Sample report
Generated by running UNWRAP against RiskyToken, a deliberately unsafe test contract deployed on a local development chain (anvil). The address is a local test address and does not exist on any public network. Everything below is real analyser output.
Local development chain (anvil)Verified source
RiskyToken
0x5FbDB2315678afecb367f032d93F642f64180aa3
Analysed 21 Oct 2026, 15:37 UTC at block 10
Summary
- RiskyToken: ERC-20 token on Local development chain (anvil). Analysed from verified source (blockscout).
- Privileged accounts can perform: arbitrary calls, minting, moving funds, blocking addresses, pausing, changing fees.
- 1 sensitive capability group(s) appear callable by anyone; see Permissions.
- The owner (0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266) is an externally owned account: a single private key controls 9 owner-restricted permission group(s).
- 7 potential vulnerabilities, 7 heuristic warning(s) and 3 confirmed risky behaviour(s) detected. No finding count means a contract is safe.
Findings by severity
Counts are not a score. Read each finding: severity and confidence are reported separately.
Data available
- Validate input and network status ok
- Retrieve on-chain data status ok
- Retrieve verified source status ok
- Analyse functions and permissions status ok
- Security analysis status ok
Contract
- Classification
- ERC-20 token
- Standards
- ERC-20 (high confidence: All six ERC-20 functions are present.)
- Patterns
- OwnablePausable
- Inheritance
- RiskyToken → Ownable
- Network
- Local development chain (anvil) chain 31337
- Verification
- Verified on blockscout.v0.8.26+commit.8a97fa7a
On-chain data
- Block
- 10
- Native balance
- 0 ETH
- Transaction count
- 1
- Bytecode
- 4,443 bytes0x0e32cca0dd91206db2f7c2b149b0bcddfad0cadf5738ee8609b9c5afd0c10dc4
Token
- Standard
- ERC-20
- Name and symbol
- Risky Token (RISK)
- Decimals
- 18
- Total supply (current)
- 1,000,000
- Maximum supply
- Not established. The contract exposes no cap; current supply is not a maximum.
- Holders
- Holder counts and distribution need an indexing service. UNWRAP does not show holder data rather than estimate it.
Proxy and upgradeability
No recognised proxy pattern. UNWRAP checks EIP-1967 (transparent, UUPS, beacon), EIP-1167 and legacy ZeppelinOS slots.
Who is in control
Owner: 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266(wallet)
The owner (0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266) is an externally owned account: a single private key controls 9 owner-restricted permission group(s).
Limitations of this report
- No transaction simulation was run. UNWRAP does not test whether tokens can be bought or sold.
- Static analysis finds known patterns. It cannot prove a contract is safe, and the absence of findings is not evidence of safety.
- Source comments and NatSpec are written by the contract author and are shown as claims, not facts.
Analysers and data sources
- UNWRAP AST rules ranSolidity AST analysis via @solidity-parser/parser.
- UNWRAP bytecode rules ranSelector extraction, opcode scan, proxy templates.
- Slither ranSlither ran and reported 11 result(s).
- Validate input and network okChain ID 31337 confirmed; block 10; 4443 bytes of code.
- Retrieve on-chain data okBalance, nonce and bytecode retrieved.
- Retrieve verified source okblockscout: Verified source found.
- Analyse functions and permissions okParsed 2 source file(s); 30 externally callable functions.
- Security analysis okUNWRAP static rules: 8 result(s). Slither ran and reported 11 result(s).