Dust out, evidence first.

At a glance#

Using it, step by step#

1. Pick the chain and the target. The target is the chain's native ETH or its canonical dollar token — native USDC on Ethereum, Base, Optimism and Arbitrum, and USDG on Robinhood Chain, which has no native USDC. Changing the target throws away the previous analysis, because every quote in it was priced into the old one.
2. Tick the dust. Same list as Batch Send — priced tokens, then a collapsed Hidden / unpriced group labelled “the usual dust”.
3. Run the check. “Check N tokens for routes & safety”. Every token gets, in parallel, a sell quote for its whole balance and a safety assessment. Progress is shown as quoting & safety-checking… n/N. Nothing is signed at this stage and nothing is spent.
4. Read the groups. The result is four lists — swap, quotes unavailable, kept safe, burnable — plus a blocked list when anything failed a safety check. Swaps arrive all ticked; burns arrive all un-ticked.
5. Confirm twice. The run button opens a panel naming the exact counts, listing the symbols you are about to burn, and stating that burning cannot be undone. Only then does the wallet open.

Where the quotes come from#

Each token is quoted for its whole balance into the target, on the same chain, through a fixed fallback chain: 0x (the widest aggregate coverage) → LI.FI → Zora (Base only, ETH target only — Zora creator and content coins live in pools the aggregators cannot see) → Pioneer, the swap page's own quote source. On Robinhood Chain none of those apply and the quote is read from Uniswap v3 on-chain instead. The winning source is labelled on the row when it is not the default.

Quotes run three at a time, deliberately: quoting each token hits a rate-limited proxy, and a twenty-token round should finish without tripping it.

The safety gate#

Every token in a round lands in exactly one group, and the order of the checks is the policy.

The distinction between “no route” and “could not ask” is the whole gate. “No route” is a specific answer from a live pricing venue — unsupported asset, amount too small, impact too high, insufficient liquidity. Anything else is a transport failure, and a transport failure can never promote a token into the burn group. With two aggregators in the chain, one of them answering “no” while the other could not be asked is not enough on its own.

The danger rule is enforced three times independently: when the plan is built, when the calls are constructed (a danger token reaching the builder throws), and once more immediately before submission. A token flagged caution can still be burned, but its row carries the deciding reason in amber and the words “burn only if you are sure.”

What you actually sign#

// One EIP-5792 batch, assembled in this order:
approve(<spender>, <exact balance>)   // only when the current allowance is short
<any prerequisite calls the route needs>
<the swap call itself>
…                                     // repeated per swap token
transfer(0x00000000…dEaD, <balance>)   // per burn token
{ value: 200000000000000n }                    // the flat fee, last

• Approvals are for the exact balance being sold and are emitted only when the current allowance is short. An allowance that cannot be read degrades to zero — an extra approve, never a broken swap.
• A burn is one transfer to the dead address. No approval, no ETH.
• Before submission every call that can be simulated is simulated, and any item whose calls would revert is dropped and reported as “Would revert — skipped before submitting”. A swap sitting behind a fresh approval in the same batch cannot be simulated statelessly — the allowance does not exist yet — so those steps are trusted to the quote's own validation instead of being guessed at.
• If every item would revert, nothing is submitted at all.

What the burn evidence actually verifies#

Every burn candidate carries a “why this is safe to burn” disclosure you can open on the row. It is built from three independent layers, and its headline degrades with the evidence — a token we know little about never reads like a token we cleared.

1. The transaction we build. Shown literally, because its shape is the strongest reassurance available:

   the whole burn

   Copy

   transfer(0x000000000000000000000000000000000000dEaD, <your whole balance>)
   
   // That is the entire transaction. Specifically:
   //   - no approve() anywhere in it — the token is never granted permission to
   //     move anything else in your wallet, now or later
   //   - value: 0 — no ETH rides along, so you pay gas and nothing else leaves

2. A burn simulation. That exact transfer is replayed against a live node with a call tracer and every internal call it makes is enumerated. A clean verdict means it touched only the token contract: no calls out to any other address, and no ETH moved. A subcall that delegatecalls elsewhere or sends value is hostile; a plain external call is flagged as caution; a revert is reported as a revert. This is the strongest check available — not what the code looks like, but what this specific burn actually does.
3. A code scan and a security database. Verified source is read directly for the transfer path; unverified contracts get an opcode-level bytecode scan instead, which works either way and can spot a delegatecall, a selfdestruct, or an upgradable proxy. Separately, GoPlus Token Security is consulted for honeypot, blacklist, pausable-transfer and balance-rewriting flags.

The three layers set a confidence level that renames the disclosure itself: “Why this is safe to burn” only when the deep trace ran, came back clean and nothing else flagged; “What we found before offering this burn” when the checks ran with caveats; and “Thin evidence — read this before burning” when a layer could not run at all. The full mechanics of the classification are on the Danger Zone page — it is the same engine.

What it cannot prove#

• Deep tracing needs a node that allows it. Not every chain has a public RPC that will run a call trace — Robinhood Chain in particular. When it did not run, the disclosure says so and the confidence drops to thin rather than quietly leaning on the weaker checks.
• GoPlus does not cover every chain. Where it does not, the fallback is a verified-or-not lookup, which is a much weaker signal — and the disclosure says exactly that.
• An upgradable contract's evidence has a shelf life. Behind a proxy, everything describes the implementation deployed right now. An owner can point it somewhere else tomorrow.
• Checks only escalate, never reassure. A danger finding forces danger and a caution finding raises safe to caution; nothing can lower a level. A safety check that fails outright degrades to caution, never silently to safe.
• Worst case is wasted gas. A contract can grief its own transfer so the call reverts or costs more than it should. It cannot reach anything else you own — there is no approval in the call and no ETH in it.

What happens after you run it#

The result screen is per token, not per batch: every item is listed as swapped, burned, failed or skipped, with the reason on hover, alongside links to every transaction. When the wallet reports per-call receipts, an item counts as successful only if all of its calls succeeded — an approval that landed and a swap that reverted is a failure, not a partial win. A run where nothing succeeded says so plainly; the share button is only offered when the run actually worked.

What it deliberately will not do#

• Burn anything flagged dangerous — not even to get rid of it. Three separate checkpoints enforce that, and the last one runs after you have confirmed.
• Burn on a hunch. A token is only burnable after a live venue really answered “no route”. Silence is never taken as an answer.
• Burn anything worth money. $1 of known value is enough to keep a token out of the burn group permanently, route or no route.
• Pre-tick a burn. Burn boxes start empty, every one needs an explicit tick, and the whole run then needs a second confirmation that names the counts.
• Grant an unlimited allowance. Approvals are exact-amount, every time.
• Sell part of a balance, or let you set your own slippage.

Related#

• The Danger Zone — the same classification engine, described in full.
• Batch Send — the same batching machinery, pointed at moving tokens instead of selling them.
• Fees — one table, every path.