Case Study: ERC-20 Tax Token Audit — 100% Configurable Fees and Permanent Trading Freeze Risk on Ethereum
Executive Summary
This token implements a standard fee-on-transfer mechanism. There are no critical findings — no deliberate honeypot, no allowance bypass, no encoded rug pull. However, three high-severity centralization risks make the token dangerous to hold regardless of current owner intent.
The fee can be raised to 100% at any time with no cap and no timelock. The fee recipient wallet can be changed instantly without warning. And the trading enable switch — which must be flipped by the owner before anyone can trade — can never be set back to disabled in the code, but if the owner never activates it, trading is permanently frozen.
These are structural risks that exist independent of whether the current owner intends harm. A compromised key, a future ownership transfer, or owner inaction can all trigger full fund confiscation.
Risk Assessment
This contract has no deliberate exploit mechanisms, but the combination of uncapped fees, instant fee wallet changes, and a permanent trading freeze capability creates material risk for holders that depends entirely on owner trustworthiness. These risks should be addressed before the token is widely distributed.
Key Findings
Fees Can Be Set Up to 100% — Full Fund Confiscation Possible
What We Found
The person who deployed this contract can change the tax on every buy or sell to as high as 100%, meaning they could take every single coin from every transaction.
Why It Matters
Owner can raise fees to 100% at any time, resulting in complete token confiscation on every transaction for all holders. No minimum notice period exists.
What Should Be Done
Hardcode a maximum fee cap (typically 10%) in the contract. Protect any fee changes with a minimum 48-hour timelock so holders can exit before the change takes effect.
Single EOA Controls All Collected Fee ETH With No Timelock or Multisig
What We Found
The fee wallet address can be changed by the owner at any moment with no warning or delay.
Why It Matters
The owner can redirect all future fee revenue to any address instantly. If the owner key is compromised, an attacker can immediately redirect all fee flows before the issue is detected.
What Should Be Done
Protect the fee wallet change function with a 48-hour timelock. Require multisig approval for fee wallet updates. Emit an event immediately when the change is queued so holders have advance notice.
Centralized Trading Gate — Permanent Trading Freeze and Honeypot Pattern
What We Found
The contract has a switch that must be flipped by the owner before anyone can trade the token. If the owner never flips it, no regular user can ever sell.
Why It Matters
If the owner never enables trading, or disables it after launch (if such a path exists through a code update), all holders are permanently unable to sell. This gate is a structural honeypot risk regardless of current intent.
What Should Be Done
Replace the manual trading gate with an automatic activation after a predefined block number or time delay. Remove the ability to disable trading once it has been enabled.
What a Secure Contract Should Have
Disclaimer: This case study is published for educational purposes only. It reflects the state of the analyzed contract at the time of audit and does not constitute investment advice, an endorsement, or a guarantee of security. Smart contracts may be modified after an audit. HyperAudit is not liable for losses arising from interaction with any contract referenced in this report. Project names and addresses have been removed to protect ongoing remediation efforts. For a full audit of your own contracts, visit hyperaudit.io.
Building a project?
Get the same depth of analysis on your own contracts before you deploy. Reports delivered in hours, not weeks.
Audit Your ContractThinking about buying a token?
Before you buy, find out if the contract is safe. We can audit any token on any EVM chain and tell you exactly what risks you're taking — in plain language you can act on.
Check a Token Before You Buy