Docs · Tools

Named, never clickable.

Portfolio aggregates balances across every wallet you have connected or saved, and hides suspected spam so a dumped airdrop cannot inflate a net-worth figure. At the bottom sits the Danger Zone, collapsed by default: the holdings whose contracts failed a safety check, named with the reason, and with nothing to press.

What it is#

The panel appears only when something was flagged. If nothing was, it is not there at all — there is no “all clear” state, because an all-clear is a claim, and the checks behind it are not strong enough to make one.

	The Danger Zone
Where	The bottom of the portfolio page, collapsed behind a header row you expand.
What it lists	Holdings whose contract came back DANGER or CAUTION. Danger rows sort first.
Per row	The token, its chain, a DANGER or CAUTION chip, the deciding reason, and up to three lines from the code scan.
Interaction	None. The only clickable thing in the whole panel is the expand header.
Cost	Nothing. There is no fee path in this code.

It is deliberately inert

There are no buttons in the Danger Zone. Not send, not burn, not approve — nothing. Danger tokens run hostile code on transfer, and sending one to the dead address still executes that code. The panel says it out loud: “Tokens in your wallets whose contracts failed safety checks. Nothing here is clickable on purpose.” Danger rows carry one more line: “Do not interact — not even to burn or send away.”

What gets checked, and what does not#

Not everything you hold is sent to a third party for assessment. The filter is narrow on purpose:

EVM ERC-20s only. Native coins are never scanned — there is no contract to scan.
Only the long tail. A token is a candidate only if the portfolio already flagged it as suspicious or nothing prices it. A priced, unflagged blue chip is never sent to a safety API.
At most 40 tokens per portfolio load, de-duplicated by chain and address, to keep the request volume small.
Contract addresses, not yours. The assessment sends token addresses and a chain id. Your wallet address is not part of it — even the burn simulation runs from the dead address rather than from you.

Verdicts are cached for 24 hours in your browser, so re-opening the portfolio does not re-ask. If the assessment fails for any reason, the panel renders nothing rather than a partial list: a safety check that broke must never break the page, and a half-answer here reads as reassurance.

How a token gets flagged#

Three levels — safe, caution, danger — from three independent layers. Only caution and danger reach the panel.

1. A security database#

GoPlus Token Security, batched into one request per chain. Its answers map to levels by rule, not by vibe. A token is danger when it is a honeypot, when an active owner can freeze transfers or rewrite balances, when the contract can self-destruct, when transfers call out to other contracts, when it is a known airdrop scam, or when sell restrictions combine with a blacklist. It is caution for an unverified contract, an upgradable proxy with an active owner, a buy or sell tax above 0.1%, a mintable supply, or a hidden owner.

Two refinements worth knowing, because they are where a naive checker gets it wrong. A power an owner has is not the same as a power an owner can use: where ownership is provably renounced, pausable transfers and balance-editing code drop from danger to caution, and the reason line says exactly that. And a token whose transfers call an external contract is the normal shape of a reflection or reward token, so a verified, non-blacklisting, ownership-renounced contract is cautioned rather than condemned for it.

GoPlus does not cover every chain. Where it does not — Robinhood Chain, for one — the fallback is a verified-or-not lookup on the chain's explorer, and the reason line is labelled “limited check only” so you can weigh it accordingly. Where even that has no host, the answer is caution with “No safety data available for this network”.

2. A code scan#

Where the source is verified, the transfer path is read directly and the code is scanned for the things that make a transfer dangerous: a delegatecall, a self-destruct, a low-level external call, a path that can send ETH out, a blacklist or whitelist gate, a pause switch, logic that depends on tx.origin, inline assembly, fee maths. Where the source is not published, the deployed bytecode is walked at the opcode level instead — which works either way, and can still spot a delegatecall, a self-destruct, or an upgradable proxy behind a standard storage slot.

3. A burn simulation#

The strongest layer, and the one that is not always available. The exact transfer the app would build is replayed against a live node with a call tracer, and every internal call it makes is enumerated. Touching only the token contract is clean; delegatecalling elsewhere or sending value out is hostile; reaching other contracts without either is a caution; reverting is reported as a revert. Only some chains have a public node that will run a deep trace at all — where none does, the verdict is unavailable and it is reported as unavailable, never rounded down to “fine”.

Checks only escalate

A code finding can raise a level and can never lower one. A danger finding forces danger; a caution finding lifts safe to caution; nothing anywhere in this pipeline can talk a level back down. That is why a green result is not a claim of safety — it is the absence of a finding, which is a much weaker statement, and the reason lines say so.

One policy, two surfaces#

This is the same engine that makes Batch Swap refuse to burn a contract — the same assessment, the same 24-hour cache, the same escalation rule. The two surfaces differ only in what they do with the answer: Batch Swap blocks a danger token from ever entering a batch and shows the full evidence disclosure per row, while the portfolio names it and offers nothing.

The rest of the portfolio page#

Every wallet in one number. Connected wallets plus any you have saved, across every chain the app supports. Saved wallets keep refreshing when the wallet is disconnected, and are stored only in your browser.
Suspected spam is excluded from every total, not just the list — net worth, the chain count, the asset count and the per-wallet cards all ignore it. The number of hidden tokens is shown under the total rather than swept away silently.
The chain outranks the indexer. The largest holdings are re-read directly from public RPCs on every refresh; a balance the chain says is zero is dropped immediately, whatever the indexer still believes.
Lookalikes never merge. Two tokens with the same symbol on the same chain stay two rows, and flagged or unpriced tokens are never folded into a real one.
A failed refresh keeps the last good snapshot rather than blanking the page.

What it deliberately will not do#

Offer any action on a flagged token. Not even burning. That is the entire point of the panel.
Let you mark something safe. There is no override, no “ignore this warning”, no way to unhide a flagged token into your totals.
Send your wallet address to a safety API. Contract addresses only.
Scan your blue chips. Priced, unflagged holdings are never sent anywhere.
Show a partial list. A failed assessment renders nothing at all.
Store any of it on a server. Saved wallets, balance snapshots, safety verdicts and code inspections all live in your browser and nowhere else.

Batch Swap + Burn — the same classification, acted on rather than displayed.
Fees — the portfolio and the Danger Zone are free, and that page says which paths are not.