PonsV2LauncherToken $SURPLUS

Risks (9)

• HighUnverified staking contract holds 11.4% of supply, owner has rescue()otherAI

  The site's staking page sends SURPLUS to 0x33B1…99E0. This is the largest non-pool holder at 11.4147% of supply. Its source is unverified, and it has an owner (0xbEdc…7d88) and a rescue(address,address,uint256) function. If rescue can move the staked SURPLUS, the owner could take every staker's tokens in one transaction. This cannot be confirmed without source. The dApp test confirmed only that staking moves tokens into the contract. The website promise to 'Unstake any time, with no lock or cooldown' was not tested on-chain.

  Evidence

  • on-chainTop holder 0x33B1e02cfFDF0ec4391D86A3503327539C5e99E0 pct 11.4147, isContract true
  • staticrelated contract 0x33B1e02cfFDF0ec4391D86A3503327539C5e99E0 verified=false owner=0xbEdcEa49E50B33f0BCb5AD1A62C3Eea80Ad97d88; fn rescue(address,address,uint256) risk=medium
  • forkStake $SURPLUS: stake(uint256) step
    Show source

    wallet -100 SURPLUS → 0x33b1…99e0 (other)

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumOne funder's 4 wallets bundled 6.73% of supplysnipersDeterministic

  4 wallets funded by the same address 0xe68d…1934 bought 6.73% of the supply together (blocks 80101279, 80101274). Spreading one buyer over many wallets hides how much a single entity controls.

  Evidence

  • on-chainbundles with commonFunder 0xe68d0bbc023de3febda04f413db23ce9c5ea1934: 4 wallets, pctSupply 6.73

  Confirmed by: facts

• MediumCreator-declared wallets bought 17% of supply at launchinsidersDeterministic

  4 wallet(s) linked to the team (declared by the creator at launch, exempt from the snipe tax) bought 17% of the supply in the first blocks — an insider allocation that real buyers did not get. They now hold 0%, so current dump pressure from them is low; most of it has already been sold.

  Evidence

  • on-chaininsiders: 4 wallets, fundedBy declared by creator at launch (snipe-tax exempt on curve; creator 0xe2006caf389d127b0bb2b3a72ee0f78f2972e6bb), bought at launch 17%, pctSupplyHeldNow 0
  • on-chainbundles[0]: block 80101238, commonFunder 0xe68d0bbc023de3febda04f413db23ce9c5ea1934, pctSupply 16.9999
  • on-chaininsiders: declared by creator at launch (snipe-tax exempt on curve), pctSupplyHeldNow 0
  • on-chainclusters funder 0xe68d0bbc023de3febda04f413db23ce9c5ea1934, 11 wallets, pctSupplyHeldNow 0
  • on-chainburns.by deployer 0xe2006caf389d127b0bb2b3a72ee0f78f2972e6bb pct 3.2999

  Confirmed by: facts, claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumUnverified credit marketplace: owner can pause it and change feesotherAI

  Buying credits sends USDG to 0xeBf1…D25f. This contract is unverified and owned by the same 0xbEdc…7d88. It exposes pause/unpause, setFees(uint16,uint16) and setFeeRecipient. The owner could therefore freeze the marketplace, including claims and cancels of open seller orders, or change fees. The MAX_FEE_BPS constant exists, but its value is not in the material. The test buy worked: approval was for the exact amount, and 7.35 USDG was paid for 10 CREDIT.

  Evidence

  • staticrelated contract 0xeBf131BbE0F2025a19Ca9Ca343F8c4692214D25f verified=false; fn setFees(uint16,uint16) risk=high; fn pause() risk=high; fn setFeeRecipient(address)
  • forkBuy credits: buyAndActivate step
    Show source

    wallet -7.35 USDG → 0xebf1…d25f (other)

  Confirmed by: claude-opus-5.5, grok-4.7 · Disputed by: gpt-5.6-sol

• MediumHomepage claims Anthropic SDK support that the docs denyclaims-mismatchAI

  The homepage tells users the whole migration is two lines and lists Anthropic SDK and Claude Agent SDK as drop-in options. The docs say only OpenAI-style chat completions work today, an Anthropic /messages endpoint is only planned, and the Anthropic SDK cannot be pointed at Surplus yet. Anyone moving a Claude agent on that homepage claim would find the integration does not exist.

  Evidence

  • webhttps://surplusllm.com/
    Show source

    The whole migration is two lines.
    Change the base URL and the key. Nothing else.
    OpenRouter
    OpenAI SDK
    Anthropic SDK · Claude Agent SDK

  • webhttps://surplusllm.com/docs
    Show source

    Only the OpenAI-compatible Chat Completions format is served today. An Anthropic-format /messages endpoint is planned, so the Anthropic SDK can't be pointed at Surplus yet.

  Confirmed by: grok-4.7, gpt-5.6-sol

• LowPons protocol owner controls fee routing on the shared hookownershipAI

  The hook owner (0x263e…19Dd) also owns the factory, buyback vault and locker. Ownership cannot be renounced. The owner can: - change future-launch fee policy; - replace the fee sweep operator, which chooses minimum outputs when converting accrued fees; - force rescuePoolFees, which pays pending fees directly to the recorded protocol and creator recipients rather than to an arbitrary address. The factory can repoint this pool's creator fee recipient, through creator transfers with a 72h timelock or owner overrides. These powers affect fee income, not holders' tokens or the pool's liquidity.

  Evidence

  • codePonsV2MemeHook.sol:L235-L278
    Show source

    function renounceOwnership() public pure override {
            revert OwnershipCannotBeRenounced();
        }
    
        function setProtocolFeeShareBps(uint256 bps) external onlyOwner {
            if (bps > MAX_PROTOCOL_FEE_SHARE_BPS) revert InvalidBps();
            protocolFeeShareBps = bps;
            emit ProtocolFeeShareUpdated(bps);
        }
    
        function setBuybackBurnBps(uint256 bps) external onlyOwner {
            if (bps > BASIS_POINTS) revert InvalidBps();
            buybackBurnBps = bps;
            emit BuybackBurnBpsUpdated(bps);
        }

  • codePonsV2MemeHook.sol:L555-L603
    Show source

    function rescuePoolFees(PoolId poolId)
            external
            onlyOwner
            nonReentrant
            returns (uint256 protocolAmount, uint256 creatorAmount)
        {
            LaunchInfo memory info = launches[poolId];
            if (!info.registered) revert UnknownPool();
            address quoteToken = info.quoteToken;
    
            if (quoteToken != address(0)) {
                (protocolAmount, creatorAmount) = _rescueCurrency(poolId, info, quoteToken);
            }
            (uint256 memecoinProtocol, uint256 memecoinCreator) = _rescueCurrency(poolId, info, info.memecoin);
            if (protocolAmount == 0 && creatorAmount == 0 && memecoinProtocol == 0 && memecoinCreator == 0) {

  • codePonsV2MemeHook.sol:L384-L397
    Show source

    /**
         * @notice Updates who receives this pool's creator fee share. Restricted
         * to the factory, which gates both self-service creator transfers and
         * protocol-owner overrides before forwarding here, so this contract only
         * needs to trust one caller.
         */
        function setCreatorFeeRecipient(PoolId poolId, address newRecipient) external onlyFactory {
            LaunchInfo storage info = launches[poolId];
            if (!info.registered) revert UnknownPool();
            if (newRecipient == address(0)) revert ZeroAddress();
    
            emit CreatorFeeRecipientUpdated(poolId, info.creator, newRecipient);
            info.creator = newRecipient;
        }

  • on-chainCREATOR_FEE_RECIPIENT_TIMELOCK = 259200

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• LowWebsite model count (435) differs from X post (157)claims-mismatchAI

  The marketing site says 435 models are available on one key. The project's X account, a day earlier, said 157 models. Buyers cannot tell which catalogue size is real from these two public statements.

  Evidence

  • webhttps://surplusllm.com/
    Show source

    Every model, one key.
    435 models, below what the lab charges.

  • Xhttps://x.com/SurplusRH/status/2117942637395382661
    Show source

    157 models, one key, settled in USDG on Robinhood Chain.

  Confirmed by: grok-4.7 · Disputed by: gpt-5.6-sol

• LowHomepage usage total is far below the team's latest X figuresclaims-mismatchAI

  The homepage shows about 3.64 billion tokens processed. On 4–5 November the same account posted 7.36 billion, 7.4 billion, and 7.53 billion tokens. The page looks stale or the figures are not kept in sync, so the discount and volume story on the site should not be treated as current.

  Evidence

  • webhttps://surplusllm.com/
    Show source

    Tokens processed
    3,641,280,937
    +5M tokens every hour

  • Xhttps://x.com/SurplusRH/status/2118142859895619978
    Show source

    7.53 billion tokens. 64,150 requests. 30 paying accounts.

  • Xhttps://x.com/SurplusRH/status/2117949227519406252
    Show source

    4 weeks live. 7.4B tokens total.

  Confirmed by: grok-4.7, gpt-5.6-sol

• LowContracts page still says addresses are not yet deployedwebsiteAI

  The protocol page says contract addresses will fill in once contracts are deployed, while the same page already lists CREDIT, staking, exchange, SURPLUS and USDG addresses. That leftover template text makes it unclear which contracts are actually live.

  Evidence

  • webhttps://surplusllm.com/protocol
    Show source

    Robinhood Chain · chain 4663. Addresses fill in once the contracts are deployed.

  • webhttps://surplusllm.com/protocol
    Show source

    SURPLUS
    The token you stake for CREDIT, on Robinhood Chain mainnet.
    0xE183…97EC

  Confirmed by: grok-4.7 · Disputed by: gpt-5.6-sol

Positive signals (6)

• PositiveOngoing token burns verified on-chain: 5.6% of supply burnedburnDeterministic

  5.6% of the supply ever minted is burned, in 489 burn transfer(s), last 2026-11-04. Burned by: the deployer 0xe200…e6bb (3.3%, 1 burn); pool 0x8366…0951 (2.3%, 488 burns). Burned tokens are gone for good, which reduces the supply over time.

  Evidence

  • on-chainTransfer events to 0x0 / 0x…dEaD and balanceOf(burn addresses) of 0xe1838f0dff03a9327dea87b2a2285850791297ec

  Confirmed by: facts

• PositiveToken is a fixed-supply template with no owner powersotherAI

  SURPLUS is a plain OpenZeppelin ERC20 plus ERC20Burnable. The whole supply is minted once to the bonding curve in the constructor. There is no mint, fee, blacklist, pause or owner function. The deployer, launchFactory and curve values are immutable reference data and give no control over the token. Nobody can change balances or block transfers at the token level.

  Evidence

  • codePonsV2LauncherToken.sol:L21-L71
    Show source

    contract PonsV2LauncherToken is ERC20, ERC20Burnable {
        struct Socials {
            string twitter;
            string telegram;
            string discord;
            string website;
            string farcaster;
        }
    
        error ZeroAddress();
    
        address public immutable deployer;
        address public immutable launchFactory;
        address public immutable curve;

  • codeERC20.sol:L176-L204
    Show source

    function _update(address from, address to, uint256 value) internal virtual {
            if (from == address(0)) {
                // Overflow check required: The rest of the code assumes that totalSupply never overflows
                _totalSupply += value;
            } else {
                uint256 fromBalance = _balances[from];
                if (fromBalance < value) {
                    revert ERC20InsufficientBalance(from, fromBalance, value);
                }
                unchecked {
                    // Overflow not possible: value <= fromBalance <= totalSupply.
                    _balances[from] = fromBalance - value;
                }
            }

  • staticprivileges: [] ; slither issues: []

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveFork test: buy, sell and transferred-wallet sell all workhoneypotAI

  On a fork, a real buy and sell went through the graduated Uniswap v4 pool. The amounts matched the quotes exactly, and token-level taxes were 0%. A second wallet that received tokens by transfer could also sell, and selling still worked after 1 hour. The round trip loses roughly 3% each way to the pool hook's fee and creator tax (see the next finding), not to the token contract.

  Evidence

  • forkcanBuy=true, canSell=true, buyTaxPct=0, sellTaxPct=0, transferTaxPct=0
  • forksecond wallet (received via transfer) could sell; sell after +1h: ok

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveMain pool liquidity is 100% held by the Pons LP lockerliquidityAI

  The graduated Uniswap v4 pool's liquidity position is 100% locked, and the deployer holds 0% of it. The locker's only listed powers are factory-only lock functions and an owner setFactory. No unlock or withdraw function appears in its function table. The locker source was omitted, so the lock terms themselves are not shown.

  Evidence

  • on-chainliquidity pool 0xf179149396b6c6bb79694ba0935ce0862ddd0bb844283f566993f1e6303c33d4: lpLockedPct 100, lpHeldByDeployerPct 0
  • staticLP-locker 0x267444D099b10fB5Ed7c3Cc7B7c767AdcA574952 functions: lockPosition [factory], lockTokenSupply [factory], setFactory [owner]

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveTeam publicly disclosed a service outage and its causesocialAI

  On 2 November the project account said its upstream provider credit ran out, most requests failed for about six hours overnight and about seven hours on 2 November, and that they only noticed from user reports. Admitting a service failure is a transparency signal, not hidden owner control of the token.

  Evidence

  • Xhttps://x.com/SurplusRH/status/2117255161676722653
    Show source

    Our upstream provider credit ran low and most requests failed in two stretches (~6h overnight, ~7h on Nov 2). That’s on us, and we only caught it from your reports.

  Confirmed by: grok-4.7, gpt-5.6-sol

• PositiveSite says credits are product access, not an investmentwebsiteAI

  The site states credits are a grant of API access, not redeemable for cash, and not financial advice. That limits the promise attached to buying credits, though it does not constrain what the SURPLUS token itself can do.

  Evidence

  • webhttps://surplusllm.com/
    Show source

    Credits are a grant of product access, not an investment return, and not redeemable for cash. Nothing here is financial advice.

  Confirmed by: grok-4.7, gpt-5.6-sol

Notes (3)

• LowEach swap pays a fixed 3% fee via the Pons hookfeesAI

  The Pons v4 hook's afterSwap takes the pool's hookFeeBps (1%) plus creatorTaxBps (2%) from the output side of each swap. These rates are copied into the pool's own record when it is registered. The swap code reads only that record, so the hook owner's later calls to setHookFeeBps cannot raise the fee on this pool. Creator tax plus hook fee is capped at 20% when a pool is registered. Swaps cannot be blocked: the hook address only enables beforeInitialize (factory-only), afterSwap and afterSwapReturnDelta, so there is no beforeSwap or liquidity-removal callback.

  Evidence

  • codePonsV2MemeHook.sol:L444-L485
    Show source

    function _afterSwap(address, PoolKey calldata key, SwapParams calldata params, BalanceDelta delta, bytes calldata)
            internal
            override
            returns (bytes4, int128)
        {
            // The conversion and buyback legs swap against this same pool, but
            // they are never taxed here: v4-core skips a pool's hooks when the
            // hook itself is the caller (Hooks.afterSwap). Were that not so, the
            // skim would come out of the buyback before it reached the vault.
            PoolId poolId = key.toId();
            LaunchInfo memory info = launches[poolId];
            if (!info.registered) return (IHooks.afterSwap.selector, 0);
            if (info.hookFeeBps == 0 && info.creatorTaxBps == 0) return (IHooks.afterSwap.selector, 0);
    
            bool specifiedIsCurrency0 = (params.amountSpecified < 0) == params.zeroForOne;

  • codePonsV2MemeHook.sol:L342-L378
    Show source

    if (
                policy.protocolFeeRecipient == address(0) || policy.protocolFeeShareBps > MAX_PROTOCOL_FEE_SHARE_BPS
                    || policy.buybackBurnBps > BASIS_POINTS || policy.hookFeeBps > MAX_HOOK_FEE_BPS
                    || policy.maxInternalPriceImpactBps == 0 || policy.maxInternalPriceImpactBps >= BASIS_POINTS
            ) {
                revert InvalidBps();
            }
            // The curve bounds the same sum in its own constructor rather than
            // inheriting it from the factory. A pool taking more than the whole
            // unspecified leg would flip the swapper's output delta negative.
            if (uint256(creatorTaxBps) + policy.hookFeeBps > MAX_TOTAL_TRADE_FEE_BPS) revert InvalidBps();
    
            // The factory builds the key correctly today, but these two facts are
            // what every later fee credit and swap direction is derived from. A
            // memecoin that is neither currency would silently designate the wrong

  • codePonsV2MemeHook.sol:L184-L201
    Show source

    function getHookPermissions() public pure override returns (Hooks.Permissions memory) {
            return Hooks.Permissions({
                beforeInitialize: true,
                afterInitialize: false,
                beforeAddLiquidity: false,
                afterAddLiquidity: false,
                beforeRemoveLiquidity: false,
                afterRemoveLiquidity: false,
                beforeSwap: false,
                afterSwap: true,
                beforeDonate: false,
                afterDonate: false,
                beforeSwapReturnDelta: false,
                afterSwapReturnDelta: true,
                afterAddLiquidityReturnDelta: false,

  • on-chainlaunchpad.fees: protocol fee 1%; creator tax 2%

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• InfoWebsite domain registered on token launch daywebsiteAI

  The surplusllm.com domain creation date is 2026-10-04, the same day the token was deployed. The Wayback Machine has snapshots from 2024, which suggests the domain was previously registered or re-registered. This is context only.

  Evidence

  • on-chainsite.domainCreatedAt 2026-10-04T14:44:48.000Z; waybackFirstSeen 2024-08-28T16:22:51Z; deployedAt 2026-10-04T17:08:24.000Z

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• InfoScanner bot: usage figures come only from Surplus's own gatewaysocialAI

  LarpCheck, an automated scanner, replied that the token-volume post matches Surplus's own stats page and API, but usage is not confirmed by anything outside that gateway, and it explicitly did not check the coin. That is an allegation about unverifiable off-chain metrics, not an on-chain rug finding. No third-party posts in the search results called this contract a scam, rug, or honeypot.

  Evidence

  • Xhttps://x.com/Larpcheckbot/status/2118147024746844367
    Show source

    NARRATIVE: PARTLY REAL 52 · COIN: NOT CHECKED The post's numbers match Surplus's own live stats page, but the usage is counted by its own gateway and nothing outside it confirms it.

  Confirmed by: grok-4.7, gpt-5.6-sol