01 How Nozy sniffs
Four sniffs. Same order every time.
- A
Captures
A clean browser loads the site and tries the product.
Raises concernDead buttons, a fake app, a wallet prompt nobody asked for.
- B
Statements
Each public statement is tested against a source.
Raises concernAudits nobody signed. Partners who never mention you.
- C
Persons
Accounts behind the project are traced back in time.
Raises concernFresh accounts, bought followers, recycled identities.
- D
Ledger
Deployer, holders, liquidity and contract are read onchain.
Raises concernLP not locked, clustered holders, serial deployers, sell taxes.
02 Reading a file
Three stickers. One shrug.
Anything pulled from live market data stays UNCHECKED until Nozy has actually sniffed it.
- CORROBORATED
- Receipts check out. Claims match the chain.
- OVERSTATED
- Something real, but the shill is bigger than the bag.
- HOSTILE
- Looks like a rug. Drainers, honeypots or rigged supply.
- INCONCLUSIVE
- Not enough data to call it. We say so instead of guessing.
- UNCHECKED
- Public data only. Nozy hasn’t sniffed this one yet.
- 1
Finding
One of three. No half-scores, no stars.
- 2
Confidence
How much the exhibits agree. Under 60: read it yourself.
- 3
Statement + test
What they said, what was found, and the verdict on each.
- 4
Source
Every line points to where it came from.
- 5
Filed at
Files age. Reopen anything older than a week.
03 Records
Every CA has a past. So does the deployer.
Paste a contract to open its record. Market data and deployer history load live.
LIVE · DexScreenerUNCHECKED
National Oil Fund Dividend$NOFDbase · 0xeebc…b25e
- Price
- $0.000198
- Liquidity
- $196,141
- FDV
- $198,122
- Volume 24h
- $13
- Pairs
- 1
- Pair age
- 15m
Open the full record and its deployer
04 Method & blind spots
The rules, and the blind spots.
Every rule is public. A sticker summarises receipts. Read the receipts, then decide. NFA.
How a finding is computed
- 1Any hostile signal means HOSTILE.
- 2Fewer than 4 rules with a known result means INCONCLUSIVE. We don’t guess.
- 30 or 1 concern means CORROBORATED. 2 or more means OVERSTATED.
- 4Confidence = share of applicable rules with a known result, capped at 95. Minus 15 when the count sits on the 1/2 boundary.
| Rule | What is read | Concern | Hostile |
|---|---|---|---|
| R1 | Contract source verified (Blockscout, then Sourcify, then Basescan if a key is set) | No verified source | n/a |
| E1 | Basescan verification via Etherscan v2 (optional key): contract name, compiler, licence, proxy | Not verified on Basescan, or an upgradable proxy | n/a |
| R2 | Owner: owner()/getOwner() via RPC | Owner active while privileged functions exist or the ABI is unknown | n/a |
| R3 | Dangerous functions in the verified ABI, weighted: balance setter ×5, mint ×3, blacklist ×3, proxy upgrade ×3 (also EIP-1967 slot via RPC), owner withdraw ×2, fee change ×2, pause ×2, max-tx ×1 | Total weight 2+ while the owner is not renounced (a proxy upgrade counts even when renounced) | n/a |
| R4 | Top-10 holder share (Blockscout excl. LP/burn; GeckoTerminal fallback may include LP) | Above 50% of supply | n/a |
| H1 | Connected wallets among the top 30 holder wallets (smart wallets included): shared first funder (also through airdrop contracts), tokens passed wallet to wallet instead of bought (traced one hop back), or direct transfers between them (Blockscout). Our own bubble map | A linked cluster holds 5% of supply or more, or 5+ linked wallets hold 2%+ | A linked cluster holds 10% or more, or 10+ linked wallets hold 5%+. Caps the score at 30 |
| H2 | Risk of coordinated pump: share of the top 20 holder wallets that hold the same other tokens (shown as a %), priced on DexScreener against their all-time high (GeckoTerminal daily candles or the Pons chart) | Most overlaps are dead or 70%+ below their high, and 3+ wallets holding them own 3%+ of supply | Same, with 5+ wallets owning 10%+ of supply: the same group may be trading launches together. Caps the score at 30 (lifted on a mature market) but reads MIXED, never HOSTILE, on its own |
| H3 | Low-balance wallets among the top 20 holders (0.5 ETH or less, chain RPC) | 70% or more of them | n/a |
| H4 | Fresh or low-history wallets among the top 20 holders (first funded under 7 days ago, or under 5 sent transactions) | Half or more of them, holding 10%+ of supply | n/a |
| R5 | Liquidity across all pairs (DexScreener) | Below $10,000, or no pair | n/a |
| R6 | LP tokens burned (v2-style pairs, via RPC) | Under 90% burned. Third-party lockers are not checked | n/a |
| R7 | Age of the oldest pair | Younger than 24 hours | n/a |
| R8 | Buy/sell simulation (honeypot.is, Base only) | n/a | Simulated sell fails |
| R9 | Simulated buy/sell tax | Above 10% | Above 25% |
| R10 | Deployer history (Blockscout) | 20+ contracts created in the latest 1,000 txs | n/a |
| R11 | Solana creator’s share of supply (GeckoTerminal) | Creator holds more than 10% | n/a |
| G1 | GoPlus security flags. EVM: honeypot, hidden owner, reclaimable ownership, selfdestruct, blacklist, mintable, pausable, modifiable tax, proxy, external call, cooldown. Solana: balance-mutable, closable, upgradable fee/hook/state | Any flag raised | Honeypot, cannot sell all, owner can change balances (Solana: balance-mutable authority) |
| G2 | Contract buy/sell tax as read by GoPlus | Above 10% | Above 25% |
| G3 | Honeypots linked to the same creator (GoPlus) | One or more | n/a |
| RC1 | RugCheck risk report (Solana) | Any risk RugCheck rates “danger”. “warn” items are listed, not scored | n/a |
| CX | Codex token risk verdict (contract simulation, authorities, liquidity, holder and flow signals, moderation) | HIGH RISK, CAUTION or contested verification | SCAM, a proven honeypot or rug, or a moderator scam label |
| CT | Buy/sell tax measured by Codex's contract analysis. Counted only when no other tax test ran | Above 10% | Above 25% |
| CH | Share of supply held by snipers, bundlers and insiders (Codex, launchpad tokens) | 20% or more | n/a |
| CD | Token creator history (Codex): tokens launched and graduated. Context only | Creator labelled notorious | n/a |
| DV | Dev wallet profile: the launch wallet's other tokens on this chain (Codex: market cap, liquidity, last trade, scam label, launchpad status) and its first funder (Blockscout / Solana RPC, up to 2 hops). Dead = no trade in 7 days, market cap under $5k or liquidity under $1k | SERIAL LAUNCHER (5+ launches, or 3+ in 30 days) or PROJECT FARMER (most earlier launches dead, 3+ launches in a week mostly dead, recycled names, funded by a wallet that launched 3+ tokens, 3+ launches within an hour, a shared naming template, or the same bytecode as 2+ earlier launches). Missing data gives UNKNOWN, never CLEAN. A farmer caps the score at 45 | RUGGER: 2+ earlier launches labelled scam, a creator Codex labels notorious or serial rugger, or scammer-funded. Caps the score at 30 |
| RS | Runner Score (0-100: 1h/6h price velocity, buy pressure, turnover) and pump risk (thin liquidity vs market cap, volume far above market cap, vertical candle, pair under 24 h, 3:1 buys). DexScreener, else GeckoTerminal. Context only, not scored | Pump risk HIGH is flagged, not scored | n/a |
| C1 | CoinGecko listing for this contract | None. Not listed is shown, not scored | n/a |
| S1 | Solana mint authority | Not revoked | n/a |
| S2 | Solana freeze authority | Not revoked: holders can be frozen | n/a |
| S3 | Token-2022 extensions | Transfer hook, fee, non-transferable, default state | Permanent delegate: tokens can be moved from any wallet |
| W1 | Domain age (RDAP) | Registered under 30 days ago | n/a |
| W5 | First Wayback Machine capture of the site | Never archived, or first captured under 30 days ago | n/a |
| W2 | Social links on the site | None | n/a |
| W3 | Audit statement | Audit claimed without a linked report | n/a |
| W4 | Contract named on the site or post | Named contract has no market on a supported chain | n/a |
| X1 | Post author account age | Under 90 days | n/a |
| X2 | Post author followers | Under 500 | n/a |
| A1 | AI-extracted statements (only if an AI key is set) | Claim with no support in the text | n/a |
Sources
Every source is free. We query them live and in parallel, each with its own timeout. Category mapping: Source R1 E1 · Owner R2 S1 S2 · Functions R3 S3 · Scanners G1 RC1 · Trading R8 R9 G2 · Liquidity R5 R6 · Holders R4 R11 · Market R7 C1 · Deployer R10 G3 · Web & social W1 to W5 X1 X2 A1. Pass = 100, concern = 40, hostile = 0. A category score is the average of its known rules. It shows “n/a” when none is known. Context lines (GT score, paid promotion, LP lock %, holder count, mutable metadata) are shown but never scored.
- DexScreenerPairs, price, liquidity, pair age. Orders API: paid profile, ads, boosts (context).
- GeckoTerminalHolder distribution (BNB Chain, fallback elsewhere), Solana creator, GT score (context).
- BlockscoutVerified source, holders, deployer history (Base, Ethereum, Robinhood Chain). BNB Chain has no public Blockscout: holders come from GeckoTerminal and the creator from GoPlus.
- SourcifyVerified source fallback.
- Public RPCOwner, LP burn, mint and freeze authority, Token-2022 extensions.
- honeypot.isBuy/sell simulation and tax (Base, Ethereum, BNB Chain).
- GoPlus SecurityHoneypot, owner powers, proxy, tax, creator’s honeypots (Base, Ethereum, BNB Chain, Robinhood Chain, Solana).
- RugCheckRisk report and LP locked % (Solana).
- CoinGeckoListing, rank and market cap (Base, Ethereum, BNB Chain, Solana).
- RDAPDomain registration date.
- Wayback MachineFirst archived capture of a site.
- fxtwitterX post and author account.
- Etherscan v2Optional, with ETHERSCAN_API_KEY: Basescan and Etherscan verification, proxy check, ABI fallback (Base, Ethereum). BNB Chain and creator or tx history need a paid plan, so deployer tracing stays on Blockscout.
Out of reach
- 01Private chats, Telegram groups, anything behind a login.
- 02Intent. A real team can still walk away.
- 03Token releases not written onchain or in docs.
- 04Off-chain deals, OTC sales, market makers.
Where it goes wrong
- 01Blockscout may block datacenter IPs. Holder and deployer rules then go unknown.
- 02Third-party scanners (GoPlus, RugCheck) can lag or disagree. A source that fails is shown as unavailable, never guessed.
- 03The Wayback Machine is slow and often times out. W5 then stays unknown.
- 04Sites that block server-side fetches return nothing to test.
- 05Renamed X accounts can hide their past.
- 06One chain per case. Bridged supply is out of view.