Token Audit¶

Key Takeaways
- Free to use - paste any contract address and get a verdict in seconds, no account required
- 11 verification modules covering ownership, liquidity, supply, transfer, honeypots, reentrancy, and more
- 6 verdict levels: CLEAN, SUSPICIOUS, HIGH RISK, HONEYPOT, THEFT, UNVERIFIABLE
- Supports 7 chains: BNB Smart Chain, Ethereum, Polygon, Base, Arbitrum, Optimism, Avalanche
- Also available via MCP tools run_token_audit / get_token_audit_result for agent pipelines

Token Audit is ChainAware's deep smart contract analysis product. Paste a token contract address, trigger a full audit, and get a verdict across 11 verification modules - covering ownership, liquidity, supply, transfer integrity, and more.

11
Verification Modules

6
Verdict Levels

7
Blockchains

129
Individual Findings

Supported chains: BNB Smart Chain · Ethereum · Polygon · Base · Arbitrum · Optimism · Avalanche

What Token Audit Checks¶

Every audit runs the contract through a multi-layer analysis pipeline - static code analysis, on-chain state reads, live liquidity checks, and behavioral signals - then aggregates the results into a single verdict with a 0-100 risk score.

Layer	What It Does
Source code analysis	Inspects every function in the contract for dangerous patterns - hidden sell gates, unauthorized balance writes, fee setters without caps, and more
On-chain state	Reads live contract state - current owner, pause status, total supply, deployer holdings
Liquidity checks	Discovers pools across all known DEXes (V2 and V3), checks TVL, LP lock status, and lock duration
Behavioral signals	Cross-references the deployer and feeder wallet against 20M+ behavioral profiles for fraud probability

The Six Verdicts¶

Verdict	Risk Score	What It Means
CLEAN	0-24	No theft or rug mechanics found. Analysis passed every safety check.
SUSPICIOUS	25-49	Risky mechanics present. The code can hurt holders under certain conditions.
HIGH RISK	50-74	Owner-controlled rug vectors exist. One owner transaction could trap or drain holders.
HONEYPOT	≥ 75	You can buy - but you cannot sell. Simulation confirms sells are blocked.
THEFT	≥ 75	Funds are drained on transfer. Every transfer leaks value to the deployer.
UNVERIFIABLE	-	Source code not verified. Only partial bytecode analysis was possible.

Full verdict reference →

The 11 Modules¶

Each module runs independently and produces its own status (pass / fail / warn / n/a) and risk score. The aggregate verdict combines all module scores plus behavioral signals.

Module	What It Checks
Live Simulation	Buy + sell simulation on a forked chain (coming soon)
Ownership & Access	Owner address, blast radius, capability flags, timelock
Liquidity & Pools	Pool TVL, LP lock status, lock duration, known lockers
Supply & Mint	Mint functions, supply caps, deployer concentration, burn integrity
Transfer Integrity	Balance conservation, fee setters, unauthorized recipients
Pausability	Pause/unpause access control, asymmetric pause patterns
Approve Integrity	Allowance write paths, EIP-2612 permit detection
Permit (Gasless)	Nonce, deadline, chainId, ecrecover verification
Reentrancy	CEI violations, reentrancy guards, cross-function attack paths
Arithmetic & Fees	Fee calculation and overflow patterns (coming soon)
Event Integrity	ERC-20 event compliance (coming soon)

Full module reference →

How the Verdict Is Calculated¶

Each module produces a risk score (0-100).
Module scores are summed into a total_risk_score.
A corroboration boost (+20) is applied when two high-severity findings point to the same owner address.
The honeypot analysis adds its own score from pattern-matching the contract code.
Behavioral signals (deployer fraud probability, behavioral honeypot flag) feed into the final aggregate.
The aggregate maps the combined score to a verdict tier.

A module that returns n/a did not run - the feature it checks was not present in this contract. This is not the same as a pass.

Using Token Audit¶

Via the UI

Open chainaware.ai, select Token Audit from the Fraud Tech menu, choose a chain, paste a contract address, and click Audit.

Results are deep-linkable - share the URL directly:

https://chainaware.ai/audit/{chain}/{address}

Via the Agent

Token Audit is available as MCP tools in any agent pipeline:

run_token_audit        # trigger an audit for a chain and address
get_token_audit_result # fetch results (poll until audit_status = "complete")

Or use the ready-made chainaware-token-audit-analyst agent - it handles triggering, polling, and interpreting results automatically.

Ready-made agents → · Prediction MCP →

Frequently Asked Questions¶

Is the Token Audit free?
Yes. Open chainaware.ai, select Token Audit, choose a chain, paste a contract address, and click Audit. No account required. Results include a shareable deep-link URL.

How long does a token audit take?
Most audits complete in seconds. If a contract has not been audited before, the system queues a full analysis and returns results within 30-60 seconds. Results are cached - subsequent requests for the same contract address return instantly.

What does an UNVERIFIABLE verdict mean?
The contract source code is not publicly verified on the block explorer. ChainAware can only perform partial bytecode analysis in this case. UNVERIFIABLE is not a pass - treat unverified contracts as higher risk.

Which blockchains does Token Audit support?
BNB Smart Chain, Ethereum, Polygon, Base, Arbitrum, Optimism, and Avalanche - 7 chains in total.

Can Token Audit detect honeypots?
Yes. The HONEYPOT verdict (risk score >= 75) confirms that buy transactions succeed but sell transactions are blocked or revert. This is confirmed by simulation on a forked chain - not just code pattern matching.

What is the difference between HONEYPOT and THEFT verdicts?
A HONEYPOT means you can buy the token but cannot sell it - your funds are trapped. A THEFT verdict means funds are actively drained on every transfer - value leaks to the deployer on each transaction.