PonsV2LauncherToken $TT

Risks (9)

• HighOne funder's 12 wallets bundled 19.6% of supplysnipersDeterministic

  12 wallets funded by the same address 0x6505…40dc bought 19.6% of the supply together (blocks 104430699, 104430925). Spreading one buyer over many wallets hides how much a single entity controls.

  Evidence

  • on-chainbundles with commonFunder 0x65050a9b7e5075a2ba5ced7b1b64ee66262c40dc: 12 wallets, pctSupply 19.62

  Confirmed by: facts

• HighCreator-declared wallets bought 27% of supply at launchinsidersDeterministic

  4 wallet(s) linked to the team (declared by the creator at launch, exempt from the snipe tax) bought 27% of the supply in the first blocks — an insider allocation that real buyers did not get. They now hold 0.57%, so current dump pressure from them is low; most of it has already been sold.

  Evidence

  • on-chaininsiders: 4 wallets, fundedBy declared by creator at launch (snipe-tax exempt on curve; creator 0x21e4460bd83384758decd090d04c87af295d208b), bought at launch 27%, pctSupplyHeldNow 0.5748
  • on-chainbundles: block 104430663 wallets [0x5d782ba51b176c8d6e103eb5a550d22eab031095, 0x51d6dff3ae54d2b0a1a77aaebe2e577acfc8699f] pctSupply 27
  • on-chaininsiders: fundedBy 'declared by creator at launch (snipe-tax exempt on curve...)' pctSupplyHeldNow 0.5748
  • on-chaininsiders: 0xe056c2e9d6ef6adcce649fcb57d7003e5f57a174 fundedBy 0x21e4460bd83384758decd090d04c87af295d208b pctSupplyHeldNow 0.749

  Confirmed by: facts, claude-opus-5.5, grok-4.7, gpt-5.6-sol

• HighLaunch sniped: 40 wallets took 90.1% of supply in 11 secondssnipersDeterministic

  The launch was captured: 40 wallets bought 90.1% of the supply within 11 seconds. A small, fast group set the early price and could sell into everyone who bought later — bad for launch fairness and a strong insider/bot signal. They now hold 0.2% of supply, so current dump pressure from them is low — most of it was already sold, i.e. they exited on later buyers.

  Evidence

  • on-chainsnipers: windowBlocks=100, wallets=40, pctSupplyBought=90.0524, pctSupplyHeldNow=0.2015
  • on-chainsnipers: pctSupplyBought 90.0524, pctSupplyHeldNow 0.2015
  • on-chaintoken.top10Pct = 25.2971; holdersCount = 201

  Confirmed by: facts, claude-opus-5.5, grok-4.7

• MediumOwner can switch the fee buy-and-burn from TT to another tokenhidden-functionAI

  The project's FeeBurner (0xe73C…734F) collects protocol fees, buys TT with them and sends it to the dead address. This is the buy pressure the project advertises. Its owner (0xbaE0…989B) can call setBurnToken(anyToken) at any moment, with no timelock and no limit on how often. From then on all fees buy and burn a different token, and TT loses that support. Only the owner-allowlisted keeper can run the swap-and-burn. A second, unverified burner (0x477D…80C6) with the same owner exposes the same setBurnToken function.

  Evidence

  • codeFeeBurner.sol:L64-L72
    Show source

    /// @notice Name the project token, or change it to another one, as often as the owner wants. The pool(s) the new token trades
        /// in must be allowlisted on the adapter. Whatever is left of an earlier token here can still be burned with `burnHeldToken`.
        function setBurnToken(address token) external onlyOwner {
            if (token == address(0) || token.code.length == 0) revert NotAToken();
            if (token == address(burnToken)) revert SameToken();
            burnToken = IERC20(token);
            wasBurnToken[token] = true;
            emit BurnTokenSet(token);
        }

  • codeFeeBurner.sol:L88-L89
    Show source

    function burn(address feeToken, uint256 amount, uint256 minOut, bytes calldata data) external nonReentrant returns (uint256 burned) {
            if (!isBurner[msg.sender]) revert NotBurner();

  • on-chainFeeBurner param burnToken = 0x7Ab225FCC0231deb5381a1bAb854A4F951E3F83A (settable by setBurnToken(address) [owner])
  • webhttps://runtenet.app/
    Show source

    Burned
    30%
    of the protocol fee
    Buys the token and sends it to a dead address.

  • codeFeeSplitter.sol:L23
    Show source

    uint16 public burnBps;

  • codeFeeSplitter.sol:L39
    Show source

    function setBurnBps(uint16 bps) external onlyOwner {

  • codeFeeBurner.sol:L35
    Show source

    IERC20 public burnToken;

  • codeFeeBurner.sol:L66
    Show source

    function setBurnToken(address token) external onlyOwner {

  • codeFeeBurner.sol:L28
    Show source

    address public constant DEAD = 0x000000000000000000000000000000000000dEaD;

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumOwner can cut the burn share to 0% and withdraw fees from rewardsclaims-mismatchAI

  Each FeeSplitter sends burnBps of fees to the burner and the rest to a rewards (AuthorPayouts) contract. The owner (0xbaE0…989B) can set burnBps anywhere from 0% to 100% (currently 30%). The same owner can call AuthorPayouts.withdraw(token, amount, to), which per the function table sends tokens out to any address. It can also pause payouts. Exploit path: set burnBps to 0, so 100% of fees go to AuthorPayouts, then withdraw them to any wallet. That would contradict the docs, which say fees 'only leave by being burned or paid to authors'. The AuthorPayouts and FeeSplitter sources were omitted, so whether withdraw has extra restrictions could not be verified.

  Evidence

  • on-chainFeeSplitter 0x75B141dABF640935c44702A3A433DAbf1F699065 param burnBps = 3000 (settable by setBurnBps(uint16) [owner], bounds bps <= MAX_BPS=10000)
  • on-chainAuthorPayouts 0x941b4b2AaeC44c0B14C1f9A6C8F8bF7e225c252a fn withdraw(address,uint256,address) [owner] — sends tokens out @AuthorPayouts.sol:L135-L139
  • on-chainAuthorPayouts fn setPaused(bool) [owner] @AuthorPayouts.sol:L120-L124
  • webhttps://runtenet.app/docs/security
    Show source

    take collected fees (they only leave by being burned or paid to authors)

  • webhttps://runtenet.app/
    Show source

    Authors
    70%
    Paid every hour to everyone who has an agent on sale.

  • codeFeeSplitter.sol:L23
    Show source

    uint16 public burnBps;

  • codeAuthorPayouts.sol:L57
    Show source

    uint16 public payoutBps = 1_000;

  • codeAuthorPayouts.sol:L59
    Show source

    uint64 public minInterval = 55 minutes;

  • codeAuthorPayouts.sol:L120
    Show source

    function setPaused(bool value) external onlyOwner {

  • codeAuthorPayouts.sol:L135
    Show source

    function withdraw(address token, uint256 amount, address to) external onlyOwner nonReentrant {

  • webhttps://runtenet.app/docs/contracts
    Show source

    Holds the authors' share (as ETH) and every hour pays 10% of it, in ETH,, split equally... The owner can pause, change the share and withdraw.

  • webhttps://runtenet.app/docs/fees-token
    Show source

    The owner can the payouts, change the share, and at any time. Only the owner can.

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumUnverified vault and hub contracts hold user funds and can change feesotherAI

  User deposits go into per-user Vault clones of an unverified implementation (0x89dF…64ae). Its function table flags execute(uint256,bytes) as critical and also lists setPaused. The vaults are created by an unverified hub (0xA69C…0C11), owned by 0xbaE0…989B, which exposes setFees, setFeed, setOperator and setAdapter. Because the code is unverified, we cannot confirm who may call execute (agent/operator?) or whether an operator or adapter change could move vault funds. On the positive side, the dApp test deposited 0.01 ETH and withdrew 100% of it.

  Evidence

  • on-chainVault implementation 0x89dF467404A00CA7e67Db481b78186d5559e64ae verified=false; fn execute(uint256,bytes) risk=critical @decompiled.sol:L416
  • on-chainregistry 0xA69C6D0832473B06fe461Ed29acEcE16342B0C11 verified=false; fn setFees(uint16,uint16,address), setOperator(address,bool), setFeed(address,address,uint32)
  • forkdappTests withdraw: passed=true
    Show source

    returned 0.01 ETH of 0.01 ETH deposited (100%)

  • webhttps://runtenet.app/
    Show source

    The agent earns 0.1% of the trade, the protocol 0.1%, and 30% of the protocol's share is burned.

  • on-chainregistry 0xA69C6D0832473B06fe461Ed29acEcE16342B0C11: setFees(uint16,uint16,address) [selector 0xdfb6385f] — Can change fees / taxes / fee split
  • on-chainregistry 0xA69C6D0832473B06fe461Ed29acEcE16342B0C11 owner = 0xbaE0DA132c9834e8FaEf67Ed94E85BD6F30F989B

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• LowHook owner picks who converts pool fees and sets their slippagefeesAI

  Accrued pool fees are converted and swept against the pool by feeSweepOperator. The hook owner (0x263e…19Dd) appoints this operator. The operator chooses the minimum outputs, which only need to be non-zero. A malicious operator could pass tiny minimums and sandwich these conversions, losing part of the fee pot owed to the creator and protocol. Each internal swap is capped at the pool's frozen 3% price-impact bound. Holder balances are not directly affected. Ownership of the hook cannot be renounced.

  Evidence

  • codePonsV2MemeHook.sol:L274-L278
    Show source

    function setFeeSweepOperator(address operator) external onlyOwner {
            if (operator == address(0)) revert ZeroAddress();
            feeSweepOperator = operator;
            emit FeeSweepOperatorUpdated(operator);
        }

  • codePonsV2MemeHook.sol:L500-L511
    Show source

    function sweepPoolFees(PoolId poolId, uint256 minConversionQuoteOut, uint256 minBuybackTokensOut)
            external
            nonReentrant
        {
            LaunchInfo memory info = launches[poolId];
            if (!info.registered) revert UnknownPool();
            bool isOperator = msg.sender == feeSweepOperator;
            if (!isOperator && msg.sender != info.creator) revert NotFeeSweepOperator();
            if (!isOperator && _requiresTrustedOperator(poolId, info)) revert InternalSwapRequiresOperator();
    
            (uint256 convertedFeeQuote, uint256 convertedTaxQuote, uint256 convertedBuybackQuote, bool converted) =
                _convertPendingMemecoin(poolId, info, minConversionQuoteOut);

  • codePonsV2MemeHook.sol:L235-L237
    Show source

    function renounceOwnership() public pure override {
            revert OwnershipCannotBeRenounced();
        }

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• LowKeeper registry owner can change the stake token and ban keepersotherAI

  KeeperRegistry (0xb66b…D108) currently uses TT as the stake token. The owner can switch it with setStakeToken, change minStake with no bound, and ban addresses. Withdrawals have a 7-day unstake delay. totalStaked is currently 0, so no funds are exposed today. The source was omitted, so we could not verify whether a ban blocks withdrawal.

  Evidence

  • on-chainKeeperRegistry param stakeToken = 0x7Ab225FCC0231deb5381a1bAb854A4F951E3F83A (settable by setStakeToken(address) [owner]); totalStaked = 0; UNSTAKE_DELAY = 604800

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• LowX post understates trading fees and overstates the burnclaims-mismatchAI

  A pinned-style utility post says every agent trade pays 0.1% and that 30% of that fee is burned. The project's own docs say there are two 0.1% fees (agent and protocol), each capped at 0.5%, and that only 30% of the protocol fee is burned. A holder reading only the post would understate the cost and overstate the burn. This is a marketing mismatch, not an on-chain proof of a hidden tax.

  Evidence

  • Xhttps://x.com/runtenet/status/2117712300505506150
    Show source

    Fees. Every agent trade pays 0.1%. 30% of that is burned, 70% goes to the authors’ pool.

  • webhttps://runtenet.app/docs/fees-token
    Show source

    The protocol's 0.1% is split automatically by a contract... 30% The burner... Each fee is capped by the contract at 0.5%.

  • webhttps://runtenet.app/
    Show source

    The agent earns 0.1% of the trade, the protocol 0.1%, and 30% of the protocol's share is burned.

  Confirmed by: grok-4.7, gpt-5.6-sol

Positive signals (4)

• PositiveToken is a fixed-supply template with no admin powersotherAI

  PonsV2LauncherToken is plain OpenZeppelin ERC20 plus ERC20Burnable. The whole supply (1,000,000,000 TT) was minted once, to the bonding curve, in the constructor. There is no owner, no mint function, no fee, no blacklist, no pause and no upgrade path. deployer, launchFactory and curve are immutable labels that give no control over the token. burnFrom only works with the holder's own approval. Slither reported no issues. Nobody can change how TT itself transfers.

  Evidence

  • codePonsV2LauncherToken.sol:L21-L71
    Show source

    contract PonsV2LauncherToken is ERC20, ERC20Burnable {
        struct Socials {
            string twitter;
            string telegram;
            string discord;
            string website;
            string farcaster;
        }
    
        error ZeroAddress();
    
        address public immutable deployer;
        address public immutable launchFactory;
        address public immutable curve;

  • codeERC20Burnable.sol:L35-L38
    Show source

    function burnFrom(address account, uint256 value) public virtual {
            _spendAllowance(account, _msgSender(), value);
            _burn(account, value);
        }

  • staticslither 0.11.6: issues = []
  • on-chaincontract.isProxy = false; privileges = []

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveSimulated buys, sells and transfers all work at 0% token taxhoneypotAI

  A real buy and sell were simulated on the graduated Uniswap v4 pool. Both filled at the expected amounts, with 0% token-level tax. A second wallet that received tokens by transfer could also sell, and a sell one hour later worked. There is no sell block or hidden tax in the token. The pool's frozen 2.45% hook fee is included in the quotes (see the separate finding).

  Evidence

  • forksimulation: canBuy=true, canSell=true, buyTaxPct=0, sellTaxPct=0, transferTaxPct=0
  • forksimulation notes
    Show source

    second wallet (received via transfer) could sell

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveMain pool liquidity is 100% locked in the Pons lockerliquidityAI

  The graduated Uniswap v4 pool (about $12.8k of liquidity) has 100% of its LP locked. The deployer holds 0% of it, and the locker is wired into the factory as an immutable address. Three other v4 pools exist with only $2–$5 of unlocked liquidity each; they are irrelevant to price. The lock end date is not in the material.

  Evidence

  • on-chainliquidity pool 0xc39369cd5de175e036a6250964ce0ca071410ba50ebd9c77e5506962c718b948: lpLockedPct=100, lpHeldByDeployerPct=0, liquidityUsd=12759
  • on-chainPonsV2LaunchFactory param locker = 0x267444D099b10fB5Ed7c3Cc7B7c767AdcA574952 (immutable)

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveTeam claimed its FOMO dev profile and moved dev tokens theresocialAI

  The project posted that its FOMO team tag is live and that it moved dev-held TT to its FOMO wallet and locked some supply. In this ecosystem a verified FOMO dev profile and moving dev tokens there is a transparency step, not a dump by itself. The FOMO page we opened did not show badge or wallet text, and the lock link could not be fetched, so the lock and the badge are not independently confirmed here.

  Evidence

  • Xhttps://x.com/runtenet/status/2117722169954463803
    Show source

    Team Tag is live! Big thanks to @fomo for helping us get it sorted.

  • Xhttps://x.com/runtenet/status/2117392949441069243
    Show source

    We’ve moved the dev-held $TT supply to our FOMO wallet as part of claiming our team profile. We also locked a portion of the supply

  • webhttps://fomo.family/profile/runtenet?r=runtenet
    Show source

    Follow @runtenet's trades and portfolio on fomo, the social crypto trading app.

  Confirmed by: grok-4.7, claude-opus-5.5, gpt-5.6-sol

Notes (1)

• InfoPool's 2.45% swap fee is frozen; hook owner cannot raise itfeesAI

  Every swap in the graduated pool pays the hook fee (1%) plus the creator tax (1.45%), taken in afterSwap. Both rates are copied into the pool's own launches[poolId] record at registration, and afterSwap reads only that record. The hook owner's setters (setHookFeeBps up to 10%, setProtocolFeeShareBps up to 50%, setMaxInternalPriceImpactBps, setProtocolFeeRecipient) change only the global policy used by FUTURE launches, not this pool. Registration also caps creatorTax + hookFee at 20%. The previous scan's claim that the hook owner can raise this pool's fee to 10% does not hold against the code.

  Evidence

  • codePonsV2MemeHook.sol:L444-L485
    Show source

    function _afterSwap(address, PoolKey calldata key, SwapParams calldata params, BalanceDelta delta, bytes calldata)
            internal
            override
            returns (bytes4, int128)
        {
            // The conversion and buyback legs swap against this same pool, but
            // they are never taxed here: v4-core skips a pool's hooks when the
            // hook itself is the caller (Hooks.afterSwap). Were that not so, the
            // skim would come out of the buyback before it reached the vault.
            PoolId poolId = key.toId();
            LaunchInfo memory info = launches[poolId];
            if (!info.registered) return (IHooks.afterSwap.selector, 0);
            if (info.hookFeeBps == 0 && info.creatorTaxBps == 0) return (IHooks.afterSwap.selector, 0);
    
            bool specifiedIsCurrency0 = (params.amountSpecified < 0) == params.zeroForOne;

  • codePonsV2MemeHook.sol:L364-L378
    Show source

    launches[poolId] = LaunchInfo({
                registered: true,
                memecoinIsCurrency0: memecoinIsCurrency0,
                memecoin: memecoin,
                quoteToken: quoteToken,
                creator: creator,
                buybackCreatorRecipient: buybackCreatorRecipient,
                protocolFeeRecipient: policy.protocolFeeRecipient,
                creatorTaxBps: creatorTaxBps,
                protocolFeeShareBps: policy.protocolFeeShareBps,
                buybackBurnBps: policy.buybackBurnBps,
                hookFeeBps: policy.hookFeeBps,
                maxInternalPriceImpactBps: policy.maxInternalPriceImpactBps,
                buybackEnabled: buybackEnabled
            });

  • codePonsV2MemeHook.sol:L251-L255
    Show source

    function setHookFeeBps(uint256 bps) external onlyOwner {
            if (bps > MAX_HOOK_FEE_BPS) revert InvalidBps();
            hookFeeBps = bps;
            emit HookFeeBpsUpdated(bps);
        }

  • codePonsV2MemeHook.sol:L352
    Show source

    if (uint256(creatorTaxBps) + policy.hookFeeBps > MAX_TOTAL_TRADE_FEE_BPS) revert InvalidBps();

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol