# Token security · API reference · Femtos

> Honeypot check: a buy, a transfer and a sell simulated on our node, taxes, owner powers, holders and LP, with a verdict. GET /v1/tokens/{address}/security on Elysium and HyperEVM: parameters, response fields and a live call per layer.

- Base URL: `https://api.femtos.xyz/v1` (REST) · `wss://api.femtos.xyz/v1/ws` (WebSocket) · MCP: `https://api.femtos.xyz/mcp`
- Auth: `Authorization: Bearer $FEMTOS_KEY`. Free key: https://femtos.xyz/account/new (browser), or with
  no browser: `GET https://femtos.xyz/accounts/agent/challenge`, solve its proof of work, then `POST https://femtos.xyz/accounts/agent/signup`
  (https://femtos.xyz/agents.md#agent-onboarding)
- Decimals are exact strings, times Unix milliseconds, addresses lowercase `0x`
- Whole API in one file: https://femtos.xyz/agents.md · OpenAPI: https://api.femtos.xyz/v1/openapi.json · Index: https://femtos.xyz/llms.txt
- Page with live calls: https://femtos.xyz/reference/token-security

## Token security — GET `/v1/tokens/{address}/security`

Honeypot check: a buy, a transfer and a sell simulated on our node, taxes, owner powers, holders and LP, with a verdict.

Layers: Elysium, HyperEVM. Not on HyperCore: HyperCore spot tokens are not contracts: the token registry and coin detail cover them.
Page with live calls: https://femtos.xyz/reference/token-security?layer=<elysium|hyperevm>

| Param | In | Example or values | Meaning |
|---|---|---|---|
| `address` | path | `<token>` (Elysium); `<evmToken>` (HyperEVM) | Token address |
| `layer` | query | `elysium` (Elysium); `hyperevm` (HyperEVM) | EVM layer |

Elysium:

```bash
curl -H "Authorization: Bearer $FEMTOS_KEY" "https://api.femtos.xyz/v1/tokens/<token>/security?layer=elysium"
```

HyperEVM:

```bash
curl -H "Authorization: Bearer $FEMTOS_KEY" "https://api.femtos.xyz/v1/tokens/<evmToken>/security?layer=hyperevm"
```

| Field | Type | Meaning |
|---|---|---|
| `verdict` | ok \| caution \| danger \| honeypot | honeypot: cannot sell, sell tax ≥ 90 % or transfers blocked; danger: a danger check; caution: a warn check |
| `reasons` | string[] | warn / danger findings, strongest first (at most 8) |
| `simulation` | object | {pool, amountIn, canBuy, canSell, canTransfer, buyTax, sellTax, transferTax, buyGas, sellGas, transferGas, revert, …} |
| `checks[]` | object | One per finding. id: can_buy, can_sell, can_transfer, buy_tax, sell_tax, transfer_tax, simulation, owner, ownership_reclaim, access_control, mintable, pausable, blacklist, whitelist, max_tx, max_wallet, trading_cooldown, trading_toggle, tax_modifiable, balance_modifiable, proxy, selfdestruct, external_call, verified_source, spam, top10_share, holders, creator_share, owner_share, liquidity_usd, lp_locked: {id, severity, value, message} |
| `holders` | object | {top10Share, top10EoaShare, totalHolders, creator, creatorShare, ownerShare} |
| `liquidity` | object | {usd, pools, mainPool} |
| `height` | int | Block the checks ran at |
| `asOf` | int | Unix ms of the report |
| `cached` | boolean | Served from the 60 s cache (ageMs old) |
| `billing` | heavy | heavy |

## Related (Holders & tokens)

- [Token registry](https://femtos.xyz/reference/coins.md) `GET /v1/coins`: HyperCore tokens with their HyperEVM contract and price. (Elysium, HyperCore, HyperEVM)
- [Coin detail](https://femtos.xyz/reference/coin.md) `GET /v1/coins/{layer}/{id}`: One token: its links across layers, the markets it trades on, its 5 largest holders. (Elysium, HyperCore, HyperEVM)
- [Token metadata](https://femtos.xyz/reference/tokens-batch.md) `GET /v1/tokens`: Metadata of up to 100 tokens: supply, creator, logo and socials when indexed, family, spam. Also POST with a JSON body. (Elysium, HyperCore, HyperEVM)
- [Token overview](https://femtos.xyz/reference/token-overview.md) `GET /v1/tokens/{address}`: One token across all its pools: price, FDV, market cap, liquidity, windows, holders, top pools. (Elysium, HyperEVM)
- [Token across layers](https://femtos.xyz/reference/token-lifecycle.md) `GET /v1/tokens/{address}/lifecycle`: One token from its Elysium launch to its HyperEVM mirror, HyperCore spot and perps, each link proven or marked inferred. (Elysium, HyperCore, HyperEVM)
- [Holders](https://femtos.xyz/reference/holders.md) `GET /v1/holders`: Spot balances of a HyperCore token, largest first. (Elysium, HyperCore, HyperEVM)
- [Perp holders](https://femtos.xyz/reference/holders-positions.md) `GET /v1/holders`: Largest open positions of a perp, long and short. (HyperCore)
- [Token families](https://femtos.xyz/reference/token-families.md) `GET /v1/token-families`: Tokens whose balance moves without Transfer logs: Aave aTokens and debt tokens, stHYPE, xStocks. (Elysium, HyperEVM)
- [Family token holders](https://femtos.xyz/reference/token-family.md) `GET /v1/token-families/{token}`: Holders of one family token with balanceOf at the indexed head. (Elysium, HyperEVM)
- [Token transfers](https://femtos.xyz/reference/transfers.md) `GET /v1/transfers`: ERC-20 Transfer events of one token, newest first. (Elysium)
- [Spam tokens](https://femtos.xyz/reference/spam-tokens.md) `GET /v1/tokens/spam`: Tokens the indexer flags as spam, left out of every list, and the latest flag changes. (Elysium, HyperEVM)

Every page: https://femtos.xyz/reference.md