How the score works

Two rules that override the arithmetic

A fatal finding forces DANGER. A proven honeypot, a contract that blocks selling your full balance, a live freeze authority, a deployer already linked to honeypots, or no contract at the address at all — any one of these ends the scan at DANGER no matter how healthy everything else looks.

Unverifiable tokens are capped. This is the rule most scanners do not have, and it is the reason this one exists. Where nothing about the contract can be checked, the score cannot exceed 72 — so the best possible verdict is Caution, never Clear. Reading the deployed bytecode closes most of that gap and lifts the ceiling to 85. It never reaches 100 without a successful sell simulation, because until a sell has actually been simulated, “you can definitely get out” remains unproven.

The practical effect: a token can never be marked safe because a check failed to run. An absent check counts against the score, and the gap is named on the result page under What Nebula could not verify.

Verdict bands

What gets checked

Contract behaviour. Honeypot simulation where the chain supports it, buy and sell tax measured on-chain, mint and freeze authority, pausable transfers, blacklists, hidden owners, reclaimable ownership and changeable tax rates.

Deployed bytecode. Read straight from a public node, so it works even when the source code is unverified — the normal state of a token on launch day. Nebula calls owner() directly, reads the EIP-1967 proxy slots from storage, and scans for the four-byte selectors of mint, pause, blacklist, fee setters and upgrade hooks. When a proxy is found, the implementation’s bytecode is scanned rather than the stub — otherwise the analysis would describe code that never runs.

Liquidity structure. Pool depth summed across every pair on the chain, measured against market cap, plus LP lock and burn status. A thin pool supporting a large valuation is the structure a rug requires.

Trade flow. Volume that outruns what the pool could plausibly support, one-directional buy pressure, heavy sell pressure, and price collapses in progress.

Chain coverage

Coverage is uneven and the result page always shows which checks actually ran. Robinhood Chain is the gap worth naming: GoPlus publishes only a handful of fields there and honeypot.is rejects the chain outright, which is why direct bytecode analysis carries most of the weight.

What Nebula deliberately cannot do

It cannot see intent. A contract with no privileged functions can still be abandoned by its team. Clean code is not a promise that anyone will keep building.

Absence of a selector is not proof of absence. The bytecode scan is a reliable positive signal — Solidity’s dispatcher compares calldata via PUSH4, so a match means the function is really there. Hand-written assembly or an unusual dispatcher can still hide one, and the result page says so wherever it reports that nothing matched.

Central control is read in context. USDC genuinely can mint, pause and blacklist. Scoring that identically to an anonymous memecoin would flag the safest token on Ethereum as a rug, so where an independent source vouches for a token those findings are still shown but weighted as disclosed characteristics rather than hidden risks.

Centralised exchange liquidity is invisible. For a large, established token most real exit liquidity sits off-chain, so a low on-chain ratio there is a limit of the data and is reported as one.

A scan is a snapshot. Upgradeable proxies and live owner privileges mean a clean result can stop being true minutes later. That is exactly why upgradeability is itself scored as a risk.