PonsV2LauncherToken $WAGON

Risks (8)

• HighClaim contradicted: Wagon takes 0% fees on buys and 0% fees on sells.claims-mismatchDeterministic

  Claimed 0% tax, but the simulation measured buy 4.0% / sell 4%.

  Evidence

  • Xhttps://x.com/Wagon_family/status/2118408454758895896
    Show source

    reminder: wagon takes 0 fees 🚃 no wagon fee on buys, no wagon fee on sells. you only pay gas and the pool's own fee, like anywhere else.

  • forkmeasured buy 4.0% / sell 4%

  Confirmed by: facts

• MediumUnverified bonding curve holds 44% of supply and all reservesotherAI

  The curve contract (0x5A6e…0989) holds about 44% of the token supply and all quote reserves (about $4,762). Its source is not verified. Its function list includes sweepFees, rescueFees, setCreatorFeeRecipient, setBuybackEnabled, initialize and graduate. Factory code shows these are meant to be called by the factory, but who can actually call them, and whether the curve can pause trading or move reserves elsewhere, cannot be confirmed without the source. The simulation shows normal behaviour today.

  Evidence

  • on-chainrelatedContracts: bonding curve 0x5A6e922e013E8615057b362b29a3F3B015810989 verified=false
  • on-chaintopHolders: 0x5A6e922e013E8615057b362b29a3F3B015810989 pct 44.0938 label bonding curve
  • codePonsV2LaunchFactory.sol:L1222-L1226
    Show source

    function rescueCurveFees(address token) external onlyOwner nonReentrant {
            LaunchedToken storage launch = _launchedTokens[token];
            if (!launch.exists) revert TokenNotFound();
            PonsV2BondingCurve(payable(launch.curve)).rescueFees();
        }

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• MediumLaunchpad owner can redirect reserves if graduation seeding failsownershipAI

  The factory owner (0x263e…19Dd) can force-sweep a curve's reserves into the factory, but only when the graduation seed check says a Uniswap pool cannot be created. Seven days after a sweep, the owner can send all swept quote and tokens to any single address of their choice. Pool creation stays permissionless during that week, so any holder can block the rescue by calling createGraduatedPool. The path only opens if seeding genuinely fails. This is bounded trust in the owner, not a free drain. The factory owner cannot be renounced.

  Evidence

  • codePonsV2LaunchFactory.sol:L1109-L1123
    Show source

    function forceSweptGraduation(address token) external onlyOwner nonReentrant {
            LaunchedToken storage launch = _launchedTokens[token];
            if (!launch.exists) revert TokenNotFound();
            if (launch.phase != GraduationPhase.NotGraduated) revert WrongGraduationPhase();
            PonsV2BondingCurve curve = PonsV2BondingCurve(launch.curve);
            if (!curve.readyToGraduate()) {
                revert PonsV2BondingCurve.NotReadyToGraduate();
            }
            if (_graduationSeedable(token, launch, curve.realQuoteReserve(), curve.tokenReserve())) {
                revert GraduationStillViable();
            }
    
            _sweepCurve(token, launch, curve);
            emit LaunchForceSwept(token);
        }

  • codePonsV2LaunchFactory.sol:L1254-L1285
    Show source

    function rescueSweptGraduation(address token, address recipient) external onlyOwner nonReentrant {
            LaunchedToken storage launch = _launchedTokens[token];
            if (!launch.exists) revert TokenNotFound();
            if (launch.phase != GraduationPhase.Swept) revert WrongGraduationPhase();
            if (recipient == address(0)) revert ZeroAddress();
    
            uint256 availableAt = launch.sweptAt + GRADUATION_RESCUE_DELAY;
            if (block.timestamp < availableAt) revert GraduationRescueTooEarly(availableAt);
    
            uint256 quoteAmount = launch.sweptQuote;
            uint256 tokenAmount = launch.sweptTokens;
            address pairToken = launch.pairToken;
    
            launch.sweptQuote = 0;
            launch.sweptTokens = 0;

  • codePonsV2LaunchFactory.sol:L630-L632
    Show source

    function renounceOwnership() public pure override {
            revert OwnershipCannotBeRenounced();
        }

  • on-chainfactory owner = 0x263ed295dAFaE1d9AAdD6E56c4B6F9f38eE019Dd

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• MediumOne funder's six wallets hold about 10.8% of supplyinsidersAI

  A single funder, 0xf70d…dbef, financed six wallets. Three of them are in the top holder list (3.73%, 2.30%, 2.15%). Together the six hold 10.78% of supply. If this is one entity, it can sell a large block at once and move the curve price sharply.

  Evidence

  • on-chainclusters: funder 0xf70da97812cb96acdf810712aa562db8dfa3dbef pctSupplyHeldNow 10.7766

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• MediumBuyback-and-burn claim unsupported: 4.45% burned, no buybacksclaims-mismatchAI

  Burn addresses hold 4.4509% rather than 5%, and the burn analysis found zero buyback burns. The only identified burn event was attributed to the deployer, so the claimed buyback-and-burn is not supported.

  Evidence

  • Xhttps://x.com/Wagon_family/status/2118397402717589517
    Show source

    5% of supply bought back and burned

  • on-chaintoken.burns.burnedPct = 4.4509; token.burns.count = 1; token.burns.buybackBurns = 0
    Show source

    Burn addresses hold 4.4509% of supply

  • on-chaintoken.burns.by address = 0x38c8b866eee4643231e5df9208fcb1e50a5bbcde; kind = deployer; count = 1; buyback = 0
    Show source

    address: 0x38c8b866eee4643231e5df9208fcb1e50a5bbcde, kind: deployer, count: 1, buyback: 0

  Confirmed by: gpt-5.6-sol · Disputed by: claude-opus-5.5

• LowLaunch sniped: 4 wallets took 21.9% of supply in 10 secondssnipersDeterministic

  The launch was captured: 4 wallets bought 21.9% of the supply within 10 seconds. A small, fast group set the early price and could sell into everyone who bought later — bad for launch fairness and a strong insider/bot signal. They now hold 0% of supply, so current dump pressure from them is low — most of it was already sold, i.e. they exited on later buyers.

  Evidence

  • on-chainsnipers: windowBlocks=100, wallets=4, pctSupplyBought=21.9496, pctSupplyHeldNow=0
  • on-chainsnipers: pctSupplyBought 21.9496, pctSupplyHeldNow 0
  • on-chainbundles: block 90447111 pctSupply 15.93

  Confirmed by: facts, claude-opus-5.5

• LowLaunchpad owner can redirect the 3% creator fee after 3 daysfeesAI

  The factory owner can propose a new creator-fee recipient for any launch. Once the 3-day timelock passes, anyone can execute the change during a 3-day window. This redirects the 3% creator tax and the buyback-vest beneficiary. It does not touch holders' tokens or the trade price. The fee rates themselves are fixed per launch and cannot be raised after launch.

  Evidence

  • codePonsV2LaunchFactory.sol:L946-L974
    Show source

    function setCreatorFeeRecipient(address token, address newRecipient) external onlyOwner {
            LaunchedToken storage launch = _launchedTokens[token];
            if (!launch.exists) revert TokenNotFound();
            if (newRecipient == address(0)) revert ZeroAddress();
    
            uint256 effectiveAt = block.timestamp + CREATOR_FEE_RECIPIENT_TIMELOCK;
            uint256 expiresAt = effectiveAt + CREATOR_FEE_RECIPIENT_EXECUTION_WINDOW;
            pendingCreatorFeeRecipient[token] =
                PendingCreatorFeeRecipient({newRecipient: newRecipient, effectiveAt: effectiveAt, expiresAt: expiresAt});
    
            emit CreatorFeeRecipientChangeProposed(token, launch.creatorFeeRecipient, newRecipient, effectiveAt, expiresAt);
        }
    
        /**
         * @notice Applies a protocol-owner's proposed creator fee recipient

  • codePonsV2LaunchFactory.sol:L988-L1006
    Show source

    function _setCreatorFeeRecipient(address token, LaunchedToken storage launch, address newRecipient) private {
            if (newRecipient == address(0)) revert ZeroAddress();
    
            address previousRecipient = launch.creatorFeeRecipient;
            launch.creatorFeeRecipient = newRecipient;
    
            if (launch.phase == GraduationPhase.PoolCreated) {
                memeHook.setCreatorFeeRecipient(_poolIdFor(token, launch), newRecipient);
            } else {
                PonsV2BondingCurve(launch.curve).setCreatorFeeRecipient(newRecipient);
            }
    
            // Keep the buyback vest's beneficiary aligned with the live creator
            // recipient so recovery and self-service transfers redirect vested
            // buyback tokens as well, not only immediate fee payouts.

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• LowTiny side Uniswap v4 pools have unlocked liquidityliquidityAI

  The token has not graduated, so no official Pons-locked pool exists yet. Facts show three small Uniswap v4 pools ($1–2 of liquidity each). Their positions are held by unlocked wallets. These pools are not the launchpad's graduation pool. Trading in them carries extreme slippage, and their liquidity can be pulled at any time.

  Evidence

  • on-chainuniswap-v4 0x04c727f2e1…: v4 position liquidity holders: 0xb1b6d40d2af54cfa9dd61d95eae80dfb6a0da808 [other: wallet (unlocked)] 100%
  • on-chainuniswap-v4 0x2fe080a621…: v4 position liquidity holders: 0xfd2a475d7ce02ec077867d72177063b5c2ab01b6 [other: wallet (unlocked)] 100%
  • on-chainlaunchpad graduated=false

  Confirmed by: claude-opus-5.5 · Disputed by: gpt-5.6-sol

Positive signals (2)

• PositiveToken is an ownerless fixed-supply template with no admin powersownershipAI

  The token adds no logic on top of OpenZeppelin ERC20 and ERC20Burnable. The whole supply is minted once to the bonding curve in the constructor. There is no owner, no mint after deploy, no transfer hook, no fee, no blacklist and no pause. The deployer field is reference data only. Nobody can change balances or block transfers at the token level.

  Evidence

  • codePonsV2LauncherToken.sol:L21-L71
    Show source

    contract PonsV2LauncherToken is ERC20, ERC20Burnable {
        struct Socials {
            string twitter;
            string telegram;
            string discord;
            string website;
            string farcaster;
        }
    
        error ZeroAddress();
    
        address public immutable deployer;
        address public immutable launchFactory;
        address public immutable curve;

  • codeERC20.sol:L176-L204
    Show source

    function _update(address from, address to, uint256 value) internal virtual {
            if (from == address(0)) {
                // Overflow check required: The rest of the code assumes that totalSupply never overflows
                _totalSupply += value;
            } else {
                uint256 fromBalance = _balances[from];
                if (fromBalance < value) {
                    revert ERC20InsufficientBalance(from, fromBalance, value);
                }
                unchecked {
                    // Overflow not possible: value <= fromBalance <= totalSupply.
                    _balances[from] = fromBalance - value;
                }
            }

  • staticprivileges: [] ; slither issues: []

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• PositiveBuys and sells work on the curve at about a 4% feehoneypotAI

  The fork simulation bought and sold on the Pons bonding curve. A second wallet that received tokens by transfer could also sell, and a sell one hour later succeeded. The measured tax (about 3.98% on buys, 4% on sells, 0% on transfers) matches the curve fees: 1% protocol fee and 3% creator tax. The snipe tax has already decayed to 0.

  Evidence

  • forkcanBuy=true, canSell=true, buyTaxPct=3.98, sellTaxPct=4, transferTaxPct=0
  • forksecond wallet (received via transfer) could sell; sell after +1h: ok
  • on-chaincurve: graduated=false, feeBps=100, creatorTaxBps=300, snipeTaxNow=0bps over 3s

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

Notes (2)

• InfoOne-time burn: 4.5% of supply sent to a burn addressburnDeterministic

  4.5% of the supply ever minted is burned (at least: the transfer history was read partially), in 1 burn transfer(s), last 2026-10-16. Burned by: the deployer 0x38c8…bcde (0.96%, 1 burn). This happened once, around launch; there is no sign of a continuing burn mechanism.

  Evidence

  • on-chainTransfer events to 0x0 / 0x…dEaD and balanceOf(burn addresses) of 0x5804beee8368132d32ad4b8818ce86eba9c4bd37
  • on-chainDeployer 0x38c8b866eee4643231e5df9208fcb1e50a5bbcde holds 0% now
  • on-chainburns: burnedPct 4.4509, by deployer count 1
  • on-chaindeployerSoldPct computed from partial transfer history

  Confirmed by: facts, claude-opus-5.5

• InfoWebsite domain registered on launch daywebsiteAI

  wagon.family was registered about three hours before the token was deployed. Wayback first saw it the next day. The site presents a trading terminal. Our dApp buy and sell tests could not run because the test wallet had no funds on the chain the UI used, so they say nothing about the site's safety either way.

  Evidence

  • webhttps://wagon.family/
  • on-chaindeployedAt 2026-10-16T22:48:52.000Z
  • forkBuy token: driver fail — 'Not enough ETH' on Robinhood Chain (test inconclusive)

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol