GrailTokenV2 $GRAIL

Risks (4)

• MediumMultisig can raise the supply cap and minting rate, diluting holdersmintAI

  New GRAIL is minted over time by emitAllocations(), which anyone can call. The owner (a Gnosis Safe needing 3 signatures) can raise elasticMaxSupply up to the hard-coded MAX_SUPPLY_LIMIT of 200,000 GRAIL, which is about double the current supply of ~92,789. It can also raise emissionRate up to MAX_EMISSION_RATE, 0.01 GRAIL per second (about 864 GRAIL per day). Live values: elasticMaxSupply is 100,000 and emissionRate is 168209876542469 wei/s (about 0.000168 GRAIL/s). Exploit path: the Safe calls updateMaxSupply(200000e18) and updateEmissionRate(0.01e18). Supply then grows at the maximum rate until the cap, diluting holders. This cannot be done in a single instant mint: emissions accrue per second and both values are hard-capped. No timelock is visible in this contract.

  Evidence

  • codeGrailTokenV2.sol:L19-L20
    Show source

    uint256 public constant MAX_EMISSION_RATE = 0.01 ether;
      uint256 public constant MAX_SUPPLY_LIMIT = 200000 ether;

  • codeGrailTokenV2.sol:L241-L249
    Show source

    function updateEmissionRate(uint256 emissionRate_) external onlyOwner {
        require(emissionRate_ <= MAX_EMISSION_RATE, "updateEmissionRate: can't exceed maximum");
    
        // apply emissions before changes
        emitAllocations();
    
        emit UpdateEmissionRate(emissionRate, emissionRate_);
        emissionRate = emissionRate_;
      }

  • codeGrailTokenV2.sol:L256-L262
    Show source

    function updateMaxSupply(uint256 maxSupply_) external onlyOwner {
        require(maxSupply_ >= totalSupply(), "updateMaxSupply: can't be lower than current circulating supply");
        require(maxSupply_ <= MAX_SUPPLY_LIMIT, "updateMaxSupply: invalid maxSupply");
    
        emit UpdateMaxSupply(elasticMaxSupply, maxSupply_);
        elasticMaxSupply = maxSupply_;
      }

  • codeGrailTokenV2.sol:L113-L152
    Show source

    function emitAllocations() public {
        uint256 circulatingSupply = totalSupply();
        uint256 currentBlockTimestamp = _currentBlockTimestamp();
    
        uint256 _lastEmissionTime = lastEmissionTime; // gas saving
        uint256 _maxSupply = elasticMaxSupply; // gas saving
    
        // if already up to date or not started
        if (currentBlockTimestamp <= _lastEmissionTime || _lastEmissionTime == 0) {
          return;
        }
    
        // if max supply is already reached or emissions deactivated
        if (_maxSupply <= circulatingSupply || emissionRate == 0) {
          lastEmissionTime = currentBlockTimestamp;

  • on-chainelasticMaxSupply = 100000000000000000000000; emissionRate = 168209876542469; totalSupply = 92789169998965049816428

  Confirmed by: claude-opus-5.5

• MediumMultisig can send all newly minted GRAIL to any addressfeesAI

  The owner can change treasuryAddress to any non-zero address at any time with updateTreasuryAddress. It can also set the farming and legacy allocations to 0 with updateAllocations, so 100% of new emissions go to that treasury. Live state already shows treasuryAllocation = 100 and farmingAllocation = 0: every newly minted GRAIL goes to the treasury Safe 0x03fF…97AB. Combined with the bounded emission powers, the multisig decides who receives all newly minted supply. This does not touch existing holder balances.

  Evidence

  • codeGrailTokenV2.sol:L221-L234
    Show source

    function updateAllocations(uint256 farmingAllocation_, uint256 legacyAllocation_) external onlyOwner {
        // apply emissions before changes
        emitAllocations();
    
        // total sum of allocations can't be > 100%
        uint256 totalAllocationsSet = farmingAllocation_.add(legacyAllocation_);
        require(totalAllocationsSet <= 100, "updateAllocations: total allocation is too high");
    
        // set new allocations
        farmingAllocation = farmingAllocation_;
        legacyAllocation = legacyAllocation_;
    
        emit UpdateAllocations(farmingAllocation_, legacyAllocation_, treasuryAllocation());
      }

  • codeGrailTokenV2.sol:L269-L274
    Show source

    function updateTreasuryAddress(address treasuryAddress_) external onlyOwner {
        require(treasuryAddress_ != address(0), "updateTreasuryAddress: invalid address");
    
        emit UpdateTreasuryAddress(treasuryAddress, treasuryAddress_);
        treasuryAddress = treasuryAddress_;
      }

  • on-chaintreasuryAllocation = 100; farmingAllocation = 0; treasuryAddress = 0x03fF2d78AFB69e0859Ec6bEB4CF107D3741e97AB

  Confirmed by: claude-opus-5.5

• MediumTeam-linked wallets and Safes hold a large share of supplyinsidersAI

  Seven wallets funded by the deployer 0x01bb…db9d hold about 19.96% of supply. Several Gnosis Safes are among the top holders, including the treasury Safe (10.39%) and the owner Safe (6.89%). The top-10 share is 76%, although it includes the xGRAIL contract (21%), a FrontierDeposit contract (12.2%) and the burn address. Coordinated selling by these team or treasury wallets could heavily pressure the price, especially given the thin DEX liquidity.

  Evidence

  • on-chaininsiders fundedBy 0x01bb7b44cc398aaa2b76ac6253f0f5634279db9d pctSupplyHeldNow 19.9579
  • on-chaintop10Pct = 76.051; 0x03fF2d78AFB69e0859Ec6bEB4CF107D3741e97AB GnosisSafeProxy 10.3867%; 0x8B797D42D4B2C330575e18F7C793fE4383086807 GnosisSafeProxy 6.8866%

  Confirmed by: claude-opus-5.5

• MediumVery little DEX liquidity, so sells may face heavy slippageliquidityAI

  The pools found hold only small dollar amounts: Camelot v2 about $1,457, two Camelot v3 pools about $899 and $436, and a Uniswap v3 pool about $227. The v2 LP is neither burned nor locked, and ownership of the v3 positions was not analysed. With this little liquidity, even modest sells cause large slippage. Liquidity providers can also withdraw at any time, so exiting a position on-chain could be costly. Other venues may exist that were not captured.

  Evidence

  • on-chainliquidity: camelot-v2 0x87425D8812f44726091831a9A109f4bDc3eA34b4 liquidityUsd 1457 lpBurnedPct 0 lpLockedPct 0
  • on-chaincamelot-v3 0x60451B6aC55E3C5F0f3aeE31519670EcC62DC28f liquidityUsd 899; camelot-v3 0x8cc8093218bCaC8B1896A1EED4D925F6F6aB289F liquidityUsd 436; uniswap-v3 0x7244BCf6226077c393B7c98c0CeC6C8C3cE9427e liquidityUsd 227

  Confirmed by: claude-opus-5.5

Positive signals (3)

• PositiveNo transfer tax, blacklist or pause, and contract not upgradeablehoneypotAI

  GRAIL uses the unmodified OpenZeppelin ERC20 transfer logic. There is no fee, blacklist, whitelist, max-transaction limit or trading switch, and the _beforeTokenTransfer hook is not overridden. Nobody, owner included, can block or tax sells or move holder balances. The contract is not a proxy, so its logic cannot be upgraded. The fork simulation was skipped, so this rests on code review only.

  Evidence

  • codeERC20.sol:L208-L217
    Show source

    function _transfer(address sender, address recipient, uint256 amount) internal virtual {
            require(sender != address(0), "ERC20: transfer from the zero address");
            require(recipient != address(0), "ERC20: transfer to the zero address");
    
            _beforeTokenTransfer(sender, recipient, amount);
    
            _balances[sender] = _balances[sender].sub(amount, "ERC20: transfer amount exceeds balance");
            _balances[recipient] = _balances[recipient].add(amount);
            emit Transfer(sender, recipient, amount);
        }

  • codeERC20.sol:L305
    Show source

    function _beforeTokenTransfer(address from, address to, uint256 amount) internal virtual { }

  • on-chainisProxy = false

  Confirmed by: claude-opus-5.5

• PositiveOwner is a multisig that needs 3 signaturesownershipAI

  owner() is the Gnosis Safe L2 at 0x8B79…6807 with threshold 3. Every owner action therefore needs at least three signers, which reduces single-key risk. The number of signers and any enabled Safe modules (which could bypass signatures) were not reported. The master (rewards) address is set once and cannot be changed afterwards.

  Evidence

  • on-chainowner = 0x8B797D42D4B2C330575e18F7C793fE4383086807; GnosisSafeL2 param getThreshold = 3
  • codeGrailTokenV2.sol:L194-L200
    Show source

    function initializeMasterAddress(address masterAddress_) external onlyOwner {
        require(masterAddress == address(0), "initializeMasterAddress: master already initialized");
        require(masterAddress_ != address(0), "initializeMasterAddress: master initialized to zero address");
    
        masterAddress = masterAddress_;
        emit InitializeMasterAddress(masterAddress_);
      }

  Confirmed by: claude-opus-5.5

• PositiveOfficial Camelot docs confirm this is the real GRAIL tokenwebsiteAI

  The address matches the GRAIL token published on Camelot's official Arbitrum docs, so this is the DEX's established governance token, not an unknown copy. Docs describe Camelot as an Arbitrum DEX that has been operating since 2022. That identity match is a trust signal; it does not by itself say the owner cannot change protocol parameters.

  Evidence

  • webhttps://docs.camelot.exchange/contracts/arbitrum/one-mainnet/
    Show source

    GRAIL
    0x3d9907F9a368ad0a51Be60f7Da3b97cf940982D8

  • webhttps://docs.camelot.exchange/
    Show source

    Starting in 2022 and entirely bootstrapped by the Arbitrum community, Camelot has become the largest native DEX

  Confirmed by: grok-4.7

Notes (2)

• InfoCamelot's X account publicly rebranded to verified @frontierlaunchsocialAI

  @camelotdex (created 27 Sep 2022) now has only 83 followers and tells users to follow @frontierlaunch. That Frontier account is verified, has about 68,849 followers, and its bio says it was previously @camelotdex. This looks like a public rebrand, not a hidden team. Docs still link to x.com/CamelotDEX, so the old handle is the one the docs name.

  Evidence

  • webhttps://x.com/camelotdex
    Show source

    You can now find us on @frontierlaunch

  • webhttps://docs.camelot.exchange/
    Show source

    https://x.com/CamelotDEX

  Confirmed by: grok-4.7

• InfoPosts with the contract address are bot spam, not real warningssocialAI

  Several near-identical posts paste this contract and claim a PackScan or Backpack 'SELL' call with a large drop. They have zero likes and thank @Backpack. Treat them as promotional spam, not independent evidence that holders cannot sell or that the team rugged. Separate OmniRisk posts score GRAIL risk at 89/100 and also 42/100 while saying liquidity health is strong; those are bot scores, not confirmed by the facts given here.

  Evidence

  • Xhttps://x.com/VaishnavaRajesh/status/2117140993657168201
    Show source

    Nobody listened when $GRAIL r⁠ead SELL at $821k. -49%.
    
    0x3d9907F9a368ad0a51Be60f7Da3b97cf940982D8
    Thаnk you @Backpack for the new ecosystem.

  • Xhttps://x.com/omniriskio/status/2059214077663052115
    Show source

    GRAIL on Arbitrum scores 89/100 risk on OmniRisk. Signals: 25 recent risk alerts; Liquidity health is strong.

  Confirmed by: grok-4.7