Token Security Scan for ERC-20 projects
Fast, evidence-based screening for token contracts on testnet and mainnet. We combine deterministic on-chain data, automated analysis, and AI-assisted reporting to highlight technical, ownership, liquidity, and transparency risks, without turning the report into investment advice.
A token contract may look simple, but the real risk picture is broader: source verification, proxy setup, owner privileges, role changes, holder concentration, deployer history, liquidity context, and fund flows all matter.
xcactus Scan is designed as a practical first-pass screening layer. It helps teams, partners, and analysts understand what is publicly visible on-chain before deeper due diligence or a full manual audit.
What the scan checks
Contract and source evidence
We check whether public evidence shows source-code availability, source/deployment matching, proxy patterns, and implementation metadata where available.
- Source verification status
- Contract inventory
- Proxy and implementation analysis
- Compiler and metadata visibility
- Static-analysis findings where source code is available
Ownership and privileged control
We check whether public evidence shows owner/admin patterns, privileged roles, and observable role changes that may allow minting, pausing, blacklisting, upgrading, or otherwise affecting token behavior.
- Ownership and admin detection
- AccessControl role discovery
- Role event reconstruction
- Privileged function indicators
- Upgrade and admin risk context
Mainnet market evidence
For mainnet scans, we add public market and distribution evidence to show concentration, liquidity context, and visible fund-flow patterns.
- Holder distribution
- Top-holder concentration
- DEX and liquidity discovery
- Deployer wallet analysis
- Fund-flow evidence
Two scan profiles: testnet and mainnet
Testnet / Dev Scan
For pre-launch contracts and development deployments.
- Teams preparing for launch
- Early technical readiness checks
- Detecting obvious contract, proxy, ownership, and configuration issues before mainnet
A testnet scan does not assess real holder distribution, production liquidity, real market behavior, or production privileged-control history.
Mainnet / Due Diligence Scan
For deployed tokens with public on-chain activity.
- Contract, source, proxy, and admin evidence
- Role and ownership indicators
- Holder distribution
- Liquidity and DEX context
- Deployer and fund-flow evidence
- Static-analysis findings where source is available
Evidence first. Conclusions second.
xcactus Scan separates deterministic data collection from report generation. The scan engine collects structured evidence from public sources such as explorers, RPC endpoints, contract metadata, logs, holder data, liquidity data, and static-analysis tools. The reporting layer then turns that evidence into a readable report with explicit limitations and coverage notes.
Each report is designed to make the evidence trail clear: what was observed, what could not be verified, what requires manual follow-up, and which findings should be treated as blockers, warnings, or informational context.
- Deterministic evidence collection. Structured data, not ad-hoc screenshots.
- Coverage states. The report distinguishes confirmed evidence, missing evidence, unsupported checks, and provider or API limitations.
- Environment-aware output. Testnet and mainnet reports are not treated as the same product.
- No investment-action language. Reports avoid buy, sell, or participate recommendations.
- Evidence and coverage checks. Beta reports are reviewed before being shared.
Sample reports
Two reports on public contracts — see what the scan delivers on each profile.
Pricing
During the beta period, selected scans are processed free of charge while we validate the workflow, report format, and evidence coverage. Beta capacity may be limited.
request a beta scanPrices are per scan. Complex multi-contract systems, manual audit work, legal review, or custom due-diligence scope are quoted separately.
FAQ
See Terms, Privacy, Disclaimer, and Methodology for scan scope and limitations.
work with us?