# Token security · HyperEVM API · Femtos

> Honeypot check: a buy, a transfer and a sell simulated on our node, taxes, owner powers, holders and LP, with a verdict.

- Base URL: `https://api.femtos.xyz/v1` (REST) · `wss://api.femtos.xyz/v1/ws` (WebSocket) · MCP: `https://api.femtos.xyz/mcp`
- Auth: `Authorization: Bearer $FEMTOS_KEY`. Free key: https://femtos.xyz/accounts/ (browser), or with
  no browser: `GET https://femtos.xyz/accounts/agent/challenge`, solve its proof of work, then `POST https://femtos.xyz/accounts/agent/signup`
  (https://femtos.xyz/agents.md#agent-onboarding)
- Decimals are exact strings, times Unix milliseconds, addresses lowercase `0x`
- Whole API in one file: https://femtos.xyz/agents.md · OpenAPI: https://api.femtos.xyz/v1/openapi.json · Index: https://femtos.xyz/llms.txt
- Page with live calls: https://femtos.xyz/hyperevm/token-security

## Token security — GET `/v1/tokens/{address}/security`

Honeypot check: a buy, a transfer and a sell simulated on our node, taxes, owner powers, holders and LP, with a verdict.

| Param | In | Example or values | Meaning |
|---|---|---|---|
| `address` | path | `<evmToken>` | Token address |
| `layer` | query | `hyperevm` | EVM layer |

```bash
curl -H "Authorization: Bearer $FEMTOS_KEY" "https://api.femtos.xyz/v1/tokens/<evmToken>/security?layer=hyperevm"
```

| Field | Type | Meaning |
|---|---|---|
| `verdict` | ok \| caution \| danger \| honeypot | honeypot: cannot sell, sell tax ≥ 90 % or transfers blocked; danger: a danger check; caution: a warn check |
| `reasons` | string[] | warn / danger findings, strongest first (at most 8) |
| `simulation` | object | {pool, amountIn, canBuy, canSell, canTransfer, buyTax, sellTax, transferTax, buyGas, sellGas, transferGas, revert, …} |
| `checks[]` | object | One per finding. id: can_buy, can_sell, can_transfer, buy_tax, sell_tax, transfer_tax, simulation, owner, ownership_reclaim, access_control, mintable, pausable, blacklist, whitelist, max_tx, max_wallet, trading_cooldown, trading_toggle, tax_modifiable, balance_modifiable, proxy, selfdestruct, external_call, verified_source, spam, top10_share, holders, creator_share, owner_share, liquidity_usd, lp_locked: {id, severity, value, message} |
| `holders` | object | {top10Share, top10EoaShare, totalHolders, creator, creatorShare, ownerShare} |
| `liquidity` | object | {usd, pools, mainPool} |
| `height` | int | Block the checks ran at |
| `asOf` | int | Unix ms of the report |
| `cached` | boolean | Served from the 60 s cache (ageMs old) |
| `billing` | heavy | heavy |

## Related (Holders & tokens)

- [Holders](https://femtos.xyz/hyperevm/holders.md): Current balances of an ERC-20, largest first, with concentration.
- [Token registry](https://femtos.xyz/hyperevm/coins.md): HyperEVM tokens with their HyperCore spot link and price.
- [Coin detail](https://femtos.xyz/hyperevm/coin.md): One token: its links across layers, the markets it trades on, its 5 largest holders.
- [Daily token volume](https://femtos.xyz/hyperevm/volume.md): USD swap volume of a token per UTC day, both sides of every priced swap.
- [Token families](https://femtos.xyz/hyperevm/token-families.md): Tokens whose balance moves without Transfer logs: Aave aTokens and debt tokens, stHYPE, xStocks.
- [Family token holders](https://femtos.xyz/hyperevm/token-family.md): Holders of one family token with balanceOf at the indexed head.
- [Spam tokens](https://femtos.xyz/hyperevm/spam-tokens.md): Tokens the indexer flags as spam, left out of every list, and the latest flag changes.
- [Token metadata](https://femtos.xyz/hyperevm/tokens-batch.md): Metadata of up to 100 tokens: supply, creator, logo and socials when indexed, family, spam. Also POST with a JSON body.
- [Token overview](https://femtos.xyz/hyperevm/token-overview.md): One token across all its pools: price, FDV, market cap, liquidity, windows, holders, top pools.

All HyperEVM endpoints: https://femtos.xyz/hyperevm.md