L2ArbitrumToken $ARB

Risks (3)

• HighDump risk: launch wallets still hold 25.6% of supplyholdersDeterministic

  Sniper / insider / bundled launch wallets still hold about 25.6% of the supply. If they sell, the price can collapse — current dump pressure is HIGH.

  Evidence

  • on-chainheld now: snipers 0%, insiders 25.56%, clusters 4.17%
  • on-chaintopHolders[0] 0xF3FC178157fb3c87548bAA86F9d24BA38E649B58 pct 25.5614 TransparentUpgradeableProxy
  • on-chaininsiders fundedBy 0x2b9acfd85440b7828db8e54694ee07b2b056b30c pctSupplyHeldNow 25.5614
  • on-chainclusters funder 0x47d43ac7eea761c4959b2a4318e620603be7fd4f pctSupplyHeldNow 4.1676
  • codeL2GovernanceFactory.sol:L315-L320
    Show source

    // the actual treasury
            FixedDelegateErc20Wallet arbTreasury = deployTreasury(params._proxyAdmin, treasuryLogic);
            address excludeAddress = treasuryGov.EXCLUDE_ADDRESS();
            // since all actions from the treasury governor are executed through the timelock
            // the timelock is the owner of the treasury
            arbTreasury.initialize(address(params._l2Token), excludeAddress, address(treasuryTimelock));

  Confirmed by: facts, claude-opus-5.5

• MediumOwner (0xCF57572261c7c2BCF21ffD220ea7d1a27D40A827) can mint up to a capmintDeterministic

  mint(address,uint256) (owner (0xCF57…A827)): Can mint new tokens (inflate supply / dump); mints supply; capped by constants MINT_CAP_DENOMINATOR=10000, MINT_CAP_NUMERATOR=200, MIN_MINT_INTERVAL=31536000

  Evidence

  • codeL2ArbitrumToken.sol:L117
    Show source

    function mint(address recipient, uint256 amount) external onlyOwner {

  • staticprivilege mint(address,uint256) restricted to owner (0xCF57572261c7c2BCF21ffD220ea7d1a27D40A827)
    Show source

    Can mint new tokens (inflate supply / dump); mints supply; capped by constants MINT_CAP_DENOMINATOR=10000, MINT_CAP_NUMERATOR=200, MIN_MINT_INTERVAL=31536000

  • codeL2ArbitrumToken.sol:L117-L127
    Show source

    function mint(address recipient, uint256 amount) external onlyOwner {
            // function inspired by: https://github.com/ensdomains/governance/blob/548f3f3607c83717427d9ae3fc1f3a9e66fc7642/contracts/ENSToken.sol#L105
            require(
                amount <= (totalSupply() * MINT_CAP_NUMERATOR) / MINT_CAP_DENOMINATOR,
                "ARB: MINT_TOO_MUCH"
            );
            require(block.timestamp >= nextMint, "ARB: MINT_TOO_EARLY");
    
            nextMint = block.timestamp + MIN_MINT_INTERVAL;
            _mint(recipient, amount);
        }

  • codeL2ArbitrumToken.sol:L36-L40
    Show source

    uint256 public constant MIN_MINT_INTERVAL = 365 days;
        /// @notice The maximum amount that can be can be minted - numerator
        uint256 public constant MINT_CAP_NUMERATOR = 200;
        /// @notice The maximum amount that can be can be minted - denominator
        uint256 public constant MINT_CAP_DENOMINATOR = 10_000;

  • on-chainnextMint = 1710504508; owner = 0xCF57572261c7c2BCF21ffD220ea7d1a27D40A827

  Confirmed by: facts, claude-opus-5.5

• MediumContract is upgradeableproxy-upgradeDeterministic

  The contract logic can be replaced by its proxy admin (a contract — check if it is a timelock/multisig).

  Evidence

  • on-chaintransparent proxy; implementation 0xd47D14a315394ddf063174f2286Ab4Eb7C507fa0; admin 0xdb216562328215E010F819B5aBe947bad4ca961e
  • on-chainproxyType=transparent, proxyAdmin=0xdb216562328215E010F819B5aBe947bad4ca961e, implementation=0xd47D14a315394ddf063174f2286Ab4Eb7C507fa0
  • on-chainProxyAdmin 0xdb216562328215E010F819B5aBe947bad4ca961e owner = 0xCF57572261c7c2BCF21ffD220ea7d1a27D40A827
  • codeProxyAdmin.sol:L62-L80
    Show source

    function upgrade(TransparentUpgradeableProxy proxy, address implementation) public virtual onlyOwner {
            proxy.upgradeTo(implementation);
        }
    
        /**
         * @dev Upgrades `proxy` to `implementation` and calls a function on the new implementation. See
         * {TransparentUpgradeableProxy-upgradeToAndCall}.
         *
         * Requirements:
         *
         * - This contract must be the admin of `proxy`.
         */
        function upgradeAndCall(
            TransparentUpgradeableProxy proxy,
            address implementation,

  • codeUpgradeExecutor.sol:L57-L85
    Show source

    function execute(address upgrade, bytes memory upgradeCallData)
            public
            payable
            onlyRole(EXECUTOR_ROLE)
            nonReentrant
        {
            // OZ Address library check if the address is a contract and bubble up inner revert reason
            address(upgrade).functionDelegateCall(
                upgradeCallData, "UpgradeExecutor: inner delegate call failed without reason"
            );
    
            emit UpgradeExecuted(upgrade, msg.value, upgradeCallData);
        }
    
        /// @notice Execute an upgrade by directly calling target contract

  • codeL2GovernanceFactory.sol:L266-L276
    Show source

    function deployStep3(address _aliasedL1Timelock) public onlyOwner {
            require(step == Step.Three, "L2GovernanceFactory: not step three");
            // now that we have all the addresses we can grant roles to them on the upgrade executor
            UpgradeExecutor exec = UpgradeExecutor(upExecutor);
            exec.grantRole(exec.EXECUTOR_ROLE(), l2EmergencySecurityCouncil);
            exec.grantRole(exec.EXECUTOR_ROLE(), _aliasedL1Timelock);
    
            exec.grantRole(exec.ADMIN_ROLE(), upExecutor);
            exec.revokeRole(exec.ADMIN_ROLE(), address(this));
            step = Step.Complete;
        }

  • on-chainL2GovernanceFactory param l2EmergencySecurityCouncil = 0x3568A44b3E72F5B17a0E14E53fdB7366B3B7Ad13

  Confirmed by: facts, claude-opus-5.5

Positive signals (4)

• PositiveBuy, sell and transfer work with 0% tax in simulationhoneypotAI

  A fork simulation on Uniswap v4 bought and sold the token at the expected amounts with 0% buy, sell and transfer tax. A second wallet that received tokens by transfer could sell, and a sell after 1 hour also worked. The token code has no fee, blacklist, pause or max-transaction logic. Transfers are standard OpenZeppelin ERC20 plus vote checkpointing.

  Evidence

  • forkcanBuy=true, canSell=true, buyTaxPct=0, sellTaxPct=0, transferTaxPct=0
  • forksecond wallet (received via transfer) could sell
  • codeERC20Upgradeable.sol:L231-L251
    Show source

    function _transfer(
            address from,
            address to,
            uint256 amount
        ) internal virtual {
            require(from != address(0), "ERC20: transfer from the zero address");
            require(to != address(0), "ERC20: transfer to the zero address");
    
            _beforeTokenTransfer(from, to, amount);
    
            uint256 fromBalance = _balances[from];
            require(fromBalance >= amount, "ERC20: transfer amount exceeds balance");
            unchecked {
                _balances[from] = fromBalance - amount;
            }

  • codeL2ArbitrumToken.sol:L175-L181
    Show source

    function _afterTokenTransfer(address from, address to, uint256 amount)
            internal
            override(ERC20Upgradeable, ERC20VotesUpgradeable)
        {
            super._afterTokenTransfer(from, to, amount);
            _updateDelegationHistory(delegates(from), delegates(to), amount);
        }

  Confirmed by: claude-opus-5.5

• PositiveDeployer factory is renounced; control sits with governanceownershipAI

  The L2GovernanceFactory that created the token has owner 0x0000…dEaD and step = 2 (Complete), so it can no longer act. During setup the factory gave ProxyAdmin ownership to the UpgradeExecutor and handed the executor's ADMIN_ROLE to the executor itself. Token ownership was moved from the deployer 0x2B9A…B30C to the UpgradeExecutor. The deployer holds 0% now.

  Evidence

  • on-chainL2GovernanceFactory owner = 0x000000000000000000000000000000000000dEaD; step = 2
  • codeL2GovernanceFactory.sol:L249
    Show source

    dc.proxyAdmin.transferOwnership(address(dc.executor));

  • codeL2GovernanceFactory.sol:L273-L274
    Show source

    exec.grantRole(exec.ADMIN_ROLE(), upExecutor);
            exec.revokeRole(exec.ADMIN_ROLE(), address(this));

  • tx0x1ec93779…078f090d
  • on-chainDeployer 0x2b9acfd85440b7828db8e54694ee07b2b056b30c holds 0% now

  Confirmed by: claude-opus-5.5

• PositiveExplorer and Arbitrum Foundation confirm this is official ARBwebsiteAI

  Arbiscan labels this contract the official Arbitrum governance token and links arbitrum.foundation. The foundation site describes the Arbitrum Foundation as governing Arbitrum technology and links the verified @arbitrum account (created 2020, about 1.14M followers). This matches the long-lived L2 governance token, not a new meme launch.

  Evidence

  • webhttps://arbiscan.io/token/0x912ce59144191c1204e64559fe8253a0e49e6548
    Show source

    This is the official Arbitrum token based on the . Arbitrum DAO Governance documentation

  • webhttps://arbitrum.foundation/
    Show source

    The Arbitrum Foundation empowers the development and governance of Arbitrum technology

  Confirmed by: grok-4.7

• PositiveOfficial @arbitrum X account is verified and dates to 2020socialAI

  The project X account linked from the explorer and foundation site is @arbitrum. It was created in November 2020, is verified, and has about 1.14 million followers. That is consistent with a long-running L2 project, not a bought or newly spun-up shill account.

  Evidence

  • webhttps://arbiscan.io/token/0x912ce59144191c1204e64559fe8253a0e49e6548

  Confirmed by: grok-4.7

Notes (3)

• InfoPublic initialize() is locked and cannot be reusedotherAI

  Static analysis lists initialize() as callable by anyone and notes that it writes _owner. The function uses OpenZeppelin's initializer modifier, so it can run only once. The implementation contract calls _disableInitializers() in its constructor. The proxy was initialized by the factory during deployStep1. Nobody can re-run it to take ownership or mint the initial supply again.

  Evidence

  • codeL2ArbitrumToken.sol:L54-L65
    Show source

    constructor() {
            _disableInitializers();
        }
    
        /// @notice Initialise the L2 token
        /// @param _l1TokenAddress The address of the counterparty L1 token
        /// @param _initialSupply The amount of initial supply to mint
        /// @param _owner The owner of this contract - controls minting, not upgradeability
        function initialize(address _l1TokenAddress, uint256 _initialSupply, address _owner)
            public
            initializer
        {

  • codeInitializable.sol:L78-L93
    Show source

    modifier initializer() {
            bool isTopLevelCall = !_initializing;
            require(
                (isTopLevelCall && _initialized < 1) || (!AddressUpgradeable.isContract(address(this)) && _initialized == 1),
                "Initializable: contract is already initialized"
            );
            _initialized = 1;
            if (isTopLevelCall) {
                _initializing = true;
            }
            _;
            if (isTopLevelCall) {
                _initializing = false;
                emit Initialized(1);
            }

  • codeL2GovernanceFactory.sol:L189-L192
    Show source

    dc.token = deployToken(dc.proxyAdmin, l2TokenLogic);
            dc.token.initialize(
                params._l1Token, params._l2TokenInitialSupply, params._l2InitialSupplyRecipient
            );

  Confirmed by: claude-opus-5.5

• InfoOwner can adjust delegation total used only for quorumotherAI

  adjustTotalDelegation() and postUpgradeInit() let the owner (the UpgradeExecutor) set the recorded total delegated votes. The code comments say this number is only used for governance quorum calculation. It does not touch balances or transfers.

  Evidence

  • codeL2ArbitrumToken.sol:L88-L112
    Show source

    function postUpgradeInit(uint256 initialTotalDelegation) external onlyOwner {
            require(
                _totalDelegationHistory._checkpoints.length == 0,
                "ARB: POST_UPGRADE_INIT_ALREADY_CALLED"
            );
            _totalDelegationHistory.push(initialTotalDelegation);
        }
    
        /// @notice Adjusts total delegation value by the given amount
        /// @param  adjustment The amount that the total delegation is off by, negated. This is added to the current total delegation.
        function adjustTotalDelegation(int256 adjustment)
            external
            onlyOwner
        {
            uint256 latest = _totalDelegationHistory.latest();

  Confirmed by: claude-opus-5.5

• InfoPosts with the contract address are unrelated promo botssocialAI

  Recent posts that paste this contract address are low-engagement PackScan/@Backpack style posts claiming past price calls. They are not project announcements and do not allege a rug of this token. A search for $ARB plus scam/rug/honeypot returned unrelated posts, not credible accusations against this contract.

  Evidence

  • Xhttps://x.com/SquishyOmar9000/status/2117652878110409133

  Confirmed by: grok-4.7