# Security score: confidence and limitations > What the Crius security score can and can't see on Robinhood Chain, how to read its confidence fields, and why a low-risk result is not a guarantee a token is safe. Source: https://docs.crius.sh/concepts/security-score-limits/ · Updated 2026-10-28 Short answer The score only reports what was checked: a honeypot simulation (only for tokens with a Uniswap v2 WETH pair), taxes measured from real trades, contract code, LP locks Crius recognises, hook history and launch buyers. Read `tax.source`, `tax.confidence`, `tax.realized.samples` and `meta.simulation` to see how much evidence stands behind each answer. A `low` risk means no trap was found, not that none exists. [GET `/token/{address}/security`](https://docs.crius.sh/reference/security/security-checks/) [GET `/token/{address}/liquidity`](https://docs.crius.sh/reference/security/liquidity-locks/) [GET `/hook/{address}`](https://docs.crius.sh/reference/pools/hook-detail/) The security score is a summary of evidence, and every piece of evidence has limits. This page lists what each check can miss, which fields show how much evidence stands behind a result, and how to use the score without over-trusting it. Read it before you gate trades, listings or alerts on `risk` or `score`. A low risk result is not a safety guarantee `risk: "low"` and a high `score` mean Crius found no trap with the checks below. They don’t mean the token is safe to buy, that the price will hold, or that the team is honest. Most losses on new tokens come from insiders selling, not from contract traps, and some traps only turn on after you’ve bought. ## What each check can miss | Check | How it works | Can miss (false negatives) | | --- | --- | --- | | Honeypot simulation | `eth_simulateV1` buy → transfer → approve → sell from a fresh wallet through the Uniswap v2 router, at the current block, for `amount_usd` (default $100). | Tokens without a v2 WETH pair (v3 / v4 / curve only) are not simulated. Traps that whitelist fresh wallets, trigger later (time, block or trade count), depend on trade size, or block only certain wallets or contracts can pass. | | Realized honeypot rule | Flags 20+ buys with no successful sell by anyone but the developer. | A brand-new token with fewer than 20 buys can't be flagged by this rule yet. A trap that lets a few insider wallets sell to fake activity can pass. | | Realized taxes | The median of the latest 50 real trades per side in the last 30 days, compared with what the pool paid out. | A tax raised a minute ago only shows once new trades come in; a median hides a tax charged only on some trades (large sells, specific wallets). `max_sell_pct_seen` shows the worst single trade. | | Contract powers | Function selectors found in the token's code (and its implementation, for proxies): mint, blacklist, pause, tax changes, limits, self-destruct. | Powers behind renamed or obfuscated functions, or in another contract the token calls. An upgradeable proxy can change all of this later (it is flagged as `upgradeable_proxy`). | | Liquidity locks | LP held by burn addresses and by lockers Crius recognises (registry lockers and launchpad lock contracts). | A lock in a contract Crius doesn't know shows as held by that contract, so locks can be understated, not overstated. A lock can expire: check `next_unlock_ts`. | | Uniswap v4 hook | The hook's code, permissions, owner, its own pools' outcomes and its code family's history. | A new hook with no history gets `new_unknown`, not a verdict. Clean history doesn't stop an owner-controlled hook from changing behaviour later. | | Launch risk | Buyers in the first 10 blocks, wallet farms, uniform balances and LP concentration. | Insiders who fund wallets through exchanges, bridges or relayers look unrelated, and buyers after block 10 aren't counted as snipers. | ## How to read the confidence fields Every security response carries the evidence behind its answer. Check these before you trust a verdict: - **`tax.source`**: `realized` (measured from real trades), `realized+simulated` (measured, and the simulation agrees), `simulated` (no recent trades, simulation only) or `none` (neither: the tax is unknown, not zero). - **`tax.confidence`**: `high` with 20 or more measured trades, `medium` with 3 or more, `low` below that. A `low` confidence tax of 0% says little. - **`tax.realized.samples`**: how many buys and sells the realized numbers come from, and `max_sell_pct_seen`, the worst single sell. - **`meta.simulation`**: `eth_simulateV1 via Uniswap V2 router at head` when a simulation ran, or `no V2 WETH pair: realized tax only` when it couldn’t. - **`honeypot.reason`**: which check made the call (`simulated sell failed` or `buys but no successful sells by non-dev wallets`). - **`hook.observed`** and **`hook.family`**: how many traded pools the hook verdict rests on. Example [Anonymous · no key · 1 credit](https://docs.crius.sh/reference/security/security-checks/) ### Little evidence: a token with no simulation Recast (0xb656eadd009b3b409d7a0971e50df2f0e4ddef5a) trades only on Uniswap v4. Which parts of its verdict are measured, and which are missing? GET/v1/robinhood/token/0xb656eadd009b3b409d7a0971e50df2f0e4ddef5a/security **cURL** ```bash curl "https://api.crius.sh/v1/robinhood/token/0xb656eadd009b3b409d7a0971e50df2f0e4ddef5a/security" ``` **JavaScript** ```js const res = await fetch("https://api.crius.sh/v1/robinhood/token/0xb656eadd009b3b409d7a0971e50df2f0e4ddef5a/security"); const { data, meta } = await res.json(); ``` **Python** ```python import requests r = requests.get( "https://api.crius.sh/v1/robinhood/token/0xb656eadd009b3b409d7a0971e50df2f0e4ddef5a/security", ) body = r.json() print(body["data"]) ``` **Real response 200 Captured Oct 28, 2026 · 188 lines (arrays trimmed)** ```json { "data": { "contract": { "blacklist": false, "can_change_limits": false, "can_change_tax": false, "cooldown": false, "implementation": null, "is_proxy": false, "mintable": false, "owner": null, "ownership": "none", "pausable": false, "proxy_kind": null, "self_destruct": false, "trading_switch": false, "upgradeable": false, "verified": null }, "flags": [ "tax_over_5pct", "unverified" ], "honeypot": { "is_honeypot": false, "reason": null, "selective": false }, "hook": { "address": "0xe5e702641ea86f4ae6cc3cdaed2b886f976be044", "capabilities": { "can_block_swaps": false, "can_gate_liquidity": false, "can_modify_liquidity_amounts": false, "can_modify_swap_amounts": true }, "code": { "admin_functions": [], "checked_ts": 1793207140434, "code_hash": "0xc21b1e6c1b45403e81a581f22ed6d9c747997af1cfdac1b1dc9f4b1d346a10db", "family": "0xabda3266e50c", "kind": "contract", "logic": null, "owner": "0x263ed295dafae1d9aadd6e56c4b6f9f38ee019dd", "ownership": "active", "size": 15167 }, "family": { "honeypot_pct": 0, "hooks": 22, "id": "0xabda3266e50c", "liquidity_pulled_pct": 0.684086, "pools_traded": 10525, "taxed_pct": 51.9715, "verified_hooks": 1 }, "flags": [], "name": "PonsV2MemeHook", "observed": { "dynamic_tax_pools": 13, "first_trade_ts": 1785866942000, "honeypot_pools": 0, "last_trade_ts": 1793223683000, "liquidity_pulled_pct": 0.66813, "liquidity_pulled_pools": 70, "max_buy_tax_pct": 10.99, "max_sell_tax_pct": 0.7, "median_pool_life_min": 53423.5, "pools": 10478, "pools_traded": 10477, "tax_measured_pools": 10392, "taxed_10pct_pools": 35, "taxed_pools": 5463, "volume_usd": 5384607135 }, "pattern": { "description": "hooks that change swap amounts only", "honeypot_pct": 0.0696347, "id": "swap_delta_only", "liquidity_pulled_pct": 7.93603, "pools_traded": 43082, "taxed_pct": 15.7537 }, "permissions": [ "beforeInitialize", "afterSwap", "afterSwapReturnDelta" ], "risk": [ "can_modify_swap_amounts" ], "risk_level": "low" }, "known_asset": false, "launch": { "flags": [], "lp_top_wallet": { "address": "0x441568fdd10b00ddc90b4a95aee03d8d06242283", "liquidity_usd": 2.08528, "pct": 0.0195019 }, "sniper_supply_pct": 0.61622, "sniper_top_wallet_pct": 0.61622, "sniper_wallets": 1, "sniper_window_blocks": 10, "uniform_holders": null, "wallet_farm": null }, "limits": {}, "liquidity": { "status": "locked", "summary": { "burned_pct": 0, "locked_pct": 99.9805, "next_unlock_ts": null, "protocol_fee_pct": 0, "unlocked_in_wallets_pct": 0.019502, "weighting": "by pool liquidity_usd" } }, "primary_dex": "uniswap_v4", "risk": "low", "score": 80, "tax": { "buy_pct": 6.99, "confidence": "high", "realized": { "buy_pct": 6.99, "by_wallet_class": { "dev_sell_pct": null, "others_sell_pct": 0 }, "last_sample_ts": 1793223683000, "max_sell_pct_seen": 1, "samples": { "buys": 1107, "sells": 530 }, "sell_pct": 0, "window": "30d" }, "sell_pct": 0, "simulated": null, "source": "realized", "transfer_pct": null }, "tax_history": [ { "from_block": 82850924, "pct": 0, "side": "buy" }, { "from_block": 82929088, "pct": 0, "side": "sell" }, { "from_block": 85677230, "pct": 1, "side": "buy" }, { "from_block": 85686101, "pct": 0, "side": "buy" }, { "from_block": 90626923, "pct": 7, "side": "buy" } ], "tax_history_total": 9, "tax_mode": "dynamic", "token": "0xb656eadd009b3b409d7a0971e50df2f0e4ddef5a" }, "meta": { "block": 100406621, "block_age_ms": 400, "block_ts": 1793225060000, "chain": "robinhood", "finalized_block": 100397649, "lag_ms": 10, "safe_block": 100401329, "simulation": "no V2 WETH pair: realized tax only" } } ``` What this tells you - `tax.simulated: null` and `meta.simulation: "no V2 WETH pair: realized tax only"`: no buy-and-sell simulation ran, because the token has no v2 WETH pair. - `tax.source: "realized"` with `tax.confidence: "high"`: the 6.99% buy tax and 0% sell tax are measured from real trades (`tax.realized.samples`), so the tax answer is solid even without a simulation. - The honeypot verdict rests on the realized rule only: real wallets have sold, so it isn’t a honeypot for them. A trap that targets only some wallets would not show here. [Security checks reference](https://docs.crius.sh/reference/security/security-checks/) Runs from your browser on the anonymous plan [Data looks wrong? Report it](mailto:support@crius.sh?subject=Wrong%20data%20in%20docs%20example%3A%20Little%20evidence%3A%20a%20token%20with%20no%20simulation&body=Page%3A%20https%3A%2F%2Fdocs.crius.sh%2Fconcepts%2Fsecurity-score-limits%2F%23no-simulation%0ARequest%3A%20GET%20%2Fv1%2Frobinhood%2Ftoken%2F0xb656eadd009b3b409d7a0971e50df2f0e4ddef5a%2Fsecurity%0A%0AWhat's%20wrong%20or%20missing%3F%0A%0A) ## Timing: how fresh a result is - Results are cached for **15 seconds** per token and `amount_usd`. On paid plans, `fresh=1` skips the cache and simulates again at the current block (20 credits). - The simulation runs at the **current block** only. It says nothing about what the owner can switch on tomorrow; that is what the contract-power and proxy flags are for. - Realized taxes cover the **last 30 days**; older trades only appear in `tax_history`. - Every response’s `meta.block` tells you the block the answer was read at. Store it with any decision you make. ## Use the score safely 1. **Gate on `risk`, then read the evidence.** Block `critical` and `high`. For `low` and `medium`, check `tax.confidence` and `meta.simulation` before treating the tax as known. 2. **Treat missing evidence as unknown, not as safe.** `tax.source: "none"`, `tax.confidence: "low"` or no simulation on a token with few trades means “not enough data yet”, not “no tax”. 3. **Re-check before every trade on new tokens.** Taxes, LP locks and hook behaviour can change after launch. Re-call `/security` (or subscribe to `tax:` and `lp:` events on the [WebSocket stream](https://docs.crius.sh/reference/stream/)) instead of caching a verdict for hours. 4. **Size for being wrong.** Use the score to remove obvious traps, combine it with holder and launch data ([bundles and snipers](https://docs.crius.sh/guides/detect-bundles-and-snipers/), [holders](https://docs.crius.sh/guides/get-token-holders/)), and never risk more than you can lose on a token the checks can’t fully see. Found a token the score got wrong? Send the token address, the response’s `meta.block` and what happened to [support@crius.sh](mailto:support@crius.sh?subject=Security%20score%20miss). Misses are how the checks improve; every report is read. ## Frequently asked questions **Can a token with a score of 100 be a scam?** Yes. The score finds known trap mechanics on-chain. It can't see a team that abandons the project, a coordinated dump by wallets that look unrelated, a trap that turns on later, or a contract that treats some wallets differently from the ones the checks use. Treat the score as a filter that removes obvious traps, then size positions as if it could be wrong. **Why is \`tax.simulated\` null for my token?** The buy-and-sell simulation runs through the Uniswap v2 router, so it needs a v2 pool against WETH with liquidity. Tokens that trade only on Uniswap v3 or v4, or still on a launchpad curve, get no simulation; `meta.simulation` says `no V2 WETH pair: realized tax only` and the verdict rests on real trades alone. **How fresh is a security result?** Results are cached for 15 seconds per token and trade size, so they are close to live. Taxes come from the last 30 days of trades (the median of the latest 50 per side), so a tax change shows up as new trades arrive, not instantly. On paid plans `fresh=1` skips the cache and simulates again at the current block. **Which result fields tell me how confident the answer is?** `tax.source` (`realized`, `realized+simulated`, `simulated` or `none`), `tax.confidence` (`high` with 20+ measured trades, `medium` with 3+, `low` below that), `tax.realized.samples` (buy and sell counts), `meta.simulation` (whether a simulation ran) and, for the hook, `hook.observed` and `hook.family` (how much history the verdict is based on). ## Related [Guide **Token security score** Score any Robinhood Chain token from 0 to 100 with one API call. Honeypot, buy and sell taxes, owner powers, LP locks, v4 hook risk and insider launches, with real examples. Read](https://docs.crius.sh/guides/token-security-score/) [Guide **Detect a honeypot** Check whether a Robinhood Chain token can be sold before you buy it. One API call simulates a buy and a sell and checks real trades; a real honeypot example shows the evidence. Read](https://docs.crius.sh/guides/detect-honeypot/) [Guide **Check token taxes** Get the real buy and sell tax of any Robinhood Chain token in one call, measured from recent trades and checked by simulation. Real examples with a 5% sell tax and a 7% buy tax. Read](https://docs.crius.sh/guides/check-token-taxes/) [Concept **Token taxes** How Crius measures buy, sell and transfer taxes on Robinhood Chain tokens from real trades and from a simulated buy and sell, how the two are combined, and how tax changes are tracked. Read](https://docs.crius.sh/concepts/taxes/) [Concept **Launch risk** How Crius spots insider control of a Robinhood Chain token with a clean contract (snipers, wallet farms, uniform holders, LP control) and the thresholds it uses. Read](https://docs.crius.sh/concepts/launch-risk/) [API reference **Security checks API** Contract checks (ownership, mint, pause, blacklist, proxy, limits), realized and simulated buy/sell tax, honeypot verdict and, for v4 tokens, the pool hook's permissions and risk. Read](https://docs.crius.sh/reference/security/security-checks/)