Repository + token audit pack depth

Evidence

• Latest push observed 2 days ago on main.

Caveats

• Freshness does not validate code quality.

Evidence

• A CI workflow is configured in .github/workflows.

Caveats

• CI presence does not imply CI passes; a separate signal is required to confirm green builds.
• CI presence is a hygiene marker, not a security proof.

Next step

• Surface the latest CI run status on the report once available.

Evidence

• 87 test files detected under common test paths.

Caveats

• File count is a hygiene marker; coverage and assertion quality are not measured here.

Next step

• Publish a coverage report and tie it into CI status.

Evidence

• A LICENSE file is present in the repository root.

Caveats

• License presence does not validate downstream compatibility.

Evidence

• A SECURITY.md or equivalent disclosure policy is published at the repository root.

Caveats

• Presence does not guarantee the policy is followed in practice.
• Policy presence is hygiene, not a security audit.

Next step

• Cross-reference the policy with a public bug-bounty or contact channel.

Evidence

• At least one tagged release exists.

Caveats

• Tag presence does not imply semver discipline or signed releases.

Next step

• Adopt signed tags + CHANGELOG entries to make releases auditable.

Evidence

• Dependabot or equivalent dependency update bot is configured.

Caveats

• Bot presence is hygiene, not a vulnerability assessment.

Next step

• Pair the bot with a CVE feed and document the patching policy.

Evidence

• Public engagement: 1200 stars, 134 forks, 18 open issues.

Caveats

• Public engagement is a popularity proxy, not a security proxy.
• Stars can be acquired; do not treat them as a quality signal alone.

Next step

• Cross-reference with active maintainer activity and recent triage on open issues.

Evidence

• Latest push observed 570 days ago on main.

Next step

• Mark the repository as archived or hand off ownership to avoid downstream surprises.

Evidence

• No CI workflow detected at scan time.

Caveats

• Absence of CI may reflect a private CI provider not visible in this scan path.

Next step

• Add a public CI workflow (GitHub Actions / similar) to catch regressions before merge.

Evidence

• No test files detected under common test paths.

Caveats

• Tests may live outside the conventional paths the scanner walked.

Next step

• Add unit + integration tests under /test or /tests with a documented runner.

Evidence

• No LICENSE file detected at the repository root.

Next step

• Add a LICENSE file with an explicit OSS license to clarify downstream usage rights.

Evidence

• No SECURITY.md or equivalent disclosure path detected.

Next step

• Publish a SECURITY.md describing how to report vulnerabilities and the response window.

Evidence

• No tagged releases detected.

Next step

• Tag releases with semver and publish CHANGELOG entries so dependents can reason about updates.

Evidence

• No dependency-update bot detected.

Next step

• Enable Dependabot or Renovate to surface security patches automatically.

Evidence

• Public engagement: 4 stars, 1 forks, 42 open issues.

Caveats

• Public engagement is a popularity proxy, not a security proxy.
• Stars can be acquired; do not treat them as a quality signal alone.

Next step

• Cross-reference with active maintainer activity and recent triage on open issues.

Evidence

• Contract source is verified on basescan.

Caveats

• Verified source proves the on-chain bytecode matches the published Solidity; it does not prove the code is secure.

Next step

• Pair with the Solidity audit pack for the actual security analysis.

Evidence

• Contract address: 0x4200000000000000000000000000000000000006 on base.

Caveats

• Provenance only confirms identity; it does not prove the contract is secure.

Next step

• Cross-reference the address with the project's official channels before treating it as canonical.

Evidence

• Reported pool liquidity at scan time: $1,250,000 USD.

Caveats

• Liquidity is a snapshot of one pair at scan time and can move within a single block.
• Liquidity is a control marker only; it is not a market position recommendation.

Evidence

• Holder snapshot: 9800 addresses.
• Top-holder concentration: 11.4% of supply.

Caveats

• Concentration uses a snapshot; routing through multiple wallets can mask coordinated holders.

Evidence

• Pair has been observable on-chain for 540 days.

Caveats

• Market age is a context marker, not a quality marker.

Evidence

• Deployer address has 6 prior public contract(s) on base.

Caveats

• Prior deployments do not validate the new contract; they only establish identity continuity.

Next step

• Audit at least one of the deployer's prior public contracts for behavior continuity.

Evidence

• Contract source is not verified on the explorer at scan time.

Next step

• Publish verified source on the canonical explorer for the chain so on-chain bytecode is auditable.

Evidence

• Contract address: 0x0000000000000000000000000000000000000bad on ethereum.

Caveats

• Provenance only confirms identity; it does not prove the contract is secure.

Next step

• Cross-reference the address with the project's official channels before treating it as canonical.

Evidence

• Reported pool liquidity at scan time: $8,400 USD.

Caveats

• Liquidity is a snapshot of one pair at scan time and can move within a single block.
• Liquidity is a control marker only; it is not a market position recommendation.

Next step

• Below the threshold typically required for stable on-chain exit; treat any size operation as control-risk.

Evidence

• Holder snapshot: 42 addresses.
• Top-holder concentration: 71.2% of supply.

Caveats

• Concentration uses a snapshot; routing through multiple wallets can mask coordinated holders.

Next step

• Document who controls the top holders and whether their addresses are time-locked.

Evidence

• Pair has been observable on-chain for 9 days.

Caveats

• Market age is a context marker, not a quality marker.

Next step

• Treat newly-spawned pairs as control-risk until liquidity behavior stabilizes.

Evidence

• Deployer address has no prior public contracts on ethereum.

Caveats

• A fresh deployer is not automatically suspicious; it is a context marker.

Next step

• Confirm whether the project owners use a multisig or a deployment factory.