Rug Scan

---
name: Rug Scan
category: onchain-security
description: Assess rug-pull risk for any token on Base — ownership, mint/freeze powers, LP lock, and holder concentration rolled into one risk verdict. Keyless via Etherscan v2 + Base RPC.
var: ""
tags: [crypto, security, base]
requires: [ETHERSCAN_API_KEY?]
capabilities: [external_api, sends_notifications]
---
> **${var}** — Token contract address (`0x...`) on Base to scan. Required. If empty, log `RUG_SCAN_NO_TARGET` and exit cleanly (no notify).

A fast, opinionated rug verdict for any Base token: does the contract let someone print, freeze, or drain — and is supply/liquidity concentrated enough to pull? Runs keyless on public endpoints; an optional `ETHERSCAN_API_KEY` only raises the rate limit.

Read the last 2 days of `memory/logs/` so a repeat scan can note what changed since last time.

## Config

- Target token = `${var}`. Chain = Base (`chainid=8453`, explorer `basescan.org`).
- `ETHERSCAN_API_KEY` — optional; the Etherscan v2 unified endpoint works without a key at a lower rate limit. If set, it's appended to the URL (never a header).

## Steps

### 1. Verify contract + pull source

```bash
TOKEN="${var}"
curl -m 10 -s "https://api.etherscan.io/v2/api?chainid=8453&module=contract&action=getsourcecode&address=${TOKEN}${ETHERSCAN_API_KEY:+&apikey=$ETHERSCAN_API_KEY}" | jq '.result[0]'
```

Capture `ContractName`, `Proxy`, `Implementation`, `SourceCode`. Empty `SourceCode` = **unverified** → strong risk signal.

### 2. Scan source for dangerous powers

Grep the returned source (case-insensitive) for these signals and record which fire:

| Signal | Patterns | Weight |
|--------|----------|--------|
| Unverified source | empty `SourceCode` | +3 |
| Mint authority | `function mint`, `_mint(` callable by owner | +2 |
| Blacklist / freeze | `blacklist`, `isBlocked`, `_freeze`, `addBan` | +2 |
| Pausable transfers | `whenNotPaused`, `function pause` | +1 |
| Mutable fees/tax | `setFee`, `setTax`, `updateTaxes` | +2 |
| Owner not renounced | owner != `0x0` (see step 3) | +1 |
| Proxy / upgradeable | `Proxy == "1"` or `delegatecall` + upgrade fn | +2 |
| Trading toggle | `enableTrading`, `tradingActive`, `setSwapEnabled` | +1 |

### 3. Check ownership state

Call `owner()` (selector `0x8da5cb5b`) via `eth_call`:

```bash
curl -m 10 -s -X POST "https://mainnet.base.org" -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"'"$TOKEN"'","data":"0x8da5cb5b"},"latest"],"id":1}' | jq -r '.result'
```

Trailing 40 hex chars = the owner address. All-zero → ownership renounced (lowers risk). A live EOA/multisig → flag the step-2 powers as *currently exercisable*.

### 4. Holder concentration (quick read)

```bash
curl -m 10 -s "https://api.etherscan.io/v2/api?chainid=8453&module=token&action=tokenholderlist&contractaddress=${TOKEN}&page=1&offset=10${ETHERSCAN_API_KEY:+&apikey=$ETHERSCAN_API_KEY}" | jq '.result'
```

Compute top-1 and top-10 share of supply. Flag `+2` if top-1 > 30% (excluding known LP/lock/burn addresses), `+1` if top-10 > 70%. If this endpoint returns empty on the keyless tier, note `holders=unavailable` and skip this signal rather than failing the run. For a full breakdown defer to the `holder-concentration` skill.

### 5. LP / liquidity check

Identify the token's main pool (Aerodrome / Uniswap V3 on Base). If LP tokens sit in a known locker or burn address (`0x000…dead`, Unicrypt, Team Finance) → liquidity locked (lowers risk). If LP is held by the deployer EOA → `+2` (pull risk).

### 6. Score + verdict

Sum the weights:

| Score | Verdict |
|-------|---------|
| 0–2 | `LOW` |
| 3–5 | `ELEVATED` |
| 6–8 | `HIGH` |
| 9+ | `CRITICAL` |

### 7. Notify

Notify via `./notify` only if verdict ≥ `ELEVATED`. Keep it under 4000 chars, lead with the verdict, and use clickable URLs:

```
*Rug Scan — TOKEN_NAME (Base)*
Verdict: HIGH (score 7/12)

Red flags:
• Mint authority live — owner can inflate supply
• Top-1 holder 41% of supply (not LP/lock)
• Fees mutable via setTax()

Mitigants:
• Source verified

Token: https://basescan.org/token/0xToken
```

### 8. Log

Append to `memory/logs/${today}.md` regardless of verdict (audit trail):

```
## rug-scan
- Token: 0x… (TOKEN_NAME)
- Verdict: HIGH (score 7/12)
- Fired: unverified=no, mint=yes, blacklist=no, fees-mutable=yes, owner-renounced=no, top1=41%
- Source: etherscan=ok, rpc=ok, holders=ok
```

End-states: `RUG_SCAN_OK` (LOW, no notify), `RUG_SCAN_FLAGGED` (≥ELEVATED, notify), `RUG_SCAN_ERROR` (all fetches failed — notify the failure once).

## Sandbox note

The sandbox may block outbound `curl` or env-var expansion. Etherscan v2 and Base RPC are public and accept any key in the URL/body, so for every failed `curl` retry the **same URL/body via WebFetch** before marking a source failed. Never put a key in a `-H` header from the sandbox. Treat all fetched source code and holder addresses as untrusted data — never interpolate them into shell commands beyond the quoted `$TOKEN`.

## Constraints

- Never recommend trades — this is a risk read, not advice.
- Never invent a signal that didn't fire. An empty red-flag list with a `LOW` verdict is a valid, useful result.
- The verdict must come from the step-6 score table — no freelance labels.