPlus Security is the market standard, averaging 717 million monthly API calls in 2025. Its coverage is broad but rule-based rather than semantic. The approve transitive attack, phantom balance exploit, permit preload, and reentrancy vectors are all invisible to GoPlus’s current architecture. For how ChainAware fits into the broader DeFi security ecosystem, see our Rug Pull Detection Tools comparison and DeFi Compliance Tools guide.

The Behavioral Layer: What Code Analysis Cannot See

Code analysis answers one question: does this contract contain dangerous mechanisms? It cannot answer a more important one: does the person who deployed this contract intend to use those mechanisms maliciously?

This distinction matters because the most dangerous operators specifically invest in clean-looking code. A professional rug pull team in 2026 runs deep code analysis before deploying, checks their own contract against GoPlus, and removes every pattern that produces a red flag. They keep the mint function but make it look like a governance-controlled feature. They leave the LP unlocked but explain it as a treasury management decision. The code passes every automated check. Then, after accumulating enough liquidity, they execute.

ChainAware’s behavioral Trust Score system operates on a fundamentally different signal: the on-chain history of every wallet that deployed the contract and every wallet that provided liquidity. A deployer whose previous contracts ended in rug pulls carries that history regardless of how clean the new contract looks. An LP provider who has removed liquidity from multiple projects within 30 days of launch carries that behavioral signature regardless of how long they have held the current position.

These behavioral signals draw on ChainAware’s core fraud detection infrastructure – the same system that achieves 98% fraud prediction accuracy across 20 million+ wallet behavioral profiles. Combined with the code-level findings from Token Audit’s analysis modules, the result is the only token security tool that catches both the technical vulnerability and the operator intent simultaneously. For the full behavioral intelligence methodology, see What Are Web3 Personas and the Fraud Detector documentation.

The Data Moat: Why Token Audit Cannot Be Replicated

Token Audit is built on three proprietary data assets accumulated over years of continuous operation. A competitor starting today cannot purchase these assets, compress the time required to build them, or replicate them from publicly available sources alone. Each one directly enables detection capabilities that require the asset to exist before the analysis can run – meaning the gap between ChainAware and any new entrant widens over time rather than narrowing.

20M+ Wallet Personas: The Behavioral Trust Score Foundation

Every Token Audit includes a creator behavioral Trust Score and LP provider Trust Scores – signals that no competing token scanner offers. These scores draw on ChainAware’s database of more than 20 million wallet behavioral profiles accumulated across 8 blockchains. Each profile represents a complete behavioral fingerprint: transaction history, timing patterns, counterparty networks, protocol diversity, AML exposure, and dozens of derived features trained against confirmed fraud outcomes. The result is 98% fraud prediction accuracy on held-out test data.

This persona depth is what makes the behavioral layer meaningful. A deployer whose previous contracts ended in rug pulls carries that history as a permanent behavioral signal – regardless of how clean the new contract code looks. Without the 20M+ persona database, the behavioral Trust Score would be a near-zero confidence interval. Building that database required years of continuous on-chain data collection and iterative retraining against real-world fraud cases. A new entrant cannot compress that timeline. Furthermore, the model retrains continuously on new confirmed fraud cases – meaning the behavioral edge compounds as ChainAware observes more fraud patterns than any competitor accumulating data from a cold start.

One Year of On-Chain Pair History: The Criminal Record Database

Token Audit’s creator Trust Score cross-references the token deployer’s wallet address against ChainAware’s database of confirmed rug pull and honeypot operators – a database built from more than a year of continuous monitoring of liquidity pair creation and removal events across PancakeSwap, Uniswap, and other major DEX venues. This database records which wallet addresses created pools that subsequently exhibited rug pull patterns, and which wallet addresses previously deployed honeypot token contracts.

This is the data asset that catches the serial scammer deploying a new token after previous campaigns. The rug puller of Q4 2025 is registered as a known criminal in ChainAware’s pair history database. When they deploy a new token in Q1 2026, Token Audit flags the creator wallet immediately – regardless of how clean the new contract code appears. No competitor runs this check because no competitor maintains a paired rug pull database cross-referenced against token deployer wallets. Building it retroactively is also impossible: identifying fraud outcomes requires the passage of time to observe liquidity removal patterns after the fact. The database is a one-year head start that cannot be bought or downloaded. For the data behind this detection layer, see our Rug Pull Tracker report.

Deep Code Analysis Infrastructure: The Semantic Engine Behind 127 Checks

The analysis modules that produce Token Audit’s unique findings – approve call graph analysis, transfer conservation invariants, phantom balance detection, permit correctness checking, and reentrancy analysis – all depend on a semantic code analysis infrastructure built specifically for EVM token analysis. It handles Solidity’s inheritance chains, proxy delegation patterns, assembly blocks within Solidity functions, and the non-standard token architectures (reflection, rebasing, ERC-4626 vault tokens) that cause false positives in naive static analysis tools.

Building this infrastructure required years of engineering investment. Every EVM edge case – from DELEGATECALL chains that must be traced across contract boundaries, to assembly-level balance manipulation that bypasses Solidity’s type system, to the layered transfer delegation patterns used by professional honeypot developers – required specific detection logic designed from first principles. The result is a scanner that runs 127 checks in a median of 11.3 seconds across any EVM-compatible contract. That combination of depth and speed is what enables the unique findings in this study that no competitor detects. A new entrant replicating this infrastructure from scratch would need years of engineering time and a corpus of real fraud contracts to validate against – both of which ChainAware has already invested. For the competitive context, see our Forensic vs AI-Powered Blockchain Analysis guide.

Why the Moat Compounds

Each of these three assets improves as it grows. More wallet personas means better fraud prediction precision on creator behavioral scores. More pair history means more confirmed criminal operator wallets in the cross-reference database. More contracts analyzed means more edge cases handled correctly in the deep code analysis infrastructure. A competitor starting today with identical engineering resources would still need years to reach ChainAware’s current capability level – and by then, ChainAware’s data assets would be proportionally larger still. The advantage is a trajectory, not a snapshot.

What Does a CLEAN Token Look Like?

2,436 tokens in this dataset – 18.7% – received a CLEAN verdict. Understanding what they have in common is as instructive as understanding what HIGH RISK tokens share.

Notably, zero CLEAN tokens have an uncapped mint function. Every CLEAN token either has no mint capability at all, or has a mint function with an immutable, verifiable on-chain cap. This single characteristic is the strongest predictor of a clean verdict – more consistent than any other single check in the dataset.

Additionally, CLEAN tokens overwhelmingly have verified source code. Their LP is either locked in a recognized locker (PinkLock, UniCrypt, Team Finance), burned to a dead address, or the project has explicitly structured treasury management differently with transparent on-chain documentation. Their ownership model is either renounced, controlled by a multisig with public signers, or timelocked. The transfer function has no assembly in its call graph, no external calls, and emits exactly the events ERC-20 requires – nothing more, nothing less. For the complete CLEAN verdict criteria, see the Token Audit Verdict Methodology.

Implications for Investors, Platforms, and Builders

For Individual Investors

The core finding of this study is that market capitalization rank is not a security signal. Tokens in the CoinGecko top 10,000 are 55.2% high risk and 1% confirmed honeypot. Before committing capital to any token, check three things specifically: whether the LP is locked, whether the mint function has an enforceable cap, and whether the contract is upgradeable by a single EOA. ChainAware Token Audit checks all three – and 124 other things – in under 60 seconds, free, without requiring a wallet connection. For how to interpret Token Audit results, see the Token Audit Investor Guide.

For DeFi Platforms and DEX Aggregators

Platforms that surface token information currently rely almost entirely on GoPlus for token security data. This study demonstrates that GoPlus-equivalent analysis leaves substantial risk categories completely undetected. Embedding Token Audit results at the listing or interaction point gives users substantially more protection than any current alternative. The REST API and MCP integration return full structured results including per-finding boolean flags, per-module risk scores, and a human-readable verdict. For technical integration details, see the Token Audit API documentation and the MCP Integration guide.

For Token Builders

The 18.7% CLEAN rate in this study is not a verdict on intent – most high-risk findings reflect architectural patterns that developers adopted without understanding their security implications. Token Audit runs in full against any deployed contract, returning specific findings with remediation guidance for each. Running Token Audit costs nothing and takes 60 seconds. It identifies every architectural risk that investors, security researchers, and automated tools will find after deployment – and gives developers the opportunity to fix them first. For how to use Token Audit in a pre-deployment security review, see the Pre-Deployment Checklist.

Pausability: 5% of Tokens Can Freeze All Trading Right Now

This study found 648 tokens – 5.0% of all audited contracts – where the mint function continues operating even when the token is paused (INV_PA5_MINT_NOT_PAUSED). An admin can pause all investor transfers while continuing to mint new tokens into their own wallet – simultaneously trapping existing holders and diluting their positions.

The most sophisticated pausability vulnerability – INV_PA4_ASYMMETRIC_PAUSE – blocks sells (transferFrom) while allowing buys (transfer). Honeypot.is tests a sell by calling transfer – the same function that is allowed in the asymmetric pause scenario – so it returns CLEAN for a token that is functionally a honeypot. ChainAware detects the asymmetric pattern by analyzing whether the pause condition applies differently to transfer versus transferFrom.

The 22 tokens currently paused represent an immediate alert for any investor holding these tokens. Token Audit calls paused() directly on each pausable contract to determine whether the pause is currently active – those 22 tokens are actively frozen right now. See the Pausability Verification documentation.

Supply Analysis: Hidden Minting and Supply Manipulation at Scale

Finding INV_S1_HIDDEN_MINT appears in 822 tokens – 6.3% of the dataset. Hidden mint detects functions that inflate the total token supply through mechanisms not labeled as mint() or _mint(). Because they bypass the standard _mint internal function, simple checks that scan for mint selectors in the contract ABI will miss them entirely. ChainAware traces every function that modifies the total supply variable regardless of name. See the Supply Verification documentation.

Finding INV_S4_FAKE_BURN appears in 318 tokens – 2.4%. A fake burn transfers to address(0) but does not reduce totalSupply(). Tokens marketed as deflationary based on burn history may be inflating their apparent scarcity. Additionally, 216 tokens show deployer concentration at 100% of circulating supply (INV_S6_DEPLOYER_100PCT) – the optimal setup for a coordinated pump-and-dump.

Audit Performance: 15 Seconds Average, 98.4% Source Verified

The median audit completes in 11.3 seconds – well within the threshold for interactive use cases like a DEX listing flow or a wallet pre-transaction security check. Only 9 audits across the entire 12,998-audit dataset exceeded 120 seconds – representing 0.07% of cases and well within operational tolerances for any integration scenario. 98.4% of tokens in this dataset have verified source code. For unverified contracts, Token Audit operates in bytecode analysis mode – the Liquidity module, Simulation module, and Behavioral Trust Score all operate on bytecode and on-chain state rather than source code. For details see the Unverified Contract Analysis documentation.

Conclusion: The Token Security Gap Is Real

This study set out to answer a simple question: how safe are the tokens that most investors actually hold? The answer – 55.2% high risk, 1% confirmed honeypot, 13.2% upgradeable proxy, 25.7% unlocked LP – is more alarming than most observers expected from the top 10,000 by market capitalization. These are not obscure tokens in forgotten DEX pools. Many appear in mainstream wallet apps, on regulated exchange listings, and in institutional portfolio allocations.

Furthermore, the findings that established tools miss are precisely the ones that matter most for sophisticated attacks. GoPlus, TokenSniffer, and CertiK Skynet catch the obvious patterns. Consequently, professional scam operators have adapted: they write clean-looking code that passes all three tools, then execute through vectors those tools cannot see. The approve transitive attack, the phantom balance exploit, the permit preload, the asymmetric pause – all of these appear in this dataset, and all of them are invisible to current market-standard scanners.

ChainAware Token Audit changes this equation. It brings institutional-grade deep code analysis to every token, automatically, for free, in under 60 seconds. Combined with simulation analysis, behavioral Trust Scores, and proxy upgrade authority classification, Token Audit produces a security profile that exceeds what any competing automated tool provides. According to FATF’s Virtual Assets Recommendations, real-time token screening is becoming a compliance requirement for virtual asset service providers globally. Token Audit is live today – test any contract free, no signup, no wallet connection. For enterprise integration, book a technical walkthrough below.

Frequently Asked Questions

What is a token audit?

A token audit is an automated or manual security review of a cryptocurrency token’s smart contract. A manual token audit performed by firms like CertiK or Hacken costs $5,000 to $150,000 and takes one to four weeks. ChainAware Token Audit performs automated analysis across 127 checks in under 60 seconds at no cost for individual queries.

How is ChainAware Token Audit different from GoPlus?

GoPlus Security runs approximately 717 million monthly API calls. Its detection is rule-based – it checks for known dangerous patterns at the interface level. ChainAware Token Audit adds semantic analysis via deep code analysis, which traces the complete execution paths of transfer(), approve(), and related functions to find vulnerabilities hidden deep in internal call chains. ChainAware also adds reentrancy detection, permit correctness analysis, supply consistency checking, and behavioral Trust Scores – none of which GoPlus offers.

What does HIGH RISK mean in practice?

HIGH RISK means the token contract contains one or more mechanisms that a malicious or compromised admin could use to harm investors – an uncapped mint function, unlocked LP, EOA-controlled proxy, or admin with no timelock. HIGH RISK does not mean the token is currently being exploited – it means the architectural risk exists and investors should evaluate it consciously before committing capital.

How does the simulation analysis work?

Token Audit’s simulation module forks the relevant blockchain at the current block using an Anvil instance, then executes real buy and sell transactions inside the fork. This catches dynamic honeypot behavior that static analysis cannot detect: tokens where sells revert, tokens where the effective sell tax differs from the declared sell tax, and tokens where token conservation fails. See Simulation Module documentation.

Which chains does Token Audit cover?

Token Audit currently supports seven chains: Ethereum, BNB Smart Chain, Base, Polygon, Arbitrum, Optimism, and Avalanche. The analysis architecture is chain-agnostic at the contract level: deep code analysis, ownership tracing, and supply verification work identically across EVM-compatible chains. The 10,000-token study referenced throughout this article was run before Avalanche support was added, which is why Avalanche does not appear in the dataset tables above.

What does the creator behavioral Trust Score measure?

The creator Trust Score evaluates the on-chain behavioral history of the wallet that deployed the token contract. It draws on ChainAware’s database of 20 million+ wallet behavioral profiles to assess whether the deployer has patterns consistent with fraud operators – prior rug pulls, coordination with known scam wallet clusters, funding source characteristics, and behavioral sequences associated with professional exit scam operations. See Fraud Detector documentation.

Can Token Audit be used pre-deployment?

Token Audit requires a deployed mainnet contract address – it analyzes live on-chain state alongside contract code. For pre-deployment security review, ChainAware recommends running deep code analysis directly against the contract source, then running Token Audit immediately after mainnet deployment. According to the Smart Contract Weakness Classification Registry, the majority of token vulnerabilities are deterministic at the code level and identifiable through static analysis shortly after deployment.

Sources: Chainalysis Crypto Crime Report · OWASP Smart Contract Top 10 · Smart Contract Weakness Classification Registry · EIP-2612: Permit Extension for ERC-20

Related ChainAware Reading: Best Rug Pull Detection Tools 2026 · DeFi Compliance Tools Comparison · KYT and AML Guide for DeFi · Web3 Wallet Auditing Providers 2026 · What Are Web3 Personas · Prediction MCP for AI Agents · The Web3 Agentic Economy · Agent Trust Score: On-Chain Trust Scoring for ERC-8004

The post ChainAware Token Audit Launched – We Tested 10,000 CoinGecko Tokens. Here Are the Results. first appeared on ChainAware.ai.