PonsV2LauncherToken $CURVEIL

Risks (9)

• CriticalWithdrawing through the dApp failed ("Withdraw from Vault")honeypotDeterministic

  We ran the project's own dApp on a local fork. The "Withdraw from Vault" step did not work. Expected: Withdrawing returns the deposited funds to the wallet (minus any documented fee).. Observed: wallet no balance change; 0 tx (none). No successful transaction was made for this goal (fail). | driver: fail — No vault account exists in this browser and no funds were deposited in this session to withdraw.. Money deposited may be impossible to take out.

  Evidence

  • forkdApp test "Withdraw from Vault" on a local fork (https://curveil.xyz/vault)
    Show source

    wallet no balance change; 0 tx (none). No successful transaction was made for this goal (fail). | driver: fail — No vault account exists in this browser and no funds were deposited in this session to withdraw.

  Confirmed by: facts

• HighClaim contradicted: The project completed a third buyback and burn reducing supply.claims-mismatchDeterministic

  The project claims buyback & burn, but none of the 3 burn(s) seen was preceded by a buy from a pool in the same transaction (1.4% of supply burned in total).

  Evidence

  • Xhttps://x.com/Curveil_app/status/2118668238477201688
    Show source

    3rd Buyback-Burn done supply reduced.

  • on-chainTransfer events of 0xb9fd927f8ebdc35a83274324b138a242a8b37674 to burn addresses + balanceOf(0x…dEaD)

  Confirmed by: facts

• HighSeven wallets from one funder hold about 13% vs thin liquidityholdersAI

  Seven wallets were all funded by 0xf70d…dbef. Together they hold 12.98% of supply, which looks like one entity spread across wallets. Several of them appear among the top holders (3.20%, 2.71%, 1.94%, 1.88%, 1.51%). The curve holds only about $4,493 of liquidity. If this group sells together, it can crash the curve price and leave other holders with large losses. This is a market risk, not a code power.

  Evidence

  • on-chaintoken.clusters[funder=0xf70da97812cb96acdf810712aa562db8dfa3dbef].pctSupplyHeldNow = 12.9816
  • on-chaintoken.liquidity: pons-v2-bonding-curve pool 0x6163495e2c51a00A9c2FE1060339bE4FF5BA22aA liquidityUsd 4493

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumOne funder's 8 wallets bundled 14.3% of supplysnipersDeterministic

  8 wallets funded by the same address 0xabb2…cd10 bought 14.3% of the supply together (block 107442209). Spreading one buyer over many wallets hides how much a single entity controls.

  Evidence

  • on-chainbundles with commonFunder 0xabb2acd3be814a80e502575d6c1dc5f789e9cd10: 8 wallets, pctSupply 14.27
  • on-chaintoken.bundles[block=107442209] commonFunder 0xabb2acd3be814a80e502575d6c1dc5f789e9cd10 pctSupply 14.2676
  • on-chaintoken.snipers: pctSupplyBought 17.228, pctSupplyHeldNow 0

  Confirmed by: facts, claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumBonding curve holding all reserves has unverified sourceotherAI

  The bonding curve 0x6163…22aA holds 47.39% of supply and all quote reserves. Its source is not verified. It exposes sweepFees, rescueFees, setCreatorFeeRecipient, setBuybackEnabled, exemptFromSnipeTax, initialize and graduate. The verified factory calls these, but the curve's own access checks cannot be confirmed. Buys and sells behaved normally in the simulation.

  Evidence

  • on-chainlaunchpad.relatedContracts: bonding curve 0x6163495e2c51a00A9c2FE1060339bE4FF5BA22aA verified=false
  • codePonsV2LaunchFactory.sol:L1222-L1226
    Show source

    function rescueCurveFees(address token) external onlyOwner nonReentrant {
            LaunchedToken storage launch = _launchedTokens[token];
            if (!launch.exists) revert TokenNotFound();
            PonsV2BondingCurve(payable(launch.curve)).rescueFees();
        }

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumPons owner can claim reserves if graduation fails for 7 daysliquidityAI

  If graduation sweeps the curve but the Uniswap v4 pool cannot be seeded, the factory owner can send all swept ETH and tokens to any address of their choosing. This rescueSweptGraduation path only opens 7 days after the sweep. During that wait anyone can call createGraduatedPool, which seeds the pool and closes the path permanently. The owner can also force a sweep, but only when the code judges seeding not viable. In the normal path, liquidity goes into a full-range v4 position locked in the Pons locker. Holders depend on the owner to distribute rescued funds fairly.

  Evidence

  • codePonsV2LaunchFactory.sol:L1254-L1285
    Show source

    function rescueSweptGraduation(address token, address recipient) external onlyOwner nonReentrant {
            LaunchedToken storage launch = _launchedTokens[token];
            if (!launch.exists) revert TokenNotFound();
            if (launch.phase != GraduationPhase.Swept) revert WrongGraduationPhase();
            if (recipient == address(0)) revert ZeroAddress();
    
            uint256 availableAt = launch.sweptAt + GRADUATION_RESCUE_DELAY;
            if (block.timestamp < availableAt) revert GraduationRescueTooEarly(availableAt);
    
            uint256 quoteAmount = launch.sweptQuote;
            uint256 tokenAmount = launch.sweptTokens;
            address pairToken = launch.pairToken;
    
            launch.sweptQuote = 0;
            launch.sweptTokens = 0;

  • codePonsV2LaunchFactory.sol:L1109-L1123
    Show source

    function forceSweptGraduation(address token) external onlyOwner nonReentrant {
            LaunchedToken storage launch = _launchedTokens[token];
            if (!launch.exists) revert TokenNotFound();
            if (launch.phase != GraduationPhase.NotGraduated) revert WrongGraduationPhase();
            PonsV2BondingCurve curve = PonsV2BondingCurve(launch.curve);
            if (!curve.readyToGraduate()) {
                revert PonsV2BondingCurve.NotReadyToGraduate();
            }
            if (_graduationSeedable(token, launch, curve.realQuoteReserve(), curve.tokenReserve())) {
                revert GraduationStillViable();
            }
    
            _sweepCurve(token, launch, curve);
            emit LaunchForceSwept(token);
        }

  • codePonsV2LaunchFactory.sol:L1402
    Show source

    locker.lockPosition(token, positionId);

  Confirmed by: claude-opus-5.5, gpt-5.6-sol · Disputed by: grok-4.7

• MediumDay-old thin website; ZK, perps and vault claims unverifiedwebsiteAI

  curveil.xyz was registered on 2026-11-05, one day before the token was deployed (2026-11-06). The token description claims a privacy DeFi ecosystem with swaps, launches, perps and a shielded vault, but the token itself is a plain launchpad template with no link to those products. The site itself says there is no independent audit and that vault deposits are capped. In the dApp tests, a swap through CurveilRouter worked using an exact (not unlimited) approval. The vault deposit and withdraw flows could not be completed in the UI because of the account-setup steps, so the vault is unverified rather than proven broken.

  Evidence

  • on-chainsite.domainCreatedAt = 2026-11-05T07:20:12.000Z
  • webhttps://curveil.xyz/
    Show source

    Markets, launches, launchpads, perps and the shielded vault are live on Robinhood Chain, without an independent audit so far, and vault deposits are capped.

  • forkdappTests: Swap tokens (approve step)
    Show source

    exact 0.1 WETH

  • forkdappTests: Deposit into Vault
    Show source

    multi-step vault account creation flow requiring mnemonic verification

  • Xhttps://x.com/Curveil_app/status/2118625365568675916
    Show source

    $Curveil is a privacy-focused DeFi ecosystem on #RobinhoodChain. Trade, launch tokens, provide liquidity, and access perpetual markets. Zero-knowledge technology enables private participation in public markets.

  • Xhttps://x.com/Curveil_app/status/2118271827738784239
    Show source

    Your brand. Your launchpad. Powered by Curveil. Build your own token launchpad using Curveil's shared infrastructure. ... Curveil powers the contracts.

  • Xhttps://x.com/Curveil_app/status/2118618187432366430
    Show source

    Provide USDG liquidity to the Perps Vault and receive vault shares. The vault earns a share of trading fees and acts as the counterparty to traders.

  • on-chaintarget name = PonsV2LauncherToken, symbol CURVEIL, chain eip155:4663, deployedAt 2026-11-06T08:35:24.000Z

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• LowLaunch sniped: 11 wallets took 17.2% of supply in 10 secondssnipersDeterministic

  The launch was captured: 11 wallets bought 17.2% of the supply within 10 seconds. A small, fast group set the early price and could sell into everyone who bought later — bad for launch fairness and a strong insider/bot signal. They now hold 0% of supply, so current dump pressure from them is low — most of it was already sold, i.e. they exited on later buyers.

  Evidence

  • on-chainsnipers: windowBlocks=100, wallets=11, pctSupplyBought=17.228, pctSupplyHeldNow=0

  Confirmed by: facts

• LowX account is one day old with no named teamsocialAI

  @Curveil_app was created 2026-11-05 (about 60 followers, verified badge, bio posts the same CA). The night before launch it told followers the official token had NOT launched and to beware impersonators; hours later it posted this CA. No founder is named. Newness alone is not a rug, but there is no history or identity to check against the product claims. One reply alleges a bundled launch and an instant dump; that is a single unverified allegation and is not confirmed by the basics given here (80 holders, top 10 about 26%, empty deployer history).

  Evidence

  • Xhttps://x.com/Curveil_app/status/2118470918938980417
    Show source

    The official token has NOT launched yet.

  • Xhttps://x.com/Curveil_app/status/2118625365568675916
    Show source

    0xb9fd927f8ebdc35a83274324b138a242a8b37674 🔎 Beware of other CA

  • Xhttps://x.com/andreyyyc4/status/2118668822009762001
    Show source

    @Curveil_app well....now we know it's bundle to shit and you can insta dump...gl with your shit

  Confirmed by: grok-4.7 · Disputed by: claude-opus-5.5, gpt-5.6-sol

Positive signals (4)

• PositiveToken is the standard Pons template with no owner powersownershipAI

  CURVEIL is the standard PonsV2LauncherToken: an OpenZeppelin ERC20 plus ERC20Burnable. It has no owner, no mint function after construction, and no fee, blacklist or pause logic. The _update function is not overridden, so transfers cannot be blocked or taxed by the token. The whole fixed supply was minted once to the bonding curve in the constructor. The stored deployer address is only a label and gives no special rights. Slither reported no issues.

  Evidence

  • codePonsV2LauncherToken.sol:L21
    Show source

    contract PonsV2LauncherToken is ERC20, ERC20Burnable {

  • codePonsV2LauncherToken.sol:L70
    Show source

    _mint(curve_, supply_);

  • codeERC20.sol:L176-L204
    Show source

    function _update(address from, address to, uint256 value) internal virtual {
            if (from == address(0)) {
                // Overflow check required: The rest of the code assumes that totalSupply never overflows
                _totalSupply += value;
            } else {
                uint256 fromBalance = _balances[from];
                if (fromBalance < value) {
                    revert ERC20InsufficientBalance(from, fromBalance, value);
                }
                unchecked {
                    // Overflow not possible: value <= fromBalance <= totalSupply.
                    _balances[from] = fromBalance - value;
                }
            }

  • staticslither 0.11.6: issues = []

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveBuy, sell and transfer all worked on fork at about 4% feehoneypotAI

  On a fork, a real buy and a real sell on the bonding curve both succeeded. A second wallet that received tokens by transfer could also sell, and selling still worked one hour later. The effective fee was 3.98% on buys and 4% on sells, matching the curve fees: 1% protocol fee plus 3% creator tax. Plain transfers are untaxed. There is no sign of a honeypot.

  Evidence

  • forksimulation: canBuy=true, canSell=true, buyTaxPct=3.98, sellTaxPct=4, transferTaxPct=0
  • forksimulation note
    Show source

    second wallet (received via transfer) could sell

  • forksimulation note
    Show source

    curve fees: feeBps=100, creatorTaxBps=300

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveDeployer holds no tokens and has not soldinsidersAI

  The creator 0x1dfF…15e8 was the only declared snipe-tax-exempt wallet. It now holds 0% and recorded no sales (deployerSoldPct 0). It made 3 burns totaling 1.39% of supply. No deployer history was found.

  Evidence

  • on-chainDeployer 0x1dff56742b33aaf42e12a651435e6993437015e8 holds 0% now
  • on-chaintoken.burns.by[0]: deployer pct 1.3939 count 3
  • on-chaintoken.deployerSoldPct = 0

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveTrading fees are locked at launch and cannot be raisedfeesAI

  This launch's creator tax (3%) and curve fee (1%) were recorded at launch. The factory code shows no setter that changes them for an existing launch. Ceilings are 10% for the curve fee and 10% for the creator tax, with a 20% combined limit checked at launch. Snipe-tax settings only apply to new launches, and this curve's snipe tax is now 0.

  Evidence

  • codePonsV2LaunchFactory.sol:L58-L61
    Show source

    uint256 private constant BASIS_POINTS = 10_000;
        uint256 private constant MAX_CURVE_FEE_BPS = 1_000; // 10%
        uint256 private constant MAX_CREATOR_TAX_CEILING_BPS = 1_000; // 10%
        uint256 private constant MAX_TOTAL_TRADE_FEE_BPS = 2_000; // 20%

  • codePonsV2LaunchFactory.sol:L545-L555
    Show source

    /**
         * @notice Adjusts the ceiling a creator's chosen trade tax is validated
         * against at launch time. Already-launched tokens keep the immutable
         * tax rate they launched with regardless of later ceiling changes.
         */
        function setMaxCreatorTaxBps(uint256 bps) external onlyOwner {
            if (bps > MAX_CREATOR_TAX_CEILING_BPS) revert InvalidBasisPoints();
            maxCreatorTaxBps = bps;
            emit MaxCreatorTaxUpdated(bps);
        }

  • on-chaintoken.notes: curve: graduated=false, feeBps=100, creatorTaxBps=300, snipeTaxNow=0bps over 3s

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

Notes (2)

• LowPons owner can redirect the 3% creator fee after a 3-day timelockownershipAI

  The Pons factory owner 0x263e…19Dd can call setCreatorFeeRecipient for any launch. After a 3-day timelock, anyone can execute the change. This redirects the 3% creator tax and the creator's buyback vest, and the code says the creator cannot veto it. It does not touch holder balances or the trading fee level. Factory ownership cannot be renounced.

  Evidence

  • codePonsV2LaunchFactory.sol:L946-L957
    Show source

    function setCreatorFeeRecipient(address token, address newRecipient) external onlyOwner {
            LaunchedToken storage launch = _launchedTokens[token];
            if (!launch.exists) revert TokenNotFound();
            if (newRecipient == address(0)) revert ZeroAddress();
    
            uint256 effectiveAt = block.timestamp + CREATOR_FEE_RECIPIENT_TIMELOCK;
            uint256 expiresAt = effectiveAt + CREATOR_FEE_RECIPIENT_EXECUTION_WINDOW;
            pendingCreatorFeeRecipient[token] =
                PendingCreatorFeeRecipient({newRecipient: newRecipient, effectiveAt: effectiveAt, expiresAt: expiresAt});
    
            emit CreatorFeeRecipientChangeProposed(token, launch.creatorFeeRecipient, newRecipient, effectiveAt, expiresAt);
        }

  • codePonsV2LaunchFactory.sol:L99
    Show source

    uint256 public constant CREATOR_FEE_RECIPIENT_TIMELOCK = 3 days;

  • codePonsV2LaunchFactory.sol:L630-L632
    Show source

    function renounceOwnership() public pure override {
            revert OwnershipCannotBeRenounced();
        }

  Confirmed by: claude-opus-5.5, gpt-5.6-sol · Disputed by: grok-4.7

• InfoOne-time burn: 1.4% of supply sent to a burn addressburnDeterministic

  1.4% of the supply ever minted is burned, in 3 burn transfer(s), last 2026-11-06. Burned by: the deployer 0x1dff…15e8 (1.4%, 3 burns). This happened once, around launch; there is no sign of a continuing burn mechanism.

  Evidence

  • on-chainTransfer events to 0x0 / 0x…dEaD and balanceOf(burn addresses) of 0xb9fd927f8ebdc35a83274324b138a242a8b37674

  Confirmed by: facts