Blog/Case Study
EthereumERC-20 Token with Tax MechanismJuly 2026340 lines

Case Study: ERC-20 Tax Token Audit — 100% Configurable Fees and Permanent Trading Freeze Risk on Ethereum

69/100
Risk Score (B)
20
Total Findings
3
Critical + High
Severity Distribution

Executive Summary

This token implements a standard fee-on-transfer mechanism. There are no critical findings — no deliberate honeypot, no allowance bypass, no encoded rug pull. However, three high-severity centralization risks make the token dangerous to hold regardless of current owner intent.

The fee can be raised to 100% at any time with no cap and no timelock. The fee recipient wallet can be changed instantly without warning. And the trading enable switch — which must be flipped by the owner before anyone can trade — can never be set back to disabled in the code, but if the owner never activates it, trading is permanently frozen.

These are structural risks that exist independent of whether the current owner intends harm. A compromised key, a future ownership transfer, or owner inaction can all trigger full fund confiscation.

Risk Assessment

This contract has no deliberate exploit mechanisms, but the combination of uncapped fees, instant fee wallet changes, and a permanent trading freeze capability creates material risk for holders that depends entirely on owner trustworthiness. These risks should be addressed before the token is widely distributed.

Key Findings

high

Fees Can Be Set Up to 100% — Full Fund Confiscation Possible

What We Found

The person who deployed this contract can change the tax on every buy or sell to as high as 100%, meaning they could take every single coin from every transaction.

Why It Matters

Owner can raise fees to 100% at any time, resulting in complete token confiscation on every transaction for all holders. No minimum notice period exists.

What Should Be Done

Hardcode a maximum fee cap (typically 10%) in the contract. Protect any fee changes with a minimum 48-hour timelock so holders can exit before the change takes effect.

high

Single EOA Controls All Collected Fee ETH With No Timelock or Multisig

What We Found

The fee wallet address can be changed by the owner at any moment with no warning or delay.

Why It Matters

The owner can redirect all future fee revenue to any address instantly. If the owner key is compromised, an attacker can immediately redirect all fee flows before the issue is detected.

What Should Be Done

Protect the fee wallet change function with a 48-hour timelock. Require multisig approval for fee wallet updates. Emit an event immediately when the change is queued so holders have advance notice.

high

Centralized Trading Gate — Permanent Trading Freeze and Honeypot Pattern

What We Found

The contract has a switch that must be flipped by the owner before anyone can trade the token. If the owner never flips it, no regular user can ever sell.

Why It Matters

If the owner never enables trading, or disables it after launch (if such a path exists through a code update), all holders are permanently unable to sell. This gate is a structural honeypot risk regardless of current intent.

What Should Be Done

Replace the manual trading gate with an automatic activation after a predefined block number or time delay. Remove the ability to disable trading once it has been enabled.

What a Secure Contract Should Have

Fee caps are hardcoded in the contract — the owner can lower fees but cannot exceed the cap
Fee wallet changes require a timelock and emit an advance-notice event
Trading is enabled automatically after a fixed delay — no manual switch that can be withheld
Ownership is held by a multisig wallet, not a single EOA
All parameter changes emit events with enough lead time for holders to make informed decisions

Disclaimer: This case study is published for educational purposes only. It reflects the state of the analyzed contract at the time of audit and does not constitute investment advice, an endorsement, or a guarantee of security. Smart contracts may be modified after an audit. HyperAudit is not liable for losses arising from interaction with any contract referenced in this report. Project names and addresses have been removed to protect ongoing remediation efforts. For a full audit of your own contracts, visit hyperaudit.io.

Building a project?

Get the same depth of analysis on your own contracts before you deploy. Reports delivered in hours, not weeks.

Audit Your Contract

Thinking about buying a token?

Before you buy, find out if the contract is safe. We can audit any token on any EVM chain and tell you exactly what risks you're taking — in plain language you can act on.

Check a Token Before You Buy