Token Audit at Scale: 15,000 EVM Tokens Across CoinGecko + CoinMarketCap (2026)

The smart contract security audit market is broken. Manual audits cost $5,000 to $150,000 and take weeks. Meanwhile, thousands of new tokens launch every single day – and the vast majority of retail investors check exactly nothing before they buy. Five weeks ago, ChainAware published the first Token Audit study: 127 automated security checks run against the top 10,000 tokens on CoinGecko by market capitalization. The results were alarming – 55.2% high risk, 131 confirmed honeypots, 13.2% upgradeable proxy contracts. Read the original study: Token Audit Launched – 10,000 CoinGecko Tokens.

Two weeks after that article published, CoinGecko’s tracked token count dropped from roughly 10,000 to about 8,845. We do not know whether our findings played any role in that cleanup – correlation is not causation, and CoinGecko does not publish the reasoning behind individual delistings. What we do know is that relying on a single data provider’s market-cap ranking leaves a study vulnerable to exactly this kind of shift. So this time, we did not rely on one provider.

This is the expanded study: every EVM-based token listed on CoinGecko combined with every EVM-based token listed on CoinMarketCap, deduplicated into a single joint set. The result is 15,008 individual contract audits – larger than the original study, built from two independent sources instead of one, and run across all seven chains Token Audit supports. We also expanded liquidity lock detection significantly since the last study, added near-complete proxy contract classification, and this article explains exactly what changed and why it matters – both for the numbers that moved and the ones that stayed remarkably consistent.

The Study: 15,008 Audits, Two Data Sources, Seven Chains

The dataset combines every EVM-compatible token listed on CoinGecko with every EVM-compatible token listed on CoinMarketCap as of August 2026, deduplicated into a joint set. Because the same token frequently exists on multiple chains simultaneously – and because CoinGecko and CoinMarketCap each track tokens the other does not – the combined approach produces meaningfully broader coverage than either source alone. The total reaches 15,008 individual contract audits across seven chains. As before, each deployment receives an independent audit: the same token contract on Ethereum and BSC gets two separate results, because liquidity structure, ownership configuration, and even contract bytecode can differ between deployments.

Each audit runs 127 checks across 11 modules (8 currently active, 3 coming soon), including Ownership, Supply, Liquidity, Transfer, Approve, Permit, Pausability, Reentrancy, and Proxy Analysis. Three detection layers underpin every audit: deep code analysis for semantic, code-level findings that trace execution paths rather than matching surface patterns; direct on-chain RPC calls for live state verification; and ChainAware’s behavioral database for creator and LP trust scoring, drawing on the same infrastructure covered in What Are Web3 Personas.

Chain Distribution

Chain	Audits	Share
Ethereum	5,572	37.1%
BNB Smart Chain	4,265	28.4%
Base	2,609	17.4%
Arbitrum	1,038	6.9%
Polygon	1,007	6.7%
Optimism	286	1.9%
Avalanche	231	1.5%

Ethereum still leads by audit count, but BSC’s share grew from 26.7% in the original study to 28.4% here – a byproduct of pulling from CoinMarketCap in addition to CoinGecko, which surfaces a wider tail of BSC-native tokens that market-cap-only rankings tend to exclude. Avalanche appears for the first time in a Token Audit study dataset; it was not yet supported when the original 10,000-token study ran. For background on why BSC consistently produces the riskiest token population, see Best Web3 Rug Pull Detection Tools 2026.

The Headline Results: 57.7% High Risk

Among the combined CoinGecko and CoinMarketCap EVM token universe, 57.7% receive a HIGH RISK verdict from ChainAware Token Audit – up from 55.2% in the original top-10,000-only study. For the full criteria behind each verdict tier, see the Token Audit Verdict Methodology.

Verdict	Count	Percentage
High Risk	8,661	57.7%
Suspicious	3,740	24.9%
Clean	2,451	16.3%
Honeypot	156	1.0%

Only 16.3% of audited tokens receive a CLEAN verdict, down slightly from 18.7% in the original study. This is the expected direction of movement: broadening the dataset beyond a strict top-10,000-by-market-cap cutoff pulls in more of the long tail, and the long tail skews riskier. It is a useful cross-check on the original finding rather than a contradiction of it – a wider net catches more risk, not less, which is consistent with market cap rank offering some (limited) protective signal while still leaving the majority of tokens exposed.

156 confirmed honeypots appear in this dataset, up from 131. Sixty-six of those honeypots were found on Ethereum – more than any other chain, and a reminder that the assumption “top-ranked = safe” does not hold even on the chain most associated with institutional-quality deployments. This finding is consistent with the wider pattern documented in Chainalysis’s Crypto Scam Revenue research, which tracks scam sophistication rising even as detection tools improve.

Results by Chain: BSC Remains the Most Dangerous

Chain	Clean	Suspicious	High Risk	Honeypot	Clean %	High Risk %
BNB Smart Chain	322	1,019	2,873	51	7.5%	67.4%
Optimism	30	75	181	0	10.5%	63.3%
Arbitrum	148	234	646	10	14.3%	62.2%
Ethereum	1,111	1,069	3,326	66	19.9%	59.7%
Polygon	194	316	481	16	19.3%	47.8%
Avalanche	69	65	96	1	29.9%	41.6%
Base	577	962	1,058	12	22.1%	40.6%

BSC’s position is unchanged from the original study – still the worst-performing chain in the dataset, with only 7.5% clean and 67.4% high risk. Combined with suspicious findings, 91.6% of BSC tokens in this expanded dataset carry some meaningful security concern. This tracks with Chainalysis research identifying BSC as hosting roughly 71% of rug pull scams globally, driven by transaction fees low enough to make fraudulent deployment nearly free. For weekly-updated BSC rug pull statistics, see the ChainAware Rug Pull Tracker.

Avalanche debuts as the cleanest chain in this study at 29.9% clean – ahead of Base’s 22.1%, which held the top spot in the original study. With only 231 audits, the Avalanche sample is the smallest in the dataset, so this ranking should be read with appropriate caution until the sample grows.

What’s New Since the Last Study: Liquidity Lock Detection, Rebuilt

The most significant methodology change since the original study is not a new check – it is a substantial expansion of an existing one. LP lock detection in the original study covered Uniswap V2-style pools on Ethereum and BSC only, and it was conservative by necessity: where the system could not confirm lock status with confidence, those tokens were excluded from the unlocked-LP finding entirely rather than risk a false positive.

That constraint is gone. LP lock detection now covers both V2 (ERC-20 LP token) and V3 (NFT position) pool structures, across six chains – Ethereum, BSC, Base, Polygon, Arbitrum, and Avalanche – and across the major DEX families on each: Uniswap, PancakeSwap, QuickSwap, SushiSwap, and Trader Joe. Recognized locker contracts (PinkLock, UniCrypt, Team Finance, and chain-specific lockers) are checked directly, alongside burn-address and permanent-lock detection.

The practical result is that far more tokens now receive a definitive locked-or-unlocked determination instead of being excluded from the check. That is the primary reason the unlocked-LP percentage in this study (49.5%) is substantially higher than in the original (25.7%) – broader, more confident detection surfaces cases the earlier, more conservative version could not classify. It reflects better measurement, not a sudden deterioration in token quality.

Optimism is not included in liquidity lock detection – Token Audit has not built locker registry support for Optimism’s DEX ecosystem, so lock status is not evaluated there. Avalanche is included in the check, but the study found zero confirmed locks on Avalanche tokens to date, which is a finding in itself worth noting alongside the chain’s otherwise-clean profile on other checks.

A related product change: liquidity lock status is no longer a static, cached figure. Anyone can now trigger a real-time recalculation on any token through the free Token Audit tool – the check re-verifies current lock status directly against on-chain state, typically completing in 20 seconds to 5 minutes depending on how many pools the token has. This matters because lock status is not static in practice: locks expire, new pools get created, and liquidity moves. A cached “locked” verdict from a week ago is not the same claim as a verdict confirmed right now.

Liquidity Findings

Finding	Count	% of Tokens	What It Means
INV_L1_NO_POOL_FOUND	4,343	28.9%	No liquidity pool discovered on any tracked DEX
INV_L2_LP_UNLOCKED	7,423	49.5%	LP tokens held by deployer or unlocked address
INV_L5_CRITICAL_TVL	3,911	26.1%	Pool TVL below critical threshold ($1,000)
INV_L5_LOW_TVL	3,051	20.3%	Pool TVL below low threshold ($10,000)
INV_L4_PARTIAL_LOCK	271	1.8%	LP partially locked – unlocked portion remains riskier

Liquidity remains the single largest driver of risk verdicts in the dataset, and by a wider margin than before: the Liquidity module now drives 46.8% of all verdicts, up from 42.0% in the original study – a direct consequence of the expanded lock detection surfacing more definitive findings rather than leaving them unclassified.

What Drives the Risk: Mint Cap and Timelock, Still Dominant

The same two findings that drove most high-risk verdicts in the original study remain the two largest sources of risk here – at almost identical rates, which is a useful consistency check across an independently-sourced, 15% larger dataset.

No Mint Cap (INV_S2_NO_MINT_CAP): 35.3%

5,305 tokens – 35.3% of the dataset – have a mint function with no enforceable supply cap, nearly unchanged from 35.9% in the original study. The separation from CLEAN verdicts remains perfect: zero CLEAN tokens carry NO_MINT_CAP in this dataset, exactly as in the original. Every CLEAN token either lacks a mint function entirely or has one with an immutable, verifiable on-chain cap. Of the 5,305 flagged tokens, 5,051 land in HIGH RISK and 89 in HONEYPOT, with only 165 in SUSPICIOUS.

No Timelock (INV_O6_NO_TIMELOCK): 35.8%

5,373 tokens – 35.8% – have privileged administrative functions with no timelock protection, close to the original study’s 34.4%. Without a timelock, a single transaction from a compromised or malicious admin key can drain a protocol or convert a functioning token into a honeypot with no warning to holders. According to the OWASP Smart Contract Top 10, privileged-function abuse remains one of the most exploited categories in production DeFi contracts.

Together, these two findings continue to drive the overwhelming majority of high-risk verdicts. Liquidity and Supply modules combined now account for 77.4% of all primary-signal verdicts, up from 76% in the original study. Both findings remain invisible to honeypot-simulation-only tools; for how ChainAware’s approach differs structurally, see Web3 Wallet Auditing Providers in 2026.

Proxy Analysis: 34.9% of Tokens Are Upgradeable Contracts

This is the largest directional change from the original study, and it deserves a direct explanation rather than a footnote. The original study found 13.2% of tokens used proxy contracts. This study finds 34.9% – 5,235 of 15,008 tokens. That increase is real, but it is not a claim that upgradeable proxies have become dramatically more common among EVM tokens in five weeks. It reflects a detection fix: earlier proxy classification only ran through a separate backfill process and left the majority of audited tokens without any recorded proxy status at all. That gap has since been closed, so this study’s proxy figure reflects near-complete coverage (99.9% of tokens have a determination either way) rather than the partial coverage the original number was built on. The original 13.2% likely understated true proxy prevalence; 34.9% is the more reliable figure going forward.

Upgrade Control	Tokens
Contract-Controlled (DAO / protocol governance)	1,324
Unknown Auth – cannot be resolved	419
EOA-Controlled – single private key	118
UUPS Renounced	96
UUPS Locked	86
UUPS, EOA owner	59
Multisig-Controlled	31
UUPS, Contract owner	15
Timelock-Controlled	9

118 tokens are upgradeable by a single private key with no multisig, no governance vote, and no timelock delay – one transaction from one address can replace the entire contract implementation. That figure is lower in absolute terms than the original study’s 139, despite the much larger overall proxy count, because near-complete detection this time correctly sorts most proxies into contract-controlled or unknown-authority tiers rather than defaulting ambiguous cases into the highest-risk bucket. The EIP-2612 permit and proxy upgrade patterns referenced here follow the same specification tracked in EIP-2612.

Honeypot Signals: What Predicts a Confirmed Honeypot

156 confirmed honeypots appear in this dataset – contracts where Token Audit’s simulation module confirmed a buy transaction succeeds but a sell reverts, using the same forked-blockchain simulation methodology detailed in the Simulation Module documentation. The strongest predictive signals are consistent with the original study, with custom transfer entry points remaining the top predictor:

Signal	Present in Confirmed Honeypots
hp_CUSTOM_TRANSFER_ENTRY_POINT	56%
hp_LAYERED_TRANSFER_DELEGATION	51%
hp_UNEXPECTED_EVENTS_IN_TRANSFER	47%
hp_OBFUSCATED_VARIABLE_NAMES	36%
hp_BLACKLIST	29%
hp_EXCESSIVE_BRANCHING_IN_TRANSFER	28%

Custom transfer entry points and layered transfer delegation remain the two most reliable predictors, matching the original study’s finding that professional honeypot developers route sell-blocking logic through non-standard function paths specifically to evade rule-based scanners that only inspect the standard _transfer implementation. This class of vulnerability is documented more broadly in the Smart Contract Weakness Classification Registry.

Pausability and Supply: The Smaller but Sharper Findings

718 tokens (4.8%) allow minting to continue while the token is paused for everyone else – an admin can freeze investor transfers while continuing to dilute their own holdings, functionally trapping and diluting holders at once. 30 tokens in this dataset are actively paused right now. One token exhibits the asymmetric pause pattern that blocks sells while permitting buys – the same pattern that causes Honeypot.is to return a false CLEAN, because it tests sells using the function that remains open in that scenario.

On the supply side, 980 tokens (6.5%) show hidden mint functions that inflate supply through mechanisms not labeled mint() – invisible to any scanner that only checks function names rather than tracing every path that modifies totalSupply(). 330 tokens show fake burns: transfers to the zero address that do not actually reduce reported total supply, meaning apparent scarcity from burn history may not be real. For platform-level compliance implications of supply and mint integrity, see DeFi Compliance Tools Comparison 2026.

Risk Score Distribution and Audit Coverage

Risk Score Metric	Value
Mean score	102.2
Median score	100.0
25th percentile	55.0
75th percentile	145.0
Maximum score	1,375

97.3% of tokens in this dataset have verified source code, consistent with the original study’s 98.4%. For unverified contracts, Token Audit’s Liquidity, Simulation, and Behavioral Trust Score modules continue to operate on bytecode and on-chain state rather than source, so a lack of verification does not mean a lack of coverage.

Two Studies, One Consistent Picture

Metric	Original (CoinGecko Top 10K)	This Study (CoinGecko + CMC EVM)
Total audits	12,998	15,008
Chains covered	6	7
High risk	55.2%	57.7%
Suspicious	25.1%	24.9%
Clean	18.7%	16.3%
Confirmed honeypots	131 (1.0%)	156 (1.0%)
No mint cap	35.9%	35.3%
No timelock	34.4%	35.8%
LP unlocked	25.7%*	49.5%
Proxy contracts	13.2%*	34.9%
Source verified	98.4%	97.3%

*Original-study LP unlock and proxy figures were measured under narrower detection coverage than this study’s; see the sections above for what changed and why the two numbers are not directly comparable as an apples-to-apples trend.

The headline verdict distribution held steady within a few points across two independently-sourced datasets five weeks apart – that consistency is itself a meaningful validation of the original findings. The market cap ranking did not meaningfully change the risk picture; broadening past it if anything made things look slightly worse, which is the expected direction.

Implications for Investors, Platforms, and Builders

For Individual Investors

The core finding holds across both studies and a larger, more independent dataset: whether a token appears on a market-cap leaderboard is not a security signal. Before committing capital to any token, check whether the LP is locked – and check it in real time, not from a cached figure – whether the mint function has an enforceable cap, and whether the contract is upgradeable by a single EOA. ChainAware Token Audit checks all three, plus 124 other things, free, in under 60 seconds.

For DeFi Platforms and DEX Aggregators

The expanded proxy detection and real-time liquidity lock recalculation are both available through the same REST API and MCP integration used for the original Token Audit launch. Platforms embedding Token Audit at the listing or interaction point now get more complete proxy classification and on-demand lock verification rather than a cached snapshot. For AI agents specifically, see The Web3 Agentic Economy for how automated due diligence fits into agent-driven trading workflows.

For Token Builders

Running Token Audit against a deployed contract costs nothing and takes under a minute. It surfaces the same findings investors, security researchers, and automated tools will eventually find – with enough detail to fix them before that happens. Builders working in the ERC-8004 agentic commerce space should also see Agent Trust Score, ChainAware’s parallel trust-scoring system for on-chain AI agents.

Frequently Asked Questions

Why does this study use CoinGecko and CoinMarketCap combined instead of just CoinGecko?

The original Token Audit study used CoinGecko’s top 10,000 tokens by market cap. Two weeks after publication, CoinGecko’s tracked token count dropped to roughly 8,845 – we cannot confirm whether the original study contributed to that cleanup, but it illustrated the risk of depending on a single provider’s list. Combining CoinGecko and CoinMarketCap into one deduplicated EVM token set produces broader, more resilient coverage than either source alone.

Why did the unlocked-LP percentage nearly double?

Liquidity lock detection expanded from V2-only, two-chain coverage to V2 and V3 across six chains and five major DEX families. The original study excluded tokens it could not confidently classify; this study classifies nearly all of them. The increase reflects more complete measurement, not a sudden change in token quality.

Why did the proxy contract percentage increase from 13.2% to 34.9%?

A gap in the original detection pipeline left most audited tokens without a recorded proxy classification. That gap is now closed, so this study’s 34.9% reflects near-complete coverage rather than a real-world increase in proxy usage.

Can I check a token’s liquidity lock status in real time?

Yes. The free Token Audit tool now supports on-demand liquidity lock recalculation – it re-verifies current lock status directly against on-chain state across V2 and V3 pools on Uniswap, PancakeSwap, QuickSwap, SushiSwap, and Trader Joe, typically completing in 20 seconds to 5 minutes depending on how many pools the token has.

Which chains does Token Audit cover, and are all checks available everywhere?

Token Audit covers seven chains: Ethereum, BNB Smart Chain, Base, Polygon, Arbitrum, Optimism, and Avalanche. All 127 checks run on all seven. Liquidity lock detection is the one exception: it covers six chains and does not currently support Optimism, where locker registry support has not been built.

How is this different from GoPlus, TokenSniffer, or Honeypot.is?

Those tools primarily check honeypot simulation and basic mint capability. ChainAware runs 127 checks including timelock absence, approve() call graph analysis, transfer conservation invariants, permit() correctness, and reentrancy detection – none of which competing scanners currently offer. See the full comparison in the original Token Audit Launched study.

---

Sources: Chainalysis Crypto Scam Revenue ↗ · Chainalysis Crypto Crime Report ↗ · OWASP Smart Contract Top 10 ↗ · Smart Contract Weakness Classification Registry ↗ · EIP-2612: Permit Extension for ERC-20 ↗

Related ChainAware Reading: Token Audit Launched: 10,000 CoinGecko Tokens · Best Rug Pull Detection Tools 2026 · Rug Pull Tracker Report · Web3 Wallet Auditing Providers in 2026 · DeFi Compliance Tools Comparison · KYT and AML Guide for DeFi · What Are Web3 Personas · Prediction MCP for AI Agents · The Web3 Agentic Economy · Agent Trust Score: On-Chain Trust Scoring for ERC-8004