PonsV2LauncherToken $ASSAY

Risks (6)

• HighOne funder's 18 wallets bundled 60.3% of supplysnipersDeterministic

  18 wallets funded by the same address 0x88d2…51d3 bought 60.3% of the supply together (block 98642380). Spreading one buyer over many wallets hides how much a single entity controls.

  Evidence

  • on-chainbundles with commonFunder 0x88d25c861938a91af4ad57ad964a8fcc6c6351d3: 18 wallets, pctSupply 60.27

  Confirmed by: facts

• HighCreator-declared wallets bought 60.3% of supply at launchinsidersDeterministic

  18 wallet(s) linked to the team (declared by the creator at launch, exempt from the snipe tax) bought 60.3% of the supply in the first blocks — an insider allocation that real buyers did not get. They now hold 4.51%, so current dump pressure from them is low; most of it has already been sold.

  Evidence

  • on-chaininsiders: 18 wallets, fundedBy declared by creator at launch (snipe-tax exempt on curve; creator 0x00fbb06ac74db9ee8d38bb4278ffda0117bfdc64), bought at launch 60.27%, pctSupplyHeldNow 4.5114
  • on-chaintoken.bundles[block 98642380]: commonFunder 0x88d25c861938a91af4ad57ad964a8fcc6c6351d3, pctSupply 60.265
  • on-chaintoken.insiders: declared by creator at launch (snipe-tax exempt on curve; creator 0x00fbb06ac74db9ee8d38bb4278ffda0117bfdc64), pctSupplyHeldNow 4.5114
  • on-chaintoken.insiders: fundedBy 0x00fbb06ac74db9ee8d38bb4278ffda0117bfdc64, pctSupplyHeldNow 0.5803
  • on-chaincurve params: snipeTaxStartBps = 9900, snipeTaxSeconds = 3

  Confirmed by: facts, claude-opus-5.5, gpt-5.6-sol

• MediumTwo unidentified upgradeable proxies hold about 19.4% of supplyholdersAI

  The two largest non-infrastructure holders are ERC1967 proxy contracts: - 0x5167…65C4 holds 9.9999%. - 0xcF8a…8Dd6 holds 9.4146%. They may be project contracts, such as the staking product the website describes, but their code, admins and release rules are not in the material. Whoever controls their upgrade admin could move these tokens and sell them into the pool, which has about $59k of liquidity. The deployer also holds 4.51%.

  Evidence

  • on-chaintopHolders: 0x5167C8818eF75EBc45dd96217B36A6929b2765C4 9.9999% ERC1967Proxy; 0xcF8a103183F3bB84Cf4f43Ee9Dd6c0D173EB8Dd6 9.4146% ERC1967Proxy
  • on-chainDeployer 0x00fbb06ac74db9ee8d38bb4278ffda0117bfdc64 holds 4.5114% now

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumWebsite says token is not live, but it is already tradingclaims-mismatchAI

  The official site still tells visitors that $ASSAY has not launched on Pons and that official links come only from goassay.ai. The token under review is already a PonsV2LauncherToken (deployed 2026-10-26), and the project's verified X account posts that same contract address. Someone who trusts the site could treat the circulating token as unofficial, or buy a lookalike while the real one is already live. This is a stale or contradicted launch claim, not proof the contract can drain wallets.

  Evidence

  • webhttps://goassay.ai/
    Show source

    $ASSAY will launch on Pons
    Not live yet. Official links only via goassay.ai

  • on-chaintarget = 0xa2b38467e9b60c016d94977ad37f825da4cd3462; name = PonsV2LauncherToken; deployedAt = 2026-10-26T19:00:53.000Z
    Show source

    PonsV2LauncherToken symbol ASSAY deployed 2026-10-26

  • Xhttps://x.com/goassay/status/2117940425193644288
    Show source

    RT @winiam4444: @goassay - $ASSAY - $220K

  Confirmed by: grok-4.7, gpt-5.6-sol

• LowUnlocked secondary pool (~$28k) can be withdrawn by its ownerliquidityAI

  Pool 0x390743061b… (about $28,109) is outside the Pons locker. All of its position liquidity belongs to 0x7b5d…0cc5, which is not identified. That owner could withdraw this liquidity at any time. It does not affect the locked main pool, but traders using that pool rely on its owner.

  Evidence

  • on-chainliquidity pool 0x390743061b205154b6cf786cc14299f807a2a846fe6c359d45aa4671779dbd15: liquidityUsd 28109, lpLockedPct 0
  • on-chainuniswap-v4 0x390743061b…: v4 position liquidity other holders: 0x7b5de3d5e1bc40735a253076d920343c13510cc5 100%

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• LowWebsite says testnet-only while X posts claim mainnet usageclaims-mismatchAI

  The website says Assay currently runs on Robinhood Chain testnet and Solana devnet. The same project's X account posts that paid agent calls are live on Robinhood Chain and reposts a claim of mainnet API volume. Product-status claims do not match, so revenue and usage numbers on social posts should not be taken as confirmed by the site.

  Evidence

  • webhttps://goassay.ai/
    Show source

    Assay runs on Robinhood Chain testnet and Solana devnet today.

  • Xhttps://x.com/goassay/status/2117315414447489535
    Show source

    2,000+ paid calls by AI agents on Assay. 🟡
    
    Agents pay for tools on their own, and every payment sits in escrow until the result checks out. Live on Robinhood Chain.

  • Xhttps://x.com/goassay/status/2117708879454986475
    Show source

    RT @bruceintech: Probing is on testnet
    
    2,500+ API calls made through @goassay so far on Mainnet

  Confirmed by: grok-4.7, gpt-5.6-sol

Positive signals (4)

• PositiveToken has fixed supply and no owner powersownershipAI

  ASSAY is the standard Pons V2 launch token: OpenZeppelin ERC20 plus the voluntary burn extension. The whole 1,000,000,000 supply was minted once, to the bonding curve, in the constructor. There is no owner, no mint function, no fee, no blacklist, no pause and no transfer hook. The stored 'deployer' value is only a label and gives no privileges. Nobody can change the token's own rules after deployment.

  Evidence

  • codePonsV2LauncherToken.sol:L44-L71
    Show source

    constructor(
            string memory name_,
            string memory symbol_,
            string memory logo_,
            string memory description_,
            Socials memory socials_,
            address deployer_,
            address curve_,
            address launchFactory_,
            uint256 supply_
        ) ERC20(name_, symbol_) {
            if (deployer_ == address(0) || curve_ == address(0) || launchFactory_ == address(0)) {
                revert ZeroAddress();
            }

  • codePonsV2LauncherToken.sol:L7-L20
    Show source

    /**
     * @title PonsV2LauncherToken
     * @notice Fixed-supply ERC-20 deployed by PonsV2LaunchFactory for a v2 launch.
     * The entire supply mints directly to the token's bonding curve instead of a
     * Uniswap position. Anyone, the deployer included, may buy any amount from
     * the curve at any time; the curve's own price impact and its reserved pool
     * allocation are the only limits on a large buy. `deployer` is carried here
     * as immutable reference data for off-chain attribution only, and confers no
     * privileges over the token.
     * `ERC20Burnable` lets any holder voluntarily burn their own balance; the
     * protocol's buyback mechanism does not use it, bought-back tokens are
     * locked into `PonsV2BuybackVault` for a five-year vest instead of being
     * burned.
     */

  • on-chaincontract.privileges = [] ; isProxy=false ; slither issues = []

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• PositiveFork test: buy, sell and transfer-then-sell work at 0% token taxhoneypotAI

  On a fork, the test bought and sold through the graduated Uniswap v4 pool. A second wallet that received tokens by transfer could also sell, and a sell one hour later worked. The token itself charged 0% on buys, sells and transfers. The pool's swap fee is already inside the quoted amounts.

  Evidence

  • forksimulation: canBuy=true, canSell=true, buyTaxPct=0, sellTaxPct=0, transferTaxPct=0
    Show source

    second wallet (received via transfer) could sell

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveMain pool liquidity locked in Pons locker; hook cannot block swapsliquidityAI

  For the graduated pool 0x617b…, the facts show 100% of LP locked and 0% held by the deployer. The LP locker's function table only has factory-only lock functions and owner wiring; no withdraw or unlock function is listed. The hook's address permissions are only beforeInitialize, afterSwap and afterSwapReturnDelta. There is no beforeSwap and no remove-liquidity callback, so the hook cannot stop a swap before it runs or lock LPs. The hook is not a proxy.

  Evidence

  • on-chainliquidity pool 0x617b079d8ba5c12a65f2ae9fffeba86d3912b6084212ab6080a390822af00949: lpLockedPct=100, lpHeldByDeployerPct=0
  • codePonsV2MemeHook.sol:L184-L201
    Show source

    function getHookPermissions() public pure override returns (Hooks.Permissions memory) {
            return Hooks.Permissions({
                beforeInitialize: true,
                afterInitialize: false,
                beforeAddLiquidity: false,
                afterAddLiquidity: false,
                beforeRemoveLiquidity: false,
                afterRemoveLiquidity: false,
                beforeSwap: false,
                afterSwap: true,
                beforeDonate: false,
                afterDonate: false,
                beforeSwapReturnDelta: false,
                afterSwapReturnDelta: true,
                afterAddLiquidityReturnDelta: false,

  • on-chainhook permissions (from address bits) = beforeInitialize, afterSwap, afterSwapReturnDelta

  Confirmed by: claude-opus-5.5, grok-4.7 · Disputed by: gpt-5.6-sol

• PositiveVerified X account lists this exact contract addresssocialAI

  @goassay (Assay Labs) is verified, points at goassay.ai, and puts the reviewed contract in its bio. Account creation (2026-08-11) lines up with the domain (2026-08-26), before the token deploy. No third-party posts calling this contract a scam, rug, or honeypot were found. That does not prove the token is safe.

  Evidence

  • webhttps://x.com/goassay
    Show source

    Trust layer for agent payments on Robinhood Chain. CA: 0xa2b38467e9b60c016d94977ad37f825da4cd3462

  • on-chaintarget = 0xa2b38467e9b60c016d94977ad37f825da4cd3462
    Show source

    target matches the CA in the @goassay bio

  Confirmed by: grok-4.7, gpt-5.6-sol

Notes (3)

• LowPons hook takes a fixed 3% fee on every swapfeesAI

  Every swap in the graduated pool goes through the PonsV2MemeHook afterSwap callback. It takes hookFeeBps (1%) plus the creator tax (2%) from the swap output, so about 3% per trade. These rates are copied into the pool's record when the pool is registered. The hook owner's setters (setHookFeeBps up to 10%, setProtocolFeeShareBps up to 50%, setBuybackBurnBps) only change the policy for future launches; they do not change this pool's stored rates. Combined fee plus tax is capped at 20%. Fees go to the protocol, the creator and an optional buyback-and-lock leg, through the fee escrow.

  Evidence

  • codePonsV2MemeHook.sol:L444-L485
    Show source

    function _afterSwap(address, PoolKey calldata key, SwapParams calldata params, BalanceDelta delta, bytes calldata)
            internal
            override
            returns (bytes4, int128)
        {
            // The conversion and buyback legs swap against this same pool, but
            // they are never taxed here: v4-core skips a pool's hooks when the
            // hook itself is the caller (Hooks.afterSwap). Were that not so, the
            // skim would come out of the buyback before it reached the vault.
            PoolId poolId = key.toId();
            LaunchInfo memory info = launches[poolId];
            if (!info.registered) return (IHooks.afterSwap.selector, 0);
            if (info.hookFeeBps == 0 && info.creatorTaxBps == 0) return (IHooks.afterSwap.selector, 0);
    
            bool specifiedIsCurrency0 = (params.amountSpecified < 0) == params.zeroForOne;

  • codePonsV2MemeHook.sol:L337-L378
    Show source

    // Terms frozen here govern the pool for life, so each is held to the
            // same ceiling as the setter that produced it. protocolFeeShareBps
            // against BASIS_POINTS rather than MAX_PROTOCOL_FEE_SHARE_BPS would
            // let a pool be registered on terms the live policy could never
            // reach, paying the creator nothing.
            if (
                policy.protocolFeeRecipient == address(0) || policy.protocolFeeShareBps > MAX_PROTOCOL_FEE_SHARE_BPS
                    || policy.buybackBurnBps > BASIS_POINTS || policy.hookFeeBps > MAX_HOOK_FEE_BPS
                    || policy.maxInternalPriceImpactBps == 0 || policy.maxInternalPriceImpactBps >= BASIS_POINTS
            ) {
                revert InvalidBps();
            }
            // The curve bounds the same sum in its own constructor rather than
            // inheriting it from the factory. A pool taking more than the whole
            // unspecified leg would flip the swapper's output delta negative.

  • codePonsV2MemeHook.sol:L251-L255
    Show source

    function setHookFeeBps(uint256 bps) external onlyOwner {
            if (bps > MAX_HOOK_FEE_BPS) revert InvalidBps();
            hookFeeBps = bps;
            emit HookFeeBpsUpdated(bps);
        }

  • on-chainlaunchpad.fees: protocol fee 1%; creator tax 2%

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• LowPons protocol owner controls fee sweeping and future fee policyownershipAI

  Address 0x263e…19Dd owns the hook, factory, buyback vault and LP locker. Ownership of the hook and vault cannot be renounced. What the owner can do: - Change the fee policy for future launches. - Change the protocol fee recipient for future launches. - Replace the fee-sweep operator. The operator chooses the minimum outputs when the hook converts accumulated fees, so a bad operator could sell fee inventory at a poor price into the pool. - Call rescuePoolFees, which only pays the pool's recorded protocol recipient and creator. - Use the factory's override path to change who receives creator fees (a 3-day timelock constant exists). None of these powers let the owner take holders' tokens or block trading in this pool. Factory rescue functions (rescueCurveFees, rescueSweptGraduation) exist, but their source was omitted. The curve is graduated and shows zero real reserves.

  Evidence

  • codePonsV2MemeHook.sol:L274-L278
    Show source

    function setFeeSweepOperator(address operator) external onlyOwner {
            if (operator == address(0)) revert ZeroAddress();
            feeSweepOperator = operator;
            emit FeeSweepOperatorUpdated(operator);
        }

  • codePonsV2MemeHook.sol:L555-L603
    Show source

    function rescuePoolFees(PoolId poolId)
            external
            onlyOwner
            nonReentrant
            returns (uint256 protocolAmount, uint256 creatorAmount)
        {
            LaunchInfo memory info = launches[poolId];
            if (!info.registered) revert UnknownPool();
            address quoteToken = info.quoteToken;
    
            if (quoteToken != address(0)) {
                (protocolAmount, creatorAmount) = _rescueCurrency(poolId, info, quoteToken);
            }
            (uint256 memecoinProtocol, uint256 memecoinCreator) = _rescueCurrency(poolId, info, info.memecoin);
            if (protocolAmount == 0 && creatorAmount == 0 && memecoinProtocol == 0 && memecoinCreator == 0) {

  • codePonsV2MemeHook.sol:L235-L237
    Show source

    function renounceOwnership() public pure override {
            revert OwnershipCannotBeRenounced();
        }

  • on-chainfactory param CREATOR_FEE_RECIPIENT_TIMELOCK = 259200

  Confirmed by: claude-opus-5.5 · Disputed by: gpt-5.6-sol

• InfoStaking dApp untested: login blocked by CAPTCHAwebsiteAI

  Scripted tests of the stake and unstake flows on portal.goassay.ai stopped at a Privy CAPTCHA during login. No transactions or approvals were made. This is not evidence of a broken withdraw, but the website's claims about staking and withdrawals remain unverified.

  Evidence

  • forkdappTests stake
    Show source

    Login blocked by CAPTCHA verification in Privy authentication modal

  • forkdappTests unstake
    Show source

    Login blocked by Privy CAPTCHA requirement

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol