FoboToken $FLORA

Risks (4)

• HighClaim contradicted: All generated fees are automatically used for token buybacks and 100% burned.claims-mismatchDeterministic

  The project claims ongoing burns, but only 8 burns at launch were seen (4.3% of supply, last 2026-11-06).

  Evidence

  • Xhttps://x.com/floradotmeme/status/2118462771557777561
    Show source

    All generated fees are automatically used for buybacks and burn everything.

  • on-chainTransfer events of 0x7bae7a90c7328969614b3efbee8c4a9026befea8 to burn addresses + balanceOf(0x…dEaD)
  • Xhttps://x.com/floradotmeme/status/2118433064430776331
    Show source

    all fees generated by $FLORA will be used for buybacks and 100% of tokens will be burned. Starting from today.

  • webhttps://flora.meme/
    Show source

    Of that 2.5%, 1.5% goes straight to the floor, 0.6% to the creator and 0.4% to the protocol.

  Confirmed by: facts, grok-4.7, gpt-5.6-sol

• HighLaunch sniped: 2 wallets took 104.6% of supply in 10 secondssnipersDeterministic

  The launch was captured: 2 wallets bought 104.6% of the supply within 10 seconds. A small, fast group set the early price and could sell into everyone who bought later — bad for launch fairness and a strong insider/bot signal. They now hold 0% of supply, so current dump pressure from them is low — most of it was already sold, i.e. they exited on later buyers.

  Evidence

  • on-chainsnipers: windowBlocks=100, wallets=2, pctSupplyBought=104.607, pctSupplyHeldNow=0

  Confirmed by: facts

• MediumPool hook charges a swap tax whose code was not reviewedfeesAI

  Every trade in the main FLORA pool goes through FoboHook. The hook has beforeSwap/afterSwap 'ReturnDelta' permissions, which let it take part of each swap. Its own comments say it 'Charges a tax on the quote leg of every swap'. During the snipe window, 60% of that tax goes to floor money (vesting) and 40% to a $FOBO buy-and-burn. The tax code (HookTax) and the payout code (HookClaims) were not provided. So the actual rate, any cap, and how the split between creator, team, revenue and floor works cannot be checked here. The permission bits are fixed by the hook address and the hook shows no owner or setter, so the tax logic most likely cannot be raised later. That is not verified. In the simulation, putting 0.02 ETH in and selling half the tokens back returned about 0.0095 ETH, which is consistent with a moderate round-trip cost (tax plus price impact) and not a trap.

  Evidence

  • codeFoboHook.sol:L22-L27
    Show source

    /// @notice Owns every FOBO pool's liquidity. Charges a tax on the quote leg of every swap (no LP fee), and keeps a
    ///         single-tick wall of quote under the price that can buy back every circulating token. The wall moves up
    ///         whenever it can and never moves down. Floor money the wall can't use under the price buys back and burns
    ///         tokens instead, lifting the price to what the tokens are backed by, so it never sits idle for a pumper to
    ///         harvest. Both run once per block, before that block's first swap, on the state the block started with.
    ///         The snipe window's tax is 60% floor money (vesting) and 40% for a buy-and-burn of $FOBO (FoboBurner).

  • codeFoboHook.sol:L54-L70
    Show source

    function _permissions() internal pure override returns (Hooks.Permissions memory) {
            return Hooks.Permissions({
                beforeInitialize: true,
                afterInitialize: false,
                beforeAddLiquidity: true,
                afterAddLiquidity: false,
                beforeRemoveLiquidity: false,
                afterRemoveLiquidity: false,
                beforeSwap: true,
                afterSwap: true,
                beforeDonate: true,
                afterDonate: false,
                beforeSwapReturnDelta: true,
                afterSwapReturnDelta: true,
                afterAddLiquidityReturnDelta: false,

  • on-chainuniswap-v4 0xf9572b36d7… hook permissions
    Show source

    v4 hook can take a cut of / rewrite swaps (returns-delta)

  • forksimulation buy/sell notes
    Show source

    sell: 27402456950637516147689 token-wei → 9513123877767050 quote-wei (expected 9513123877767050)

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• LowLaunchpad owner can change the team payout addressownershipAI

  FoboFactory is owned by 0xf3c4…aF88. This owner can: - pause new launches; - set the launch fee, with no upper limit; - lower or raise the creator dev-buy cap, never above 5%; - change the start-price signer and price bands; - allow or disallow quote tokens; - change the 'team' address that receives team payouts. The hook can be set only once and is already set, so the owner cannot swap in a different hook for existing pools. None of these powers can change FLORA's token code or block trading in its live pool. The main remaining trust point is setTeam, which redirects where the team's share of fees goes. That affects the platform, not holders' balances.

  Evidence

  • codeFoboFactory.sol:L379-L393
    Show source

    function setLaunchFee(uint256 fee) external onlyOwner {
            launchFeeEth = fee;
            emit ConfigChanged("launchFeeEth", fee);
        }
    
        function setTeam(address _team) external onlyOwner {
            if (_team == address(0)) revert ZeroAddress();
            team = _team;
            emit ConfigChanged("team", uint256(uint160(_team)));
        }
    
        function setLaunchesPaused(bool paused) external onlyOwner {
            launchesPaused = paused;
            emit ConfigChanged("launchesPaused", paused ? 1 : 0);
        }

  • codeFoboFactory.sol:L284-L288
    Show source

    function setHook(IFoboHook _hook) external onlyOwner {
            if (address(hook) != address(0)) revert HookSet();
            if (address(_hook) == address(0)) revert ZeroAddress();
            if (_hook.factory() != address(this)) revert BadHook();
            hook = _hook;

  • codeFoboFactory.sol:L92
    Show source

    // team balances (and $FOBO's creator share) are paid to `team` by a permissionless claim: never zero

  • on-chainFoboFactory owner = 0xf3c47512BFF9B8F38952945714d2d4eAa025aF88

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

Positive signals (5)

• PositiveBuyback & burn verified on-chain: 4.3% of supply burnedburnDeterministic

  4.3% of the supply ever minted is burned, in 8 burn transfer(s), last 2026-11-06. Burned by: contract FoboHook 0x0af5…28ec (4.0%, 1 burn, 1 buyback); the deployer 0xe0c2…8ee6 (0.31%, 7 burns). Burned tokens are gone for good, which reduces the supply over time.

  Evidence

  • on-chainTransfer events to 0x0 / 0x…dEaD and balanceOf(burn addresses) of 0x7bae7a90c7328969614b3efbee8c4a9026befea8
  • on-chaintoken.burns: burnedPct 4.3034, by hook 0x0af57f62982d03066ef917acad87f771c06528ec pct 3.9972 (buyback 1), deployer pct 0.3061
  • codeFoboHook.sol:L24-L25
    Show source

    ///         whenever it can and never moves down. Floor money the wall can't use under the price buys back and burns
    ///         tokens instead, lifting the price to what the tokens are backed by, so it never sits idle for a pumper to

  Confirmed by: facts, claude-opus-5.5, grok-4.7

• PositiveToken is a fixed-supply ERC-20 with no owner powersownershipAI

  FLORA (FoboToken) is an unmodified OpenZeppelin ERC-20 plus ERC20Burnable. The full 1,000,000,000 supply is minted once in the constructor, to the factory that deploys it. The token has no owner, no further minting, no fees, no blacklist, no pause and no proxy. The only extra functions are burn and burnFrom, and burnFrom needs the holder's own allowance. Nobody can change how the token itself behaves.

  Evidence

  • codeFoboToken.sol:L74-L85
    Show source

    contract FoboToken is ERC20, ERC20Burnable, IFoboToken {
        uint256 public constant TOTAL_SUPPLY = 1_000_000_000e18;
    
        constructor(string memory name_, string memory symbol_) ERC20(name_, symbol_) {
            _mint(msg.sender, TOTAL_SUPPLY);
        }
    
        /// @dev OpenZeppelin's burn unchanged. Solidity requires this override because both ERC20Burnable and IFoboToken
        ///      declare burn.
        function burn(uint256 amount) public override(ERC20Burnable, IFoboToken) {
            super.burn(amount);
        }

  • codeERC20Burnable.sol:L35-L38
    Show source

    function burnFrom(address account, uint256 value) public virtual {
            _spendAllowance(account, _msgSender(), value);
            _burn(account, value);
        }

  • on-chaincontract.isProxy = false; privileges = []; static.issues = []

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveBuy and sell both work in simulation with 0% token taxhoneypotAI

  On a fork, a real buy and sell through the Uniswap v4 pool both went through and returned exactly the quoted amounts. A second wallet that received tokens by transfer could also sell, and a sell one hour later worked. The token itself charges 0% on buys, sells and transfers. The pool's hook does take its own swap tax on the ETH/quote side, which is already included in the quoted amounts (see the separate hook-tax finding).

  Evidence

  • forksimulation: canBuy=true, canSell=true, buyTaxPct=0, sellTaxPct=0, transferTaxPct=0
    Show source

    second wallet (received via transfer) could sell

  • forksell after +1h
    Show source

    sell after +1h: ok

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveHolders spread out; deployer holds and sold nothingholdersAI

  Excluding the pool, no wallet holds more than about 1.5%. The top 10 together hold 10.475%. The deployer/creator 0xe0c2…8Ee6 holds 0%, has sold 0%, and has burned about 0.31%. Two early 'sniper' addresses are the hook itself and another address, and they hold 0% now. One funding cluster of two wallets holds 1.2852%. No bundles were detected.

  Evidence

  • on-chaintoken.top10Pct = 10.475; holdersCount = 303
  • on-chainDeployer 0xe0c289493a9741a2f346914d7347d1b32e7a8ee6 holds 0% now
  • on-chainsnipers.pctSupplyHeldNow = 0; clusters funder 0xf70da97812cb96acdf810712aa562db8dfa3dbef pctSupplyHeldNow 1.2852

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveSite warns the price floor is not a profit guaranteewebsiteAI

  The site warns that the floor is only the lowest price the protocol will pay, that price can fall to that floor, and that buying above it can lose the difference. It also says a launch tax starts at 90% and falls to 2.5% in the first 60 seconds, and that none of that launch tax goes to the creator. These are disclosures, not hidden claims.

  Evidence

  • webhttps://flora.meme/
    Show source

    No. The floor is the lowest price the protocol will pay, not a promise of profit. If you buy above the floor and the price drops, you can lose the difference.

  • webhttps://flora.meme/
    Show source

    In the first 60 seconds the launch tax falls from 90% to 2.5%, and none of that launch tax goes to the creator.

  Confirmed by: grok-4.7, gpt-5.6-sol

Notes (3)

• LowAll pool liquidity is owned by the hook, not by a walletliquidityAI

  100% of the main pool's liquidity (about $60k) belongs to the FoboHook contract. It was added directly, not as a transferable LP NFT. The hook does not enable beforeRemoveLiquidity. It refuses liquidity from anyone else. Its key addresses (factory, poolManager, burner, revenue, limitOrders) are immutable, and the provided code shows no owner and no withdraw-liquidity function. The factory's comments say the owner 'can't touch live pools'. The facts layer lists this liquidity as 0% locked/burned only because it is hook-owned, not because a person holds it. However, the hook's claim and floor modules (HookClaims, HookFloor, HookStorage) were not provided. A hidden withdrawal path there cannot be fully ruled out.

  Evidence

  • on-chainuniswap-v4 0xf9572b36d7…: v4 position liquidity holders
    Show source

    0x0af57f62982d03066ef917acad87f771c06528ec [other: v4 hook contract FoboHook (the hook controls this liquidity)] 100%

  • codeFoboHook.sol:L51-L53
    Show source

    /// @dev Swaps (the tax and the raise) plus three callbacks enabled only to refuse them: pools the hook didn't create,
        ///      third-party liquidity (it would sit outside the floor invariant) and donations (fees the rebuild would then
        ///      have to settle). The hook's own calls skip its callbacks.

  • codeFoboFactory.sol:L29
    Show source

    ///         ticker: EIP-712), checked against the pair's start band. The owner can't touch live pools. Spec: packages/contracts/README.md.

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• LowWebsite domain registered on launch day; marketing page onlywebsiteAI

  flora.meme was registered on 2026-11-05, the same day the token launched, and has no archive history. It is a marketing page only and offers no wallet connection, so the dApp buy/sell tests could not run there; trading happens on fobo.fun. The site links a Coinsult audit PDF that was not checked here.

  Evidence

  • on-chainsite.domainCreatedAt = 2026-11-05T00:03:40.440Z; waybackSnapshots = []
  • forkdappTests: buy (open a position)
    Show source

    flora.meme is a static marketing landing page with no wallet connection or trading interface

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• InfoAnonymous mascot X account created the same day as the tokensocialAI

  @floradotmeme was created on 2026-11-05, about 40 minutes before the token was deployed, and flora.meme was registered the same day. The account has 223 followers and is not verified; posts are mostly floor and burn hype. That fits a brand-new mascot launch, not a renamed old account, but there is no public identity behind the mascot account to hold to the fee promises.

  Evidence

  • Xhttps://x.com/floradotmeme/status/2118348355046871392
    Show source

    RT @fobodotfun: We have an official mascot! Everybody, meet Flora

  • webhttps://flora.meme/
    Show source

    Flora ($FLORA) is the official mascot coin of fobo.fun

  Confirmed by: grok-4.7 · Disputed by: gpt-5.6-sol