ORYLIA

Risks (10)

• MediumSource code is not verifiedotherDeterministic

  The contract source is not published on the explorer, so nobody can read what it really does. The analysis relies on bytecode only.

  Evidence

  • on-chainexplorer: no verified source for 0x627E45cA536c6CeCEDcD9D9BaE0e0B11d5cB9bAa
  • on-chaincontract.verified = false; sourceFileCount = 0
    Show source

    "verified": false

  • on-chainrelatedContracts: bonding curve 0x94ab19Db0935822484e19E984E14bbd49fE5030A verified=false
  • staticslither ran=false: no verified source available
  • codePonsV2LaunchFactory.sol:L839-L847
    Show source

    PonsV2BondingCurve(curve).initialize(token);
    
            // The creator's own addresses never count as snipers on their own
            // launch: an atomic dev buy lands in the launch second, exactly when
            // the tax peaks, and would otherwise be consumed by it.
            PonsV2BondingCurve(curve).exemptFromSnipeTax(originalDeployer);
            if (creatorFeeRecipient != originalDeployer) {
                PonsV2BondingCurve(curve).exemptFromSnipeTax(creatorFeeRecipient);
            }

  Confirmed by: facts, claude-opus-5.5, gpt-5.6-sol

• MediumLaunchpad owner can redirect creator fees after a 3-day timelockownershipAI

  The factory owner (0x263e…19Dd) can propose a new creator fee recipient for any launch. After a 3-day timelock, anyone can execute it within a 3-day window. The change also redirects the buyback-vault vest. This affects where the 1.56% creator tax goes, not holders' tokens. Factory ownership cannot be renounced (L630-L632), so this power is permanent unless ownership is transferred.

  Evidence

  • codePonsV2LaunchFactory.sol:L946-L957
    Show source

    function setCreatorFeeRecipient(address token, address newRecipient) external onlyOwner {
            LaunchedToken storage launch = _launchedTokens[token];
            if (!launch.exists) revert TokenNotFound();
            if (newRecipient == address(0)) revert ZeroAddress();
    
            uint256 effectiveAt = block.timestamp + CREATOR_FEE_RECIPIENT_TIMELOCK;
            uint256 expiresAt = effectiveAt + CREATOR_FEE_RECIPIENT_EXECUTION_WINDOW;
            pendingCreatorFeeRecipient[token] =
                PendingCreatorFeeRecipient({newRecipient: newRecipient, effectiveAt: effectiveAt, expiresAt: expiresAt});
    
            emit CreatorFeeRecipientChangeProposed(token, launch.creatorFeeRecipient, newRecipient, effectiveAt, expiresAt);
        }

  • codePonsV2LaunchFactory.sol:L988-L1006
    Show source

    function _setCreatorFeeRecipient(address token, LaunchedToken storage launch, address newRecipient) private {
            if (newRecipient == address(0)) revert ZeroAddress();
    
            address previousRecipient = launch.creatorFeeRecipient;
            launch.creatorFeeRecipient = newRecipient;
    
            if (launch.phase == GraduationPhase.PoolCreated) {
                memeHook.setCreatorFeeRecipient(_poolIdFor(token, launch), newRecipient);
            } else {
                PonsV2BondingCurve(launch.curve).setCreatorFeeRecipient(newRecipient);
            }
    
            // Keep the buyback vest's beneficiary aligned with the live creator
            // recipient so recovery and self-service transfers redirect vested
            // buyback tokens as well, not only immediate fee payouts.

  • codePonsV2LaunchFactory.sol:L630-L632
    Show source

    function renounceOwnership() public pure override {
            revert OwnershipCannotBeRenounced();
        }

  • on-chainfactory owner = 0x263ed295dAFaE1d9AAdD6E56c4B6F9f38eE019Dd

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• MediumOwner can take curve reserves if graduation stays unseeded 7 daysliquidityAI

  When the curve graduates, its ETH and tokens are swept into the factory. Anyone can then call createGraduatedPool to seed a locked Uniswap v4 position. If no successful seed happens within 7 days, the factory owner can call rescueSweptGraduation. That sends all swept ETH and tokens to any recipient the owner chooses, for promised off-chain distribution. The owner can only force a sweep when the seed is genuinely unviable (L1117-L1119). Any holder can close this path by seeding the pool. So it is a narrow, delayed trust assumption, not a direct rug path.

  Evidence

  • codePonsV2LaunchFactory.sol:L1254-L1285
    Show source

    function rescueSweptGraduation(address token, address recipient) external onlyOwner nonReentrant {
            LaunchedToken storage launch = _launchedTokens[token];
            if (!launch.exists) revert TokenNotFound();
            if (launch.phase != GraduationPhase.Swept) revert WrongGraduationPhase();
            if (recipient == address(0)) revert ZeroAddress();
    
            uint256 availableAt = launch.sweptAt + GRADUATION_RESCUE_DELAY;
            if (block.timestamp < availableAt) revert GraduationRescueTooEarly(availableAt);
    
            uint256 quoteAmount = launch.sweptQuote;
            uint256 tokenAmount = launch.sweptTokens;
            address pairToken = launch.pairToken;
    
            launch.sweptQuote = 0;
            launch.sweptTokens = 0;

  • codePonsV2LaunchFactory.sol:L1109-L1123
    Show source

    function forceSweptGraduation(address token) external onlyOwner nonReentrant {
            LaunchedToken storage launch = _launchedTokens[token];
            if (!launch.exists) revert TokenNotFound();
            if (launch.phase != GraduationPhase.NotGraduated) revert WrongGraduationPhase();
            PonsV2BondingCurve curve = PonsV2BondingCurve(launch.curve);
            if (!curve.readyToGraduate()) {
                revert PonsV2BondingCurve.NotReadyToGraduate();
            }
            if (_graduationSeedable(token, launch, curve.realQuoteReserve(), curve.tokenReserve())) {
                revert GraduationStillViable();
            }
    
            _sweepCurve(token, launch, curve);
            emit LaunchForceSwept(token);
        }

  • codePonsV2LaunchFactory.sol:L104
    Show source

    uint256 public constant GRADUATION_RESCUE_DELAY = 7 days;

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• MediumVery thin market: 25 holders and about $1,205 liquidityholdersAI

  The token has only 25 holders, and the bonding curve holds about $1,205 of liquidity. The top 10 non-curve holders control 20.39%. Any single holder of 2-3% selling will move the price sharply.

  Evidence

  • on-chaintoken.holdersCount = 25; top10Pct = 20.3866
  • on-chainliquidity pons-v2-bonding-curve 0x94ab19Db0935822484e19E984E14bbd49fE5030A liquidityUsd 1205

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• MediumWallets funded by the same sources hold about 9% of supplyinsidersAI

  Funder 0x5118…6f72 funded three top holders that together hold 5.83%: - 0xdc186cd7… - 0x30d81c46… - 0x3d31b1e1… Two other funders control 2.149% and 0.98%. These look like single entities spread across wallets and could sell together.

  Evidence

  • on-chainclusters: funder 0x511808449be470efaf4131838b2d4998500a6f72 pctSupplyHeldNow 5.8295
  • on-chainclusters: funder 0x53091256ebd2d8aa37b45536a5fd864ca764f32f pctSupplyHeldNow 2.149
  • on-chainclusters: funder 0xf70da97812cb96acdf810712aa562db8dfa3dbef pctSupplyHeldNow 0.9796

  Confirmed by: claude-opus-5.5 · Disputed by: gpt-5.6-sol

• LowLaunch sniped: 13 wallets took 13.1% of supply in 11 secondssnipersDeterministic

  The launch was captured: 13 wallets bought 13.1% of the supply within 11 seconds. A small, fast group set the early price and could sell into everyone who bought later — bad for launch fairness and a strong insider/bot signal. They now hold 0.22% of supply, so current dump pressure from them is low — most of it was already sold, i.e. they exited on later buyers.

  Evidence

  • on-chainsnipers: windowBlocks=100, wallets=13, pctSupplyBought=13.073, pctSupplyHeldNow=0.2235
  • on-chainsnipers.pctSupplyBought = 13.073; pctSupplyHeldNow = 0.2235
  • on-chainbundles: block 106820271 pctSupply 4.8476; block 106820272 commonFunder 0xf70da97812cb96acdf810712aa562db8dfa3dbef pctSupply 3.9598

  Confirmed by: facts, claude-opus-5.5

• LowOwner can change factory address used by locker and buyback vaultownershipAI

  The LaunchLocker and BuybackVault each have an owner-only setFactory(address). Their owner is the same address as the factory owner. Only the 'factory' address may call lockPosition/lockTokenSupply on the locker and updateCreatorRecipient on the vault. Whether swapping the factory could let a new contract withdraw locked LP or vested buyback tokens cannot be checked, because those sources were omitted. This is a trust point on the launchpad operator.

  Evidence

  • on-chainLP-locker setFactory(address) [owner] @PonsV2LaunchLocker.sol:L60-L66; owner = 0x263ed295dAFaE1d9AAdD6E56c4B6F9f38eE019Dd
  • on-chainbuyback-vault setFactory(address) [owner] @PonsV2BuybackVault.sol:L98-L104; owner = 0x263ed295dAFaE1d9AAdD6E56c4B6F9f38eE019Dd

  Confirmed by: claude-opus-5.5 · Disputed by: gpt-5.6-sol

• LowX post says 'burn all supply', but only 0.75% was burnedclaims-mismatchAI

  Only 0.7483% of the supply was burned in one deployer burn, while the token still reports a total supply of 1,000,000,000 tokens. The burn was not ongoing, so this is not an all-supply burn.

  Evidence

  • Xhttps://x.com/oryliaai/status/2118356279089619211
    Show source

    Burn all supply $ORYLIA.

  • on-chainBurn addresses hold 0.7483% of supply
    Show source

    Burn addresses hold 0.7483% of supply

  • on-chaintoken.burns: burnedPct=0.7483, count=1, ongoing=false, by deployer 0x527a1299475ff48bc628975e42b6cffa85287f0e
    Show source

    burnedPct: 0.7483; count: 1; ongoing: false

  • on-chaintotalSupply() = 1000000000000000000000000000
    Show source

    totalSupply: 1000000000000000000000000000

  • on-chainholdersCount: 25; top10Pct: 20.3866
    Show source

    holdersCount: 25, top10Pct: 20.3866

  Confirmed by: gpt-5.6-sol, grok-4.7 · Disputed by: claude-opus-5.5, grok-4.7

• LowDocs page is an unedited Fumadocs template, not real docswebsiteAI

  The linked Documentation page is the stock Fumadocs framework tutorial (install commands, localhost URLs, “What is Fumadocs”), not documentation of Orylia billing, models, or the token. Holders cannot use this page to verify how the product or the coin works.

  Evidence

  • webhttps://orylia.ai/docs
    Show source

    Getting Started with Fumadocs

  • webhttps://orylia.ai/docs
    Show source

    http://localhost:3000/docs

  Confirmed by: grok-4.7, gpt-5.6-sol

• LowProduct website never mentions the tokenwebsiteAI

  orylia.ai presents a paid AI image/video studio (Stripe plans, credits, trust/billing). The homepage, About, and Trust pages in the fetched text do not mention $ORYLIA, a contract, or a chain. The same-day X account both sells that site and posts token actions (DEX paid, burn all supply). The coin is not explained on the site buyers are pointed to.

  Evidence

  • webhttps://orylia.ai/
    Show source

    Free AI image & video generator. Describe an idea and the agent auto-picks the best model

  • webhttps://orylia.ai/about
    Show source

    Orylia is an AI visual studio built for people who care how the result actually looks.

  • Xhttps://x.com/oryliaai/status/2118356279089619211
    Show source

    Burn all supply $ORYLIA.

  Confirmed by: grok-4.7, gpt-5.6-sol

Positive signals (3)

• PositiveBuy and sell work in simulation at about 2.56% feehoneypotAI

  A fork simulation bought on the bonding curve and sold part of the tokens back. A second wallet that received tokens by transfer could also sell, and a sell one hour later succeeded. Measured buy tax was 2.55% and sell tax 2.56%. This matches the curve fee of 1% (feeBps=100) plus a creator tax of 1.56% (creatorTaxBps=156). Transfers between wallets carry no tax. No honeypot behaviour was observed.

  Evidence

  • forksimulation: canBuy=true buyTaxPct=2.55, canSell=true sellTaxPct=2.56, transferTaxPct=0
  • forksimulation notes
    Show source

    second wallet (received via transfer) could sell

  • forksimulation notes
    Show source

    curve fees: feeBps=100, creatorTaxBps=156

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• PositiveGraduation liquidity will be locked in the Pons lockerliquidityAI

  On graduation the factory mints a full-range Uniswap v4 position and locks it in the Pons LaunchLocker (0x267444D0…) via lockPosition. Excess curve tokens are also locked permanently. Neither the creator nor the deployer receives the LP. The token has not graduated yet, so no LP exists today.

  Evidence

  • codePonsV2LaunchFactory.sol:L1386-L1402
    Show source

    (int24 tickLower, int24 tickUpper) = _fullRangeTicks(launch.tickSpacing);
            positionId = positionManager.nextTokenId();
    
            uint256 nativeValue = _fundGraduationExecutor(currency0, currency1, amount0, amount1);
            graduationExecutor.mintFullRangePosition{value: nativeValue}(
                token,
                key,
                tickLower,
                tickUpper,
                sqrtPriceX96,
                amount0,
                amount1,
                currency0,
                currency1,
                policy.protocolFeeRecipient

  • codePonsV2LaunchFactory.sol:L1293-L1306
    Show source

    function _lockExcessGraduationTokens(
            address token,
            LaunchedToken storage launch,
            uint256 sweptQuote,
            uint256 totalTokenAmount
        ) private returns (uint256 poolTokenAmount) {
            poolTokenAmount = _poolTokenAmount(launch, sweptQuote, totalTokenAmount);
    
            uint256 excess = totalTokenAmount - poolTokenAmount;
            if (excess != 0) {
                IERC20(token).forceApprove(address(locker), excess);
                locker.lockTokenSupply(token, excess);
                emit GraduationTokensPermanentlyLocked(token, excess);
            }

  • on-chainlaunchpad.graduated = false

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• PositiveDeployer holds no tokens, never sold, and burned 0.75%insidersAI

  The deployer, the only declared snipe-tax-exempt insider, holds 0% now. It made one burn of 0.7483% of supply to the dead address and has not sold.

  Evidence

  • on-chainDeployer 0x527a1299475ff48bc628975e42b6cffa85287f0e holds 0% now
  • on-chainburns.by deployer pct 0.7483; deployerSoldPct = 0

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

Notes (5)

• LowCreator tax of 1.56% is fixed at launch, capped at 10%feesAI

  The creator chose a 1.56% trade tax. The factory checks it against maxCreatorTaxBps (currently 1000 = 10%) only at launch time (L770). The factory's comments say already-launched tokens keep the tax rate they launched with. The combined fee is capped at 20% (L801-L806). The factory owner has no visible function to raise this token's fee after launch. Because the curve is unverified, the immutability of its stored rate could not be confirmed in bytecode.

  Evidence

  • codePonsV2LaunchFactory.sol:L545-L554
    Show source

    /**
         * @notice Adjusts the ceiling a creator's chosen trade tax is validated
         * against at launch time. Already-launched tokens keep the immutable
         * tax rate they launched with regardless of later ceiling changes.
         */
        function setMaxCreatorTaxBps(uint256 bps) external onlyOwner {
            if (bps > MAX_CREATOR_TAX_CEILING_BPS) revert InvalidBasisPoints();
            maxCreatorTaxBps = bps;
            emit MaxCreatorTaxUpdated(bps);
        }

  • codePonsV2LaunchFactory.sol:L770
    Show source

    if (params.creatorTaxBps > maxCreatorTaxBps) revert CreatorTaxTooHigh();

  • codePonsV2LaunchFactory.sol:L801-L806
    Show source

    if (config.curveFeeBps + params.creatorTaxBps > MAX_TOTAL_TRADE_FEE_BPS) {
                revert CombinedFeeTooHigh();
            }
            if (policy.hookFeeBps + params.creatorTaxBps > MAX_TOTAL_TRADE_FEE_BPS) {
                revert CombinedFeeTooHigh();
            }

  Confirmed by: claude-opus-5.5, gpt-5.6-sol

• LowLinked site is an AI app; its backing of the token is unconfirmedwebsiteAI

  The on-chain socials point to orylia.ai and x.com/oryliaai. The site is a 'Free AI Image and Video Generator' with no wallet connection or token functionality, according to the dApp test. From the material given, it cannot be verified that the Orylia service officially issued or endorses this token. Buyers should not assume the AI business backs the token.

  Evidence

  • webhttps://orylia.ai/
    Show source

    Free AI Image and Video Generator — Orylia

  • forkdappTests swap
    Show source

    Orylia is an AI image and video generator service, not a Web3 crypto dApp; there is no wallet connection or token swap feature.

  • on-chainOn-chain socials: twitter=https://x.com/oryliaai, website=https://orylia.ai

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• InfoOne-time burn: 0.75% of supply sent to a burn addressburnDeterministic

  0.75% of the supply ever minted is burned, in 1 burn transfer(s), last 2026-11-05. Burned by: the deployer 0x527a…7f0e (0.75%, 1 burn). This happened once, around launch; there is no sign of a continuing burn mechanism.

  Evidence

  • on-chainTransfer events to 0x0 / 0x…dEaD and balanceOf(burn addresses) of 0x627e45ca536c6cecedcd9d9bae0e0b11d5cb9baa

  Confirmed by: facts

• InfoX account created the same day, ~10 followers, team unnamedsocialAI

  @oryliaai was created the same day as the token (about 7.5 hours before deploy), is unverified, and has 10 followers. About only says “Follow on X” and “Contact us” — no person is named, and the project did not claim to be doxxed. That is a new, quiet account, not proof of a rug, but there is nobody publicly accountable for the coin.

  Evidence

  • Xhttps://x.com/oryliaai/status/2118263459821605375
    Show source

    Say the idea. Get the picture. Orylia is a free AI image and video generator.

  • webhttps://orylia.ai/about
    Show source

    Follow on X

  Confirmed by: grok-4.7

• InfoScanner bot claims are unverified; its holder count disagreesclaims-mismatchAI

  Larpcheckbot called the narrative only partly real and said generation and refunds were not tested because the tool sits behind sign-in. Treat that as an allegation, not a fact. Its “31 holders” does not match the basics given here (25 holders). No third-party posts in the search results call $ORYLIA a scam, rug, or honeypot. One reply called it a possible 100x; that is a single hype line, not a shill wave. “DEXPAID” is a paid DEX Screener listing alert, which is ordinary marketing, not a risk by itself.

  Evidence

  • Xhttps://x.com/Larpcheckbot/status/2118357692154515670
    Show source

    Couldn't confirm yet: - Generation and refunds not confirmed

  • on-chainholdersCount: 25
    Show source

    holdersCount: 25

  • Xhttps://x.com/oryliaai/status/2118357239006380257
    Show source

    DEXPAID!

  Confirmed by: grok-4.7, claude-opus-5.5, gpt-5.6-sol