The safety stack
Everything else on a card is a judgement. This is the part that is closest to a fact.
Nine layers run on every token. They are independent — each can answer, fail, or stay silent without the others — and they are deliberately not equally trusted. Some can condemn a token on their own. Some can only ever report.
The verdict you actually see
The card shows one word. Here is what stands behind it.
Sell simulation Blocks on its own
If I buy this and immediately sell, what comes back?
A multi-probe sweep across trade sizes, fitted to a curve, so a real fee-on-transfer tax can be told apart from ordinary price impact.
Fails when All probes revert (honeypot), the curve is conditional, or the round-trip cost is 20% or more.
An earlier generation measured price impact at one trade size and called the difference tax. It is not the same thing, and the multi-probe sweep exists because of that mistake.
Router spoof Blocks with one other
Does it behave differently when I call it directly?
Probes the token both through the Universal Router and directly, then compares.
Fails when The two paths disagree — clean through the router, malicious when a person calls it.
Observed sells Blocks with one other
Has anyone else actually got out?
Counts real sells by distinct wallets on-chain. The simulator-free backstop for tokens a quoter cannot price.
Fails when Never fails on tax. It can only confirm sellability or stay silent.
Hook family Blocks on its own
Was this deployed by a known honeypot factory?
Matches the pool hook against the address families behind previously confirmed honeypot clusters. Pure logic, no network call.
Fails when The hook belongs to a known family — the whole family is ruled out at once.
Its pass earns nothing. Not matching a known-bad list is the absence of a modelled risk, not evidence of safety.
Market suppression Blocks on its own
Is there a real market here at all?
Reads aggregator coverage and near-term volume. Absence from the most permissive aggregator means no price discovery anywhere.
Fails when No coverage, or coverage showing an effectively dead market.
Its pass earns nothing either. A token can have deep liquidity and still hold a balance-control backdoor.
Wash trade Blocks on its own
Is the volume on the chart real?
Follows the proceeds of each sell. In a wash pattern the tokens leave a wallet but the money arrives at a router or treasury instead of the seller.
Fails when Confirmed wash router — deliberately faked volume to bait buyers.
Balance control Blocks on its own
Can someone take this token out of your wallet?
Looks for privileged code paths that move a holder's balance without their approval.
Fails when A balance-control backdoor exists.
This layer exists because of a real loss. A token passed every sellability check, a customer bought it, and six seconds later the deployer moved their entire balance to a sink. The old stack was answering the wrong question.
Proxy / upgradeability Reports, never blocks
Can this contract become a different contract?
Detects proxy patterns and upgrade authority.
Fails when Reports rather than blocks. An upgradeable contract puts a shelf life on every other measurement here.
Its pass earns nothing — not being a proxy is not evidence you can exit.
Privileged selectors Reports, never blocks
What is the team still allowed to do?
Scans the bytecode for owner-only capabilities: mint, blacklist, pause, fee changes.
Fails when Reports rather than blocks.
Roughly three quarters of tokens expose no named privileged selector at all — including ones that later drained their holders. Silence here is the weakest evidence of safety in the stack, which is exactly why it reports instead of passing.
How nine answers collapse into one verdict
- RUG_RISK Any one hard-fail layer fails, or two soft-fail layers do.
- CLEAN At least one layer that actually tests exitability passed, and nothing failed.
- INDETERMINATE Nothing failed and nothing substantive answered. Never promoted to CLEAN.
The three rules that matter
One hard failure is enough. L1, L4, L5, L6 and L7 each condemn a token alone. There is no averaging, no "four out of five layers passed". A honeypot that passes eight checks is a honeypot.
A pass is not automatically evidence. Four of the nine layers can pass without earning anything. L4 not matching a known honeypot family, L5 finding a market, L8 finding no proxy, L9 finding no privileged function — none of those establish that you can exit. They are the absence of a modelled risk, and treating absence as safety is how a stack talks itself into a CLEAN it has not earned.
INDETERMINATE is a real answer and we will show it to you. When nothing failed but nothing substantive answered either, the verdict is INDETERMINATE and stays there. It is never quietly promoted to CLEAN. Roughly half of all launches have had at least one measurement we could not take — you deserve to know which half you are looking at.
CLEAN means "we looked and found nothing". It does not mean safe. It means the checks we can run, ran, and did not find the specific harms they are built to find. A contract that can be upgraded (L8) can become something else after we measured it.
The round-trip cost, and where the lines are
The single most useful number on a card. We simulate a buy immediately followed by a sell and report what comes back, as a percentage lost to fees, tax and price impact combined.
Two things worth knowing about this number:
It is not the same as "tax". An earlier version of this simulator measured price impact at one trade size and reported the difference as tax. Those are different things — a thin pool costs you money without anyone being malicious. The current simulator probes several trade sizes and fits a curve, so genuine fee-on-transfer separates from ordinary slippage.
Absence of the number is not a good sign. Where the simulation could not run, the card says so rather than showing a comfortable default. An unmeasured round-trip earns nothing in the conviction score either — it used to earn a small credit, and that was wrong: not knowing is not the same as knowing it is fine.
Why L7 exists
Every layer above L7 asks a version of can I sell this? On 3 August 2026 a customer bought a token that answered yes to all of them. It was genuinely sellable. Six seconds later the deployer moved their entire balance to a sink contract. The buyer had signed exactly one transaction — the purchase. No approval existed to revoke.
The stack was not wrong. It was answering the wrong question. "Can I sell it" and "can someone take it" are different questions, and only the first one had ever been asked.
L7 is the second question. It is a named, critical-severity check at every serious scanner in the industry, and we did not have it until a real customer paid for its absence.
What this stack does not catch
- A team that simply stops. No check detects abandonment.
- A legitimate token that dumps. Nothing here is about price.
- Sophisticated freshly-written traps. These layers encode harms we have seen. A genuinely novel mechanism gets one free run before anyone models it.
- Anything after the measurement. Every number is a snapshot. L8 exists to tell you when that snapshot has a short shelf life.
➡️ See also: Holder concentration · Launch forensics · Reading an alert
Anything on this page unclear, or wrong?
Tell us →