GoPlus: In the past three quarters, over 560,000 potential risk tokens have been discovered on 5 major L2 chains, affecting more than 13.6 million user addresses

Author: GoPlus

Introduction

With the rapid development of Web3.0, more and more users are entering this field and investing. Among the on-chain investment areas, meme coins have become one of the most favored and attractive investment objects for users. Meme coins are characterized by fast issuance, high volatility, and anonymity of issuers. However, a large number of scam groups have exploited users' enthusiasm for meme coins, disguising themselves as meme coins and conducting extensive on-chain scams targeting users. These criminals utilize the characteristics of smart contracts to design various risky tokens, luring users to invest and then illegally profiting by triggering code backdoors. These risky tokens typically have the following features: the contract creator has unlimited minting rights, users can only buy but not sell, malicious black and white list settings, and transaction taxes that can be maliciously altered. Once users purchase these tokens, they are highly likely to incur financial losses that cannot be recovered. To address the increasingly serious fraud risks, identifying and warning about risky tokens has become particularly important. This article will analyze the situation of risky tokens on five popular Ethereum Layer 2 networks (Base, Arbitrum, Optimism, Blast, Mantle) over the past three quarters based on the GoPlus Security API and real on-chain data, aiming to provide reference and warnings for users.

Method Description

Data Sources

• GoPlus Security API

The GoPlus Security API is an open, permissionless Web3.0 security data API service provided by the GoPlus team for Web3.0 developers and end-users. This service empowers professional developers in the tech field to protect their users and meet the security needs of end users.

• Transaction data on various chains is mainly collected and queried through DUNE.

Analysis Method

Based on the GoPlus Security API, we scanned a total of 564,180 potential risky tokens across the 5 Top L2 Chains (users accessed through products integrated with the GoPlus Security API).

We conducted data analysis and visualization on the aforementioned suspected risky tokens using DUNE and created an open-source dashboard that displays three data metrics:

1. the number of unique traders involved in suspected risky tokens
2. the transaction amount involved in suspected risky tokens
3. all suspected risky tokens contract addresses

The sample period for this data is the past three quarters, specifically from August 1, 2023, to May 24, 2024. Since the Blast chain was launched in March 2024, its sample period starts from March 2024, although some ERC20 tokens on its chain were issued as early as February 2024.

Definition of Risky Tokens

The definition of risky tokens in this article is mainly derived from Token Risk Classification (TRC), and detailed definitions of each condition can be found in the TRC. Specifically, any smart contract that meets any of the following conditions is considered a potential risky token.

• Honeypot (TRC-001): The token has a "honeypot" mechanism, allowing users to buy but not sell.
• OwnershipRetrieval (TRC-003): Token ownership may be maliciously retrieved.
• AntiWhale (TRC-014): The token contract can restrict transactions of large holders, and specific users may not be able to cash out freely.
• TransferPausable (TRC-011): Token transfers can be paused, and user funds may be maliciously frozen.
• SlippageModification (TRC-010): The token contract can arbitrarily modify slippage, leading to unpredictable losses for users.
• BlacklistFunction (TRC-008): The token contract can set a blacklist, preventing specific users from transferring and trading freely.
• WhitelistFunction (TRC-013): The token contract can set a whitelist, preventing specific users from transferring and trading freely.
• TradingCooldown (TRC-016): The token contract can set a trading cooldown period, preventing users from trading in a timely manner.
• SelfDestruction (TRC-006): The token contract can self-destruct, causing the tokens held by users to suddenly disappear.
• ExternalCall (TRC-007): The token contract can call external contracts, posing a risk of malicious exploitation.
• PersonalSlippageModification (TRC-012): Slippage for specific users can be modified, potentially causing targeted losses for those users.
• AntiWhaleModification (TRC-015): Restrictions on large holders' transactions can be modified, further harming specific users' interests.
• BalanceManipulation (TRC-004): Token balances can be arbitrarily modified, causing the number of tokens held by users to change suddenly.
• HiddenOwnership (TRC-005): The identity of the token owner is hidden, making it difficult to trace responsible parties.
• FullSaleRestriction (TRC-009): The token contract can completely restrict sales, preventing holders from cashing out in a timely manner.
• FullBuyRestriction: The token contract can completely restrict purchases, preventing holders from cashing out in a timely manner.
• NotOpenSource: The token contract code is not open source.

Base

Number of New Tokens and New Suspected Risky Tokens on Base Chain

In the past three quarters, a total of 573,484 ERC20 tokens were newly added on the Base chain, of which 381,790 were scanned as new suspected risky ERC20 tokens, accounting for approximately 66.6%! This means that over half of the newly issued ERC20 tokens on the Base chain in the past three quarters are suspected risky tokens.

The trend of newly added ERC20 tokens on the Base chain first decreased and then significantly increased, especially since March 2024, when the number of newly added ERC20 tokens on the Base chain increased significantly. In April 2024, the number of newly added ERC20 tokens reached its peak at 240,000.

The number of newly added suspected risky ERC20 tokens on the Base chain is highly positively correlated with the number of newly added ERC20 tokens, showing similar trends.

Number of User Addresses Involved in Suspected Risky Tokens on Base Chain

Before March 2024, the number of addresses involved in suspected risky tokens on the Base chain remained relatively stable, ranging from approximately 230,000 to 300,000. However, overall, the number of addresses involved in suspected risky tokens on the Base chain has shown an upward trend, slowly increasing from 287,000 in August 2023 to 372,000 in February 2024. After that, there was a sharp peak, reaching 1.135 million and 1.994 million in March and April 2024, respectively. Although it decreased to 1.301 million in May 2024, it is still far higher than the same period in 2023, and May 2024 has not yet ended. This indicates that as time goes on, the fraud risks faced by users on the Base chain are continuously escalating.

Arbitrum

Number of New Tokens and New Suspected Risky Tokens on Arbitrum Chain

In the past three quarters, a total of 95,203 ERC20 tokens were newly added on the Arbitrum chain, of which 85,633 were scanned as new suspected risky ERC20 tokens, accounting for approximately 89.9%!

The number of newly added ERC20 tokens on the Arbitrum chain has shown a relatively stable upward trend. It increased from 8,520 in August 2023 to 12,349 in April 2024.

Similar to the Base chain, the number of newly added suspected risky tokens on the Arbitrum chain is highly positively correlated with the number of newly added ERC20 tokens, showing consistent trends.

Number of User Addresses Involved in Suspected Risky Tokens on Arbitrum Chain

The number of addresses involved in suspected risky tokens on the Arbitrum chain shows a clear upward trend, especially during the period from March 2024 to May 2024, when this number increased significantly. The number of addresses involved in suspected risky tokens on the Arbitrum chain grew from 36,000 in August 2023 to 3.78 million in May 2024, an increase of approximately 105 times!

In May 2024, suspected risky tokens on the Arbitrum chain affected 3.78 million users, posing a serious threat to users' asset security.

Optimism

Number of New Tokens and New Suspected Risky Tokens on Optimism Chain

In the past three quarters, a total of 73,737 ERC20 tokens were newly added on the Optimism chain, of which 70,089 were scanned as new suspected risky ERC20 tokens, accounting for approximately 95%! This means that about 95% of the newly added ERC20 tokens on the Optimism chain in the past three quarters are suspected risky tokens!

The number of newly added ERC20 tokens on the Optimism chain is also highly positively correlated with the number of newly added suspected risky ERC20 tokens.

The trend of newly added ERC20 tokens first increased and then decreased. During the cryptocurrency bull market from March to May 2024, the number of newly added ERC20 tokens significantly increased, while the number of newly added ERC20 tokens on the Optimism chain was relatively low, averaging an increase of about 4,500 ERC20 tokens per month.

Number of User Addresses Involved in Suspected Risky Tokens on Optimism Chain

The number of addresses involved in suspected risky tokens on the Optimism chain is significantly lower than that on the aforementioned two chains. Before March 2024, this number fluctuated relatively little. From March to May 2024, the number of addresses involved in suspected risky tokens on the Optimism chain increased significantly.

Although the number of newly added suspected risky ERC20 tokens on the Optimism chain was relatively low during this period, the number of addresses involved in suspected risky tokens increased significantly. This phenomenon may be due to previously suspected risky tokens affecting a large number of users during the cryptocurrency bull market, or it may be due to the small number of newly added suspected risky tokens affecting a large number of users during this period.

Blast

Number of New Tokens and New Suspected Risky Tokens on Blast Chain

The Blast chain launched its mainnet in March 2024, but transactions had already occurred on its chain in February 2024, so only data from February to May 2024 is available.

In the past three quarters, a total of 13,859 ERC20 tokens were newly added on the Blast chain, of which 12,608 were scanned as new suspected risky ERC20 tokens, accounting for approximately 91%.

The number of newly added ERC20 tokens on the Blast chain shows a downward trend. After the mainnet launch in March 2024, the Blast chain rapidly increased the number of ERC20 tokens, but the number of newly added tokens gradually decreased thereafter. Approximately 91% of the newly added ERC20 tokens are suspected risky tokens.

Number of User Addresses Involved in Suspected Risky Tokens on Blast Chain

After the launch of the Blast chain mainnet in March this year, user growth was rapid, and on-chain transactions were active. Data shows that in March 2024, the number of addresses involved in suspected scam contracts on the Blast chain reached as high as 642,000, close to the 663,000 on the Optimism chain, indicating that transactions involving suspected risky tokens on the Blast chain are very active. By May, the number of addresses involved in suspected risky tokens had reached 218,000, potentially forming a historical high. As an emerging L2 chain, the Blast chain has already shown signs of fraud issues, which warrants high vigilance.

Mantle

Number of New Tokens and New Suspected Risky Tokens on Mantle Chain

In the past three quarters, a total of 5,645 ERC20 tokens were newly added on the Mantle chain, of which 3,801 were scanned as new suspected risky ERC20 tokens, accounting for approximately 67.3%.

The proportion of newly added ERC20 tokens and newly added suspected risky ERC20 tokens on the Mantle chain shows a downward trend.

The number of newly added suspected risky tokens on the Mantle chain is the lowest among the five chains.

Number of User Addresses Involved in Suspected Risky Tokens on Mantle Chain

The number of addresses involved in suspected risky tokens on the Mantle chain is relatively low, even lower than that on the newly launched Blast chain. However, data shows that this metric is generally on the rise, increasing from 1,519 to around 54,000, a growth of over 35 times, indicating that fraud issues on the Mantle chain also warrant high vigilance.

Conclusion

Overall, the rapid growth in the number of addresses involved in suspected risky tokens across various Layer-2 Ethereum networks indicates that the investment environment faced by users is becoming increasingly harsh. The data clearly shows that as the popularity of these networks increases, the risk of encountering scams also rises, especially scams related to meme tokens. This trend is evident across all analyzed networks. As the entire field continues to develop, we all need to remain vigilant and actively guard against these threats. GoPlus Network, as an open, permissionless, and user-driven modular security layer for Web3, provides users with protection throughout the entire transaction lifecycle, utilizing a decentralized user security network and advanced AI-driven security solutions to offer in-depth risk analysis and provide users with intelligent and efficient security services. If users encounter any security issues, we will do our utmost to help resolve them.