You can buy it. Can you sell it?
A B20 (a Base token) can pass every contract check and still be a honeypot — the trap lives in the pool, not the token. Paste an address and Cybercentry attempts a real buy-and-sell round trip — and says so when no pool can be quoted.
Can you get your money out?
A real buy-and-sell round trip against the token’s own pools: sell-side honeypots, pool hooks that exempt insiders from a penalty everyone else pays, reverting sells, and a round trip that costs more than the stated fee. When no pool can be quoted, it says unknown rather than fine.
What can the issuer do to you?
Freeze-and-seize authority and whether it is armed, live pauses, mint rights and supply caps, rebase — which changes what every balance is worth — policy control held by a third party, and admin power concentrated on a single hot key. Disclosed as capability, and where it matters proven by running the call in a read-only simulation.
Is this even the right token?
Fake B20s minted to look official, same-ticker copycats, homoglyph and zero-width lookalikes, and address-derivation reproduction. Ecosystem copycats are reported separately — someone else’s fake is never counted against the token you asked about.
Coinbase tokenized stocks
All thirteen — NVDAc, TSLAc, AAPLc and ten more — settled against the issuer’s published list by address, so a copycat wearing the ticker cannot pass as the real security. Reads the Chainlink total-return feed and its staleness, the multiplier that decides what a token redeems for, and the oracle’s registry state. Reports the controls that sit above the token — AP-gated redemption, price-feed behaviour outside market hours — which no on-chain check can see.
It never guesses. A truncated read is never called clean, an empty result is never called proof, and an absence is reported as not observed — never as does not exist.