Nullmask $MASK

Risks (8)

• HighPool liquidity is neither burned nor lockedliquidityDeterministic

  Only 0% of the Meteora DLMM pool's LP is burned or locked. Whoever holds the LP tokens can withdraw the liquidity ("rug pull") at any time.

  Evidence

  • on-chainpool D1rDVEp78cvBctREKZmpLdRnPNe3Ufmgq6ZjMYye9kmq (Meteora DLMM): lpBurnedPct=0, lpLockedPct=0

  Confirmed by: facts

• HighFee authority can raise the transfer feefeesDeterministic

  The transfer-fee config authority (5KXDF6QnqhBj72hDtJNkkpFaQVUfbFXNybMsp3DiK6tD) can change the fee charged on every transfer (now 3%), so the fee can be raised after people buy.

  Evidence

  • on-chaintoken-2022 transferFeeConfig authority = 5KXDF6QnqhBj72hDtJNkkpFaQVUfbFXNybMsp3DiK6tD
    Show source

    transfer fee 3% (max 1,000,000,000 tokens per transfer); fee authority 5KXDF6QnqhBj72hDtJNkkpFaQVUfbFXNybMsp3DiK6tD can raise it up to 100%; withdraw authority 5KXDF6QnqhBj72hDtJNkkpFaQVUfbFXNybMsp3DiK6tD; withheld 440.398439

  • on-chaintoken-2022 extension transferFeeConfig authority=5KXDF6QnqhBj72hDtJNkkpFaQVUfbFXNybMsp3DiK6tD
    Show source

    transfer fee 3% (max 1,000,000,000 tokens per transfer); fee authority 5KXDF6QnqhBj72hDtJNkkpFaQVUfbFXNybMsp3DiK6tD can raise it up to 100%

  • on-chaintransferFeeBps = 300, settableBy fee authority 5KXDF6QnqhBj72hDtJNkkpFaQVUfbFXNybMsp3DiK6tD
    Show source

    ≤ 10000 (100%)

  • on-chainAUTHORITY transfer-fee-config = 5KXDF6QnqhBj72hDtJNkkpFaQVUfbFXNybMsp3DiK6tD (wallet)

  Confirmed by: facts, claude-opus-5.5, grok-4.7, gpt-5.6-sol

• HighDeployer took ~41.5% at launch and still holds ~40%holdersAI

  The creator wallet FrXTvkebakR2oNctgsHz1yeijmu9wTZifL3FmffJP5xJ bought or received 41.5683% of supply in the launch slots and still holds 39.8833%. It has sold only about 4% of its peak balance. Selling that stack into the pools would crash the price. Top-10 holders control 57.39% of supply.

  Evidence

  • on-chainDeployer FrXTvkebakR2oNctgsHz1yeijmu9wTZifL3FmffJP5xJ holds 39.8833% now
  • on-chainDeployer bought/received 41.5683% of supply at launch (slot 449654074–449654075)
  • on-chaindeployerSoldPct = 4.0533; top10Pct = 57.3943
  • on-chaintop10Pct = 57.3943
    Show source

    top10Pct: 57.3943

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• HighDeployer can withdraw 30% of the main pool's unlocked liquidityliquidityAI

  The largest pool is Raydium CPMM 4GWh5saKgzoukhhj4Rh3p5FmPU6yPuAexV6FaH5JQYfm (MASK/ZEC, about $682,897). It is also the pool the bonding curve graduated into. None of its LP tokens are burned or locked, and the deployer holds 30.29% of them. The deployer can withdraw that share of the pool's liquidity at any time. No other pool shows burned or locked LP either. The Meteora DLMM and Orca Whirlpool positions belong to other wallets and can also be withdrawn by their owners.

  Evidence

  • on-chain[pools] Raydium CPMM 4GWh5saKgzoukhhj4Rh3p5FmPU6yPuAexV6FaH5JQYfm: pool lp_supply 504802927145, LP mint supply 504802927045 → 0% burned (Burn instructions + incinerator), locked 0%, deployer 30.29%
  • on-chainlaunchpad graduatedPool = 4GWh5saKgzoukhhj4Rh3p5FmPU6yPuAexV6FaH5JQYfm

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumToken name, symbol and image can still be changedownershipDeterministic

  The token metadata is mutable (update authority WLHv2UAZm6z4KyaaELi5pjdbJh6RESMva1Rnn8pJVVh). The holder can rename the token or swap its logo/links later — used in impersonation and bait-and-switch scams.

  Evidence

  • on-chainmetadata.mutable = true; updateAuthority = WLHv2UAZm6z4KyaaELi5pjdbJh6RESMva1Rnn8pJVVh
  • on-chainAUTHORITY update = WLHv2UAZm6z4KyaaELi5pjdbJh6RESMva1Rnn8pJVVh (pda) [off-curve address with no account (PDA)]
  • on-chainmetadata name="Nullmask" symbol="MASK" mutable=true updateAuthority=WLHv2UAZm6z4KyaaELi5pjdbJh6RESMva1Rnn8pJVVh
  • on-chaintoken-2022 extension metadataPointer authority=null
    Show source

    pointer authority none

  Confirmed by: facts, claude-opus-5.5, grok-4.7

• MediumTwo top holders share the deployer's funding walletinsidersAI

  Wallet iGdFcQoyR2MwbXMHQskhmNsqddZ6rinsipHc4TNSdwu first funded the deployer. It also funded holders 9BMzTpSo4URse1oN666pmexhdjpU1vA5p7LtroCFQdLU (3.1037%) and G53BqVueoKBktnpe5CNd2xDtG63ddsMwD7bx5GpfTDvg (1.0098%), which together hold 4.1135%. If these wallets belong to the same party, insiders control roughly 44% of supply. A shared funder can also be an exchange or bot, so this is a signal, not proof. A second cluster funded by 5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9 holds 2.2552%.

  Evidence

  • on-chainDeployer was first funded by iGdFcQoyR2MwbXMHQskhmNsqddZ6rinsipHc4TNSdwu
  • on-chaincluster funder iGdFcQoyR2MwbXMHQskhmNsqddZ6rinsipHc4TNSdwu wallets [9BMzTpSo4URse1oN666pmexhdjpU1vA5p7LtroCFQdLU, G53BqVueoKBktnpe5CNd2xDtG63ddsMwD7bx5GpfTDvg] pctSupplyHeldNow 4.1135
  • on-chainCommon funders may be exchanges / bots funding many unrelated wallets — clusters are a signal, not proof

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumAds promise untraceable privacy; docs say the operator can see activityclaims-mismatchAI

  The X account sells Nullmask as a ZK protocol with untraceable, fully private payments. The official docs say the opposite in plain language: the operator can read your private balance and history, deposits and withdrawals are public, and the project does not promise activity can never be linked. Anyone depositing into the shared pool on the basis of the X claims is trusting an operator who can see the activity the ads say nobody can see.

  Evidence

  • Xhttps://x.com/NullMaskio/status/2117245047561461793
    Show source

    Send a link. Get paid into your private balance. No sender, no recipient, no amount on-chain.

  • webhttps://nullmask.io/docs/privacy
    Show source

    Nullmask protects your activity from outside observers, not from the operator.

  • webhttps://nullmask.io/docs/security
    Show source

    They let Nullmask read your private balance and history, and they cannot spend.

  • webhttps://nullmask.io/docs/privacy
    Show source

    Nullmask does not promise that your activity can never be linked.

  Confirmed by: grok-4.7 · Disputed by: gpt-5.6-sol

• MediumPosts claim six live chains, docs list only Ethereum and Baseclaims-mismatchAI

  Official posts say Nullmask is live on Avalanche, BNB Chain, Solana, Robinhood Chain and PancakeSwap, on top of Ethereum and Base. The website and network docs still say the product runs only on Ethereum and Base, with those two apps and pool networks. Chain coverage used to sell the token does not match the published product docs, so those launch claims are unverified.

  Evidence

  • Xhttps://x.com/NullMaskio/status/2116188287920709728
    Show source

    NullMask is LIVE on @avax. Chain #6 joins Ethereum, Base, BNB Chain, Robinhood Chain and Solana.

  • webhttps://nullmask.io/docs/networks
    Show source

    Nullmask runs on Ethereum and Base. The pool contract has the same address on both.

  • webhttps://nullmask.io/
    Show source

    confidential transfers, swaps and bridging for tokens and stablecoins on Ethereum and Base.

  Confirmed by: grok-4.7, gpt-5.6-sol

Positive signals (3)

• PositiveMint and freeze authority revoked, supply fixedmintAI

  Mint authority is revoked, so no new MASK can ever be created and the supply of 963,520,244.548304 is fixed. Freeze authority is also revoked, so nobody can freeze a holder's account. No permanent delegate, transfer hook, default-frozen state or pausable extension is present.

  Evidence

  • on-chainmintAuthority = null (revoked)
  • on-chainfreezeAuthority = null (revoked)
  • on-chaintoken-2022 extensions: metadataPointer, transferFeeConfig, tokenMetadata

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveSelling works today at about 6.4% round-trip costhoneypotAI

  A Jupiter quote routed through Meteora DLMM shows buys and sells both work. A 0.1 SOL round trip loses 6.37%, which includes the 3% transfer fee on each leg, pool fees and 7.82% price impact. A read-only sell simulation from an existing holder succeeded. This holds only at the current fee level.

  Evidence

  • forksell quote: 405706057 tokens → 0.093628066 SOL; round-trip loss 6.37% (price impact 7.82%, LP/protocol fees and Token-2022 fees included)
  • forksimulateTransaction: SELL of 405706057 raw tokens by existing holder 9BMzTpSo4URse1oN666pmexhdjpU1vA5p7LtroCFQdLU succeeds (read-only simulation, not signed/sent)

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• PositiveDocs openly disclose operator visibility and loss riskwebsiteAI

  Unlike the ads, the docs tell users the operator can read private state, that the team operates the pool contracts, and not to deposit more than they can afford to lose. That disclosure is a transparency plus for people who read the docs, not a guarantee funds are safe.

  Evidence

  • webhttps://nullmask.io/docs
    Show source

    Nullmask is new software. Read the before you deposit, and do not deposit more than you can afford to lose.

  • webhttps://nullmask.io/docs/security
    Show source

    Nullmask operates the pool contracts.

  Confirmed by: grok-4.7, gpt-5.6-sol

Notes (6)

• LowFee wallet collects all withheld transfer feesfeesAI

  The withdraw-withheld authority is the same wallet that controls the fee rate. It can sweep the 3% fees withheld in holder accounts to itself. About 440.398439 MASK is currently withheld. This is income for whoever controls the wallet. It does not take holders' own balances.

  Evidence

  • on-chainAUTHORITY withdraw-withheld = 5KXDF6QnqhBj72hDtJNkkpFaQVUfbFXNybMsp3DiK6tD (wallet)
  • on-chaintoken-2022 extension transferFeeConfig
    Show source

    withdraw authority 5KXDF6QnqhBj72hDtJNkkpFaQVUfbFXNybMsp3DiK6tD; withheld 440.398439

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• LowRaydium and Meteora programs are upgradeable, builds unverifiedproxy-upgradeAI

  Raydium CPMM and Raydium LaunchLab can be upgraded by a Squads v4 multisig, FytDrVzDybM1TwFQPGb8qaxZR7dBCzNeqT3vtQsceZQK. Meteora DLMM is upgradeable by a PDA, JADaUV8kvDpDbJr55wxXJHVaBS3VCj8thZZHjfeuCVLd. OtterSec reports none of the three on-chain builds as verified. These are widely used protocol programs, not project code. Still, holders must trust their multisig and governance controllers. Raydium CPMM also has an admin update_pool_status instruction that its authority could use to change a pool's status.

  Evidence

  • on-chainupgrade authority FytDrVzDybM1TwFQPGb8qaxZR7dBCzNeqT3vtQsceZQK: multisig (Squads v4 multisig vault (PDA))
  • on-chainPROGRAM pool LBUZKhRxPF3XUpBCjp4YzTKgLccjZhTSDM9YuVaPwxo (Meteora DLMM) upgradeAuthority=JADaUV8kvDpDbJr55wxXJHVaBS3VCj8thZZHjfeuCVLd (program) verifiedBuild=false
  • on-chainix update_pool_status(status: u8) signers=[authority] risk=high

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• InfoLaunch snipers bought 1.6% and have fully soldsnipersAI

  Two wallets bought 1.5681% of supply in the first 25 slots (about 10 seconds) after launch. They hold nothing now. No bundles were detected.

  Evidence

  • on-chainLaunch slot 449654074; sniper window 25 slots (≈10s at 400 ms/slot); 2 buys by 2 wallets in window
  • on-chainsnipers pctSupplyBought 1.5681, pctSupplyHeldNow 0; bundles []

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• InfoDeployer has no earlier token launchesdeployer-historyAI

  The creator's full history of 225 transactions shows only this one mint, so there is no record of earlier rugs. The project website was archived from 2025-11-06, about ten months before the token was created on 2026-09-23.

  Evidence

  • on-chaindeployerHistory: scanned the creator's 225 most recent successful txs (full history); found 1 mint(s) created, 0 other than this one
  • webhttps://web.archive.org/web/20251106010229/https://nullmask.io/

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• InfoMetadata names an unidentified launchpad, StonkFunclaims-mismatchAI

  The off-chain metadata says the token "was launched on StonkFun". On-chain, the launch went through Raydium LaunchLab, curve HGMEiG5yyYPx7NYJeeugSQbxXEVEEkQt8yG63rrBbq6, using platform config 6BwHHDg3u1854jC8PDLXvR4spTcLNaoBxLJNGC4nTESt. StonkFun may be a front-end platform built on LaunchLab, but this could not be confirmed. It is unverifiable, not a risk by itself.

  Evidence

  • on-chainmetadata offchain description
    Show source

    Nullmask was launched on StonkFun.

  • on-chain[launchpad] Raydium LaunchLab (bonk.fun et al.) pool HGMEiG5yyYPx7NYJeeugSQbxXEVEEkQt8yG63rrBbq6: status 2 (migrated)

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• InfoFounder named, but Zcash contributor claim is unprovensocialAI

  The project names Tomas Krnak as founder and his X bio links to nullmask.io. That account is unverified and has 15 followers, so it is a weak public identity, not proof he was a core Zcash contributor. The "core $ZEC contributors" line in the project bio is only the project's own claim.

  Evidence

  • Xhttps://x.com/NullMaskio/status/2117929700547006912
    Show source

    Tomorrow, our founder Tomas Krnak shares his story, from Zcash and Trezor to building NullMask.

  Confirmed by: grok-4.7