USD Coin (USDC) — what its owner can do
0x43506849d7c04f9138d1a2050bbf3a0c054402dd, since that is the code that actually runs.Who can do these things
Control is split across 4 addresses: 0xFcb19e6a322b27c06842A71e8c725399f049AE3a (owner-gated functions, a single private key); 0xE982615d461DD5cD06575BbeA87624fda4e3de17 (creating new tokens, a contract); 0x0A06BE16275B95a7d2567fBdAE118b36C7DA78F9 (blocking transfers, a single private key); 0x4914f61d25e5C567143774B76EdbF4D5109a8566 (blocking transfers, a single private key). 3 of them are a plain private key. Whether that is acceptable depends on who holds them.
0xFcb19e6a322b27c06842A71e8c725399f049AE3a— a single private key, 6 transactions sent. Found via owner().0xE982615d461DD5cD06575BbeA87624fda4e3de17— a contract, possibly a multisig. Found via masterMinter().0x0A06BE16275B95a7d2567fBdAE118b36C7DA78F9— a single private key, 719 transactions sent. Found via blacklister().0x4914f61d25e5C567143774B76EdbF4D5109a8566— a single private key, 0 transactions sent. Found via pauser().
Only named getters were read. If this contract uses role-based access control without enumeration, its role holders cannot be listed, and the absence of a controller here does not mean there is none.
What the contract permits
Can new tokens be created?
New tokens can be created after deployment.
Whoever holds that permission can increase the supply, which reduces the share each existing token represents.
- mint(address,uint256)
Whether minting has been used, and under what constraints, is not established here.
Can transfers be blocked?
Transfers can be blocked by whoever holds the relevant permission.
If the mechanism is applied to your address, or to the pool you would sell into, you would be unable to sell.
- Address blocking: blacklist(address), unBlacklist(address), updateBlacklister(address)
- Pause controls: pause(), unpause()
- paused() currently returns false
This reports what the contract permits. Whether any address is currently blocked was not checked.
Is there a trading tax?
No trading tax mechanism was found.
- No tax setter or tax rate in the ABI
Can the contract logic be replaced?
The contract logic can be replaced.
Everything else described here reflects the code running today, and could be changed by whoever holds the upgrade rights.
- The block explorer resolves this as a proxy for 0x43506849d7c04f9138d1a2050bbf3a0c054402dd
- It uses a non-standard storage slot, so the upgrade rights could not be read on-chain
Who holds the upgrade rights was not determined.
Is the liquidity locked?
The trading liquidity can be withdrawn by whoever holds the LP tokens.
Withdrawing liquidity leaves holders with tokens and no pool to sell them into. This is the mechanism behind most losses described as rug pulls.
- Uniswap V2 WETH pool at 0xB4e16d0168e52d35CaCD2c6185b44281Ec28C9Dc: 4,040 WETH of depth, 0% of its LP supply burned
- Uniswap V2 USDT pool at 0x3041CbD36888bECc7bbCBc0045E3B1f144466f5f: 1,804,183 USDT of depth, 0% of its LP supply burned
- SushiSwap WETH pool at 0x397FF1542f962076d0BFE58eA045FfA2d347ACa0: 55.624 WETH of depth, 0% of its LP supply burned
- SushiSwap USDT pool at 0xD86A120a06255Df8D4e2248aB04d4267E23aDfaA: 663.7357 USDT of depth, 0% of its LP supply burned
Who holds the unburned LP tokens cannot be established: ERC20 holders cannot be enumerated over RPC. It may sit in a time-lock contract, or in a wallet, and this check cannot tell those apart.