PonsV2LauncherToken $ORBIX

Risks (7)

• HighLaunch sniped: 50 wallets took 78.5% of supply in 10 secondssnipersDeterministic

  The launch was captured: 50 wallets bought 78.5% of the supply within 10 seconds. A small, fast group set the early price and could sell into everyone who bought later — bad for launch fairness and a strong insider/bot signal. They now hold 0% of supply, so current dump pressure from them is low — most of it was already sold, i.e. they exited on later buyers.

  Evidence

  • on-chainsnipers: windowBlocks=100, wallets=50, pctSupplyBought=78.497, pctSupplyHeldNow=0
  • on-chainsnipers: windowBlocks 100, pctSupplyBought 78.497, pctSupplyHeldNow 0
  • on-chainbundles[block 95426098] commonFunder 0xcdd37ada79f589c15bd4f8fd2083dc88e34a2af2 pctSupply 4.7695
  • on-chainclusters: funder 0xa5a5491bca93dd4c076e4906e79e7673f4a5a142 wallets 4, pctSupplyHeldNow 0

  Confirmed by: facts, claude-opus-5.5, gpt-5.6-sol

• MediumCreator-declared wallets bought 20% of supply at launchinsidersDeterministic

  4 wallet(s) linked to the team (declared by the creator at launch, exempt from the snipe tax) bought 20% of the supply in the first blocks — an insider allocation that real buyers did not get. They now hold 1.54%, so current dump pressure from them is low; most of it has already been sold.

  Evidence

  • on-chaininsiders: 4 wallets, fundedBy declared by creator at launch (snipe-tax exempt on curve; creator 0x7087628171e7a67244f28677873c12caeb6a1718), bought at launch 20%, pctSupplyHeldNow 1.5418
  • on-chainbundles[block 95426048]: wallets 0x8c695456e8dbea07fde5dcb5d668a2d218b1be13, 0x5fe15fb338ead852488401586d0a22ee93f538c9, pctSupply 19.9999
  • on-chaininsiders: fundedBy declared by creator at launch (snipe-tax exempt on curve), pctSupplyHeldNow 1.5418
  • on-chaininsiders: 0xa47df43e10563f207fed08a1ff58e7761c9176f6 fundedBy 0x7087628171e7a67244f28677873c12caeb6a1718, pctSupplyHeldNow 0.7724
  • on-chainsnipers.pctSupplyHeldNow = 0

  Confirmed by: facts, claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumUser top-ups go to a plain team wallet, not a contractwebsiteAI

  Anyone who tops up ORBIX is sending money straight to a published wallet, not a deposit contract. The same wallet also receives trading fees and pays providers. Whoever controls that wallet can move user balances before they are spent, and the site itself says you are trusting ORBIX with that credit.

  Evidence

  • webhttps://useorbix.app/docs/project/risks
    Show source

    There is no deposit contract. Top-ups are plain transfers to the ORBIX treasury wallet, which also pays upstream providers. You are trusting ORBIX with prepaid credit until it is spent.

  • webhttps://useorbix.app/docs/token/treasury
    Show source

    One public wallet receives the Pons creator fees in ETH, takes top-ups and pays for inference. There is no smart contract in between

  Confirmed by: grok-4.7, gpt-5.6-sol

• MediumTeam can switch which token contract earns holder discountsclaims-mismatchAI

  Holding this token is supposed to set your inference discount. The docs say the contract used for that check is just a setting and can be replaced (for example a test token for a final one) without redeploying or moving user balances. The team can point discounts at a different contract while buyers still hold this one.

  Evidence

  • webhttps://useorbix.app/docs/token/treasury
    Show source

    The $ORBIX contract used for tier checks is configuration: it can be switched, for example from a test token to the final one, without moving balances or redeploying anything.

  Confirmed by: grok-4.7

• LowA few unlabelled wallets hold 3–7% of supply eachholdersAI

  Excluding the pool, locker and infrastructure, the largest holders are an EOA with 7.19% and an unlabelled contract with 7.00%. Several more unlabelled contracts each hold 3–4%. There are only 248 holders. A few wallets could still move the price sharply. Fresh wallets hold 5.61%.

  Evidence

  • on-chainTop holders (excl. pools/curve/burn/infra/launchpad): 0x9065fc5462efe63a394aa13de190d39e465c8ee3 7.1892%, 0xcbe08c93da3d5e256276fc09dd4236647ab4fc51 [contract] 7.0034%
  • on-chainholdersCount 248; freshWalletsPct 5.6064

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• LowOne Pons admin controls the hook, factory, vault and lockerownershipAI

  Address 0x263e…19Dd owns the hook, factory, buyback vault and locker. Its powers relevant to ORBIX are limited: - rescuePoolFees: pays this pool's pending fees directly to the recipients recorded at registration, not to an arbitrary address. - Changing the fee sweep operator. - Overriding the creator fee recipient through the factory (3-day timelock constant shown). - Factory rescue functions (rescueCurveFees, rescueSweptGraduation), whose source was omitted. The owner cannot change this pool's fee rates or block swaps. The hook and vault forbid renouncing ownership. It is not known whether this owner is an EOA or a multisig.

  Evidence

  • codePonsV2MemeHook.sol:L555-L603
    Show source

    function rescuePoolFees(PoolId poolId)
            external
            onlyOwner
            nonReentrant
            returns (uint256 protocolAmount, uint256 creatorAmount)
        {
            LaunchInfo memory info = launches[poolId];
            if (!info.registered) revert UnknownPool();
            address quoteToken = info.quoteToken;
    
            if (quoteToken != address(0)) {
                (protocolAmount, creatorAmount) = _rescueCurrency(poolId, info, quoteToken);
            }
            (uint256 memecoinProtocol, uint256 memecoinCreator) = _rescueCurrency(poolId, info, info.memecoin);
            if (protocolAmount == 0 && creatorAmount == 0 && memecoinProtocol == 0 && memecoinCreator == 0) {

  • codePonsV2MemeHook.sol:L235-L237
    Show source

    function renounceOwnership() public pure override {
            revert OwnershipCannotBeRenounced();
        }

  • on-chainfactory param CREATOR_FEE_RECIPIENT_TIMELOCK = 259200
  • on-chainfactory fn rescueSweptGraduation(address,address) [owner] — sends tokens out, sends ETH

  Confirmed by: claude-opus-5.5 · Disputed by: gpt-5.6-sol

• Low'Keeps 0% of fees' claim conflicts with 1.2% creator taxclaims-mismatchAI

  The zero-retention statement conflicts with the bonding curve allocating a 1.2% creator tax to a creator-controlled recipient and allowing the deployer to sweep those fees; the factory can also redirect the creator-fee recipient. The separate claim of zero margin on inference remains unverified because no marketplace accounting was supplied.

  Evidence

  • webhttps://useorbix.app/
    Show source

    ORBIX keeps of fees, margin on inference, from sellers 0%

  • on-chainPonsV2BondingCurve creatorTaxBps = 120 (1.2%)
    Show source

    creatorTaxBps: 120 (1.2%)

  • on-chainPonsV2BondingCurve deployer = 0xa469E1DA83AaB613e13DA88c74F8Ec7CF7811a3f
    Show source

    settableBy: setCreatorFeeRecipient(address) [factory [msg.sender == factory]]

  • on-chainPonsV2BondingCurve privilegedFunctions
    Show source

    sweepFees(uint256) [not isOperator && msg.sender == deployer] risk=low

  • codePonsV2LaunchFactory.sol:L946
    Show source

    function setCreatorFeeRecipient(address token, address newRecipient) external onlyOwner {

  Confirmed by: gpt-5.6-sol, grok-4.7 · Disputed by: claude-opus-5.5

Positive signals (3)

• PositiveStandard Pons token with no owner powers and fixed supplyownershipAI

  ORBIX is the standard PonsV2LauncherToken: plain OpenZeppelin ERC20 plus voluntary burn. The whole fixed supply was minted once, to the bonding curve, in the constructor. There is no owner, mint, fee, blacklist, pause or transfer restriction. The stored deployer address is metadata only and gives no control. Slither reported no issues.

  Evidence

  • codePonsV2LauncherToken.sol:L21-L71
    Show source

    contract PonsV2LauncherToken is ERC20, ERC20Burnable {
        struct Socials {
            string twitter;
            string telegram;
            string discord;
            string website;
            string farcaster;
        }
    
        error ZeroAddress();
    
        address public immutable deployer;
        address public immutable launchFactory;
        address public immutable curve;

  • codeERC20.sol:L176-L204
    Show source

    function _update(address from, address to, uint256 value) internal virtual {
            if (from == address(0)) {
                // Overflow check required: The rest of the code assumes that totalSupply never overflows
                _totalSupply += value;
            } else {
                uint256 fromBalance = _balances[from];
                if (fromBalance < value) {
                    revert ERC20InsufficientBalance(from, fromBalance, value);
                }
                unchecked {
                    // Overflow not possible: value <= fromBalance <= totalSupply.
                    _balances[from] = fromBalance - value;
                }
            }

  • on-chaincontract.privileges = [] ; static.issues = []

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• PositiveBuy, sell and transfer all work with 0% token taxhoneypotAI

  A real buy and sell on the graduated Uniswap v4 pool both returned the expected amounts. A second wallet that received tokens by transfer could also sell, and selling still worked one hour later. The token itself charges no tax. Pool and hook fees are already included in the quotes.

  Evidence

  • forksimulation: canBuy=true, canSell=true, buyTaxPct=0, sellTaxPct=0
    Show source

    second wallet (received via transfer) could sell

  • forksimulation notes
    Show source

    sell after +1h: ok

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveMain pool liquidity is locked in the Pons lockerliquidityAI

  The main ORBIX/ETH v4 pool, about $25,350 of liquidity, is reported 100% locked and 0% held by the deployer. The LP locker contract also holds 8.16% of token supply. The locker's source code was not provided, so its unlock terms could not be checked.

  Evidence

  • on-chainliquidity pool 0x80fe223cfe48490b183778aff1508919c91420bb2d2c76480e3b445b8d263953: lpLockedPct=100, lpHeldByDeployerPct=0, liquidityUsd=25350
  • on-chaintopHolders: 0x267444D099b10fB5Ed7c3Cc7B7c767AdcA574952 (LP locker) 8.1632%

  Confirmed by: claude-opus-5.5, grok-4.7 · Disputed by: gpt-5.6-sol

Notes (3)

• InfoPool hook takes a 2.2% swap fee, frozen for this poolfeesAI

  The PonsV2MemeHook takes a cut of every swap through its afterSwap callback: the hook fee (1% at launch) plus the creator tax (1.2%). Fee terms are copied into this pool's record when the pool is registered. afterSwap reads only that stored copy (info.hookFeeBps, info.creatorTaxBps). The hook owner's setters (hookFeeBps up to 10%, protocol share up to 50%) therefore only affect future launches, not ORBIX. Registration also caps creator tax plus hook fee at 20%. The hook's permission bits allow only beforeInitialize, afterSwap and afterSwapReturnDelta. There is no beforeSwap, and nothing in afterSwap blocks sellers, so the hook cannot be used as a honeypot.

  Evidence

  • codePonsV2MemeHook.sol:L444-L485
    Show source

    function _afterSwap(address, PoolKey calldata key, SwapParams calldata params, BalanceDelta delta, bytes calldata)
            internal
            override
            returns (bytes4, int128)
        {
            // The conversion and buyback legs swap against this same pool, but
            // they are never taxed here: v4-core skips a pool's hooks when the
            // hook itself is the caller (Hooks.afterSwap). Were that not so, the
            // skim would come out of the buyback before it reached the vault.
            PoolId poolId = key.toId();
            LaunchInfo memory info = launches[poolId];
            if (!info.registered) return (IHooks.afterSwap.selector, 0);
            if (info.hookFeeBps == 0 && info.creatorTaxBps == 0) return (IHooks.afterSwap.selector, 0);
    
            bool specifiedIsCurrency0 = (params.amountSpecified < 0) == params.zeroForOne;

  • codePonsV2MemeHook.sol:L337-L378
    Show source

    // Terms frozen here govern the pool for life, so each is held to the
            // same ceiling as the setter that produced it. protocolFeeShareBps
            // against BASIS_POINTS rather than MAX_PROTOCOL_FEE_SHARE_BPS would
            // let a pool be registered on terms the live policy could never
            // reach, paying the creator nothing.
            if (
                policy.protocolFeeRecipient == address(0) || policy.protocolFeeShareBps > MAX_PROTOCOL_FEE_SHARE_BPS
                    || policy.buybackBurnBps > BASIS_POINTS || policy.hookFeeBps > MAX_HOOK_FEE_BPS
                    || policy.maxInternalPriceImpactBps == 0 || policy.maxInternalPriceImpactBps >= BASIS_POINTS
            ) {
                revert InvalidBps();
            }
            // The curve bounds the same sum in its own constructor rather than
            // inheriting it from the factory. A pool taking more than the whole
            // unspecified leg would flip the swapper's output delta negative.

  • codePonsV2MemeHook.sol:L184-L201
    Show source

    function getHookPermissions() public pure override returns (Hooks.Permissions memory) {
            return Hooks.Permissions({
                beforeInitialize: true,
                afterInitialize: false,
                beforeAddLiquidity: false,
                afterAddLiquidity: false,
                beforeRemoveLiquidity: false,
                afterRemoveLiquidity: false,
                beforeSwap: false,
                afterSwap: true,
                beforeDonate: false,
                afterDonate: false,
                beforeSwapReturnDelta: false,
                afterSwapReturnDelta: true,
                afterAddLiquidityReturnDelta: false,

  • on-chainhook permissions (from address bits) = beforeInitialize, afterSwap, afterSwapReturnDelta

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• InfoWebsite domain registered one day before launchwebsiteAI

  The useorbix.app domain was created on 2026-10-21, and the token was deployed on 2026-10-22. The dApp test of the buy flow timed out without making any transaction. It only requested a gasless SIWE login signature, which grants no permissions, so nothing harmful was observed. The sell flow was not tested.

  Evidence

  • on-chainsite.domainCreatedAt 2026-10-21T22:30:02.902Z; contract.deployedAt 2026-10-22T21:33:22.000Z
  • forkdappTests: buy (open a position) — personal_sign (SIWE login)
    Show source

    This costs no gas and grants no permissions.

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• InfoBytejury partnership confirmed by both new accountssocialAI

  ORBIX announced a credit partnership with @bytejury, and that account posted the same partnership about two minutes earlier. It is not an unreciprocated name-drop. The partner account itself is only two days old and also lists its own token CA, so this is a new-project cross-promo, not proof of a long track record.

  Evidence

  • Xhttps://x.com/useorbix/status/2118224523996569826
    Show source

    We’re partnering with @bytejury to supply AI credits for their cybersecurity agents, with payments on Robinhood Chain.

  • Xhttps://x.com/bytejury/status/2118224115114946574
    Show source

    We’ve partnered with @useorbix to purchase affordable AI credits for our cybersecurity agents, with payments on Robinhood Chain.

  Confirmed by: grok-4.7 · Disputed by: gpt-5.6-sol