> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hashdit.io/llms.txt
> Use this file to discover all available pages before exploring further.

# EVM Token Security

> Performs a comprehensive security and market analysis of an EVM-compatible token (e.g. ERC-20). The API evaluates contract privileges, minting capabilities, honeypot risks, ownership controls, market liquidity, holder distribution, transfer restrictions, and threat intelligence to determine the token's overall risk profile.



## OpenAPI

````yaml POST /v2/hashdit/token-security
openapi: 3.1.0
info:
  title: HashDit API
  description: >-
    HashDit threat intelligence API for domain security analysis, blockchain
    address classification, address poisoning detection, address security
    assessment, transaction simulation, transaction security, token security,
    and Solana token security
  version: 2.0.0
servers:
  - url: https://service.hashdit.io
security: []
paths:
  /v2/hashdit/token-security:
    post:
      summary: EVM Token Security
      description: >-
        Performs a comprehensive security and market analysis of an
        EVM-compatible token (e.g. ERC-20). The API evaluates contract
        privileges, minting capabilities, honeypot risks, ownership controls,
        market liquidity, holder distribution, transfer restrictions, and threat
        intelligence to determine the token's overall risk profile.
      operationId: tokenSecurity
      parameters:
        - name: X-API-Key
          in: header
          description: Your HashDit API key
          required: true
          schema:
            type: string
      requestBody:
        description: Token contract address to analyze
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenSecurityRequest'
            example:
              chainId: '56'
              address: '0x0e09fabb73bd3ade0a17ecc321fd13a19e81ce82'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenSecurityResponse'
              example:
                code: '0'
                status: ok
                data:
                  address: bsc:0x0E09FaBB73Bd3Ade0a17ECC321fD13a19e81cE82
                  address_type: ERC20
                  overall_risk_level: No Obvious Risk
                  overall_score: '90'
                  basic_info:
                    token_name: PancakeSwap Token
                    token_symbol: Cake
                    token_decimals: '18'
                    days_deployed: '1913'
                    is_mintable: '1'
                    is_in_dex: '1'
                    verified: '1'
                  privileges:
                    owner_address: '0x73feaa1eE314F8c655E354234017bE2193C9E24E'
                    owner_type: contract
                    dev_malicious: '0'
                  security_risks:
                    is_honeypot: '0'
                    hidden_owner: '0'
                    self_destruct: '0'
                    unlimited_mintable: '1'
                  token_market:
                    holders_count: '1870482'
                    owner_token_percent: '0.0024'
                    holders_concentration:
                      top1_eoa_concentration: '0.0017'
                      top5_eoa_concentration: '0.0017'
                  trade_analysis:
                    sell_tax: '0.0000'
                    transfer_tax: '0.0000'
                  transfer_restrictions:
                    is_anti_whale: '0'
                    transfer_pausable: '0'
                    transfer_blacklist: '0'
                  threat_intelligence:
                    risk_level: '0'
                    trust_level: '3'
                  scanned_time: 1766092636
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Unauthorized - Invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidAPIKeyErrorResponse'
              examples:
                Invalid API key:
                  summary: Invalid API key error
                  value:
                    code: '403'
                    message: 'invalid apiKey: apiKey invalid'
                    apiKey: ''
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RateLimitExceededErrorResponse'
              examples:
                Rate limit exceeded:
                  summary: Rate limit exceeded error
                  value:
                    code: '429'
                    status: error
                    message: Rate limit exceeded
components:
  schemas:
    TokenSecurityRequest:
      type: object
      required:
        - chainId
        - address
      properties:
        chainId:
          type: string
          description: >-
            The network chain ID. See [Supported
            Chains](/api-reference/endpoint/token-security/supported-chains) for
            a complete list of supported networks for this endpoint.
          example: '56'
        address:
          type: string
          description: Token contract address.
          example: '0x0e09fabb73bd3ade0a17ecc321fd13a19e81ce82'
    TokenSecurityResponse:
      type: object
      properties:
        code:
          type: string
          description: API result code. "0" indicates success.
          example: '0'
        status:
          type: string
          description: Request status.
          example: ok
        data:
          $ref: '#/components/schemas/TokenSecurityData'
    ErrorResponse:
      type: object
      properties:
        code:
          type: string
          description: '`400`'
        status:
          type: string
          description: Error status
    InvalidAPIKeyErrorResponse:
      type: object
      properties:
        code:
          type: string
          description: '`403`'
        message:
          type: string
          description: 'invalid apiKey: apiKey invalid'
        apiKey:
          type: string
          description: API key
          example: ''
    RateLimitExceededErrorResponse:
      type: object
      properties:
        code:
          type: string
          description: '`429`'
        status:
          type: string
          description: error
        message:
          type: string
          description: Rate limit exceeded
    TokenSecurityData:
      type: object
      properties:
        address:
          type: string
          description: Fully qualified token address with chain prefix.
          example: bsc:0x0E09FaBB73Bd3Ade0a17ECC321fD13a19e81cE82
        address_type:
          type: string
          description: Token standard.
          example: ERC20
        overall_risk_level:
          type: string
          description: Overall risk summary.
          enum:
            - No Obvious Risk
            - Low Risk
            - Medium Risk
            - High Risk
            - Significant Risk
        overall_score:
          type: string
          description: Overall security score (0–100). Lower values indicate higher risk.
        basic_info:
          $ref: '#/components/schemas/BasicTokenInfo'
        privileges:
          $ref: '#/components/schemas/TokenPrivileges'
        security_risks:
          $ref: '#/components/schemas/SecurityRisks'
        token_market:
          $ref: '#/components/schemas/TokenMarket'
        trade_analysis:
          $ref: '#/components/schemas/TradeAnalysis'
        transfer_restrictions:
          $ref: '#/components/schemas/TransferRestrictions'
        threat_intelligence:
          $ref: '#/components/schemas/ThreatIntelligence'
        scanned_time:
          type: number
          description: Unix timestamp of the latest scan.
          example: 1766092636
    BasicTokenInfo:
      type: object
      properties:
        token_name:
          type: string
          description: Token name.
          example: PancakeSwap Token
        token_symbol:
          type: string
          description: Token symbol.
          example: Cake
        token_decimals:
          type: string
          description: Token decimals.
          example: '18'
        days_deployed:
          type: string
          description: Number of days since deployment.
        is_mintable:
          type: string
          description: Indicates whether new tokens can be minted.
          enum:
            - '0'
            - '1'
        is_in_dex:
          type: string
          description: Token is listed on a DEX.
          enum:
            - '0'
            - '1'
        verified:
          type: string
          description: Contract verification status.
          enum:
            - '0'
            - '1'
    TokenPrivileges:
      type: object
      properties:
        owner_address:
          type: string
          description: Contract owner address.
          example: '0x73feaa1eE314F8c655E354234017bE2193C9E24E'
        owner_type:
          type: string
          description: Owner type.
          enum:
            - contract
            - EOA
        dev_malicious:
          type: string
          description: Developer risk indicator.
          enum:
            - '0'
            - '1'
    SecurityRisks:
      type: object
      properties:
        is_honeypot:
          type: string
          description: >-
            Indicates honeypot behaviour. A honeypot is a type of malicious
            smart contract designed to lure users into interacting with it under
            false pretenses. It appears to allow certain profitable actions
            (like buying or withdrawing tokens), but when users try to perform
            other actions (such as selling or transferring tokens), they are
            blocked or lose their funds.
          enum:
            - '0'
            - '1'
        hidden_owner:
          type: string
          description: >-
            Ownership obfuscation detection. Hidden owner means the identity of
            the owner (or priviledged addresses) is not easily identifiable, in
            order to deceive users.
          enum:
            - '0'
            - '1'
        self_destruct:
          type: string
          description: >-
            Contract self-destruct capability. A self-destruct feature allows
            the contract owner to permanently delete the contract and its
            associated funds, rendering it permanently inactive.
          enum:
            - '0'
            - '1'
        unlimited_mintable:
          type: string
          description: >-
            Unlimited minting capability. An unlimited minting feature allows
            the contract owner to mint an unlimited number of tokens, regardless
            of the total supply.
          enum:
            - '0'
            - '1'
    TokenMarket:
      type: object
      properties:
        holders_count:
          type: string
          description: Total number of token holders.
          example: '1870482'
        owner_token_percent:
          type: string
          description: >-
            Percentage of tokens owned by the contract owner. E.g. 0.17 means
            17%
          example: '0.17'
        holders_concentration:
          $ref: '#/components/schemas/HoldersConcentrationEVM'
    TradeAnalysis:
      type: object
      properties:
        sell_tax:
          type: string
          description: >-
            The amount of percentage tax charged when selling tokens. E.g. 0.01
            means 1%
          example: '0.01'
        buy_tax:
          type: string
          description: >-
            The amount of percentage tax charged when buying tokens. E.g. 0.01
            means 1%
          example: '0.01'
        transfer_tax:
          type: string
          description: >-
            The amount of percentage tax charged when transferring tokens. E.g.
            0.01 means 1%
          example: '0.01'
    TransferRestrictions:
      type: object
      properties:
        is_anti_whale:
          type: string
          description: >-
            Indicates whether anti-whale restrictions are in place. Anti-whale
            restrictions are designed to prevent large holders from dominating
            the market and manipulating prices.
          enum:
            - '0'
            - '1'
        transfer_pausable:
          type: string
          description: Indicates whether a privileged address can pause token transfers.
          enum:
            - '0'
            - '1'
        transfer_blacklist:
          type: string
          description: >-
            Indicates whether a privileged address can blacklist other addresses
            from transferring tokens.
          enum:
            - '0'
            - '1'
    ThreatIntelligence:
      type: object
      properties:
        risk_level:
          type: string
          description: Threat intelligence risk score. 3 is the highest risk level.
          enum:
            - '0'
            - '1'
            - '2'
            - '3'
        trust_level:
          type: string
          description: Trust confidence level. 3 is the highest trust level.
          enum:
            - '0'
            - '1'
            - '2'
            - '3'
    HoldersConcentrationEVM:
      type: object
      properties:
        top1_eoa_concentration:
          type: string
          description: Percentage of supply held by top 1 EOA holder. E.g. 0.17 means 17%
          example: '0.17'
        top5_eoa_concentration:
          type: string
          description: Percentage of supply held by top 5 EOA holders. E.g. 0.17 means 17%
          example: '0.17'

````