Read a token's admin powers before you buy it

A token contract is a small program. Most of it moves balances from one address to another, but many tokens also carry functions only a privileged account may call. Those functions are where most nasty surprises come from, and they are visible before you buy if you know where to look.

The powers that matter

• Create new supply. A mint function lets the holder of the role print tokens, diluting everyone else.
• Pause transfers. One call can freeze every holder at once.
• Block single holders. A blocklist lets the owner stop chosen addresses from selling.
• Change fees or limits. A fee setter can raise the sell tax after you are in; a max-transaction setter can make selling impossible in practice.
• Switch trading on or off. Common at launch, dangerous if it stays reachable.
• Burn or move other holders' tokens. Rare in memecoins, standard in regulated assets.
• Replace the logic. On an upgradeable token, all of the above can be added later.

How the scan finds them

Nurvo Ai reads the contract's deployed bytecode and lists every four-byte function selector it pushes. Each selector is compared with a table of known administrative signatures. When the token is a proxy, the logic contract's code is read and scanned too. The result is a list of powers with the exact function signatures as evidence.

This is a match on known names. A function called something unusual will not be recognised, which is why the rule states that limit next to its result.

Having a power is not using it

What matters next is who can call those functions. The owner rule reads owner(): the zero address usually means owner-only functions are switched off; a contract owner is often a multisig or a timelock; a plain wallet means one key decides. Combine the two rules and you have a fair picture of how much trust a token asks of you.

Official stock tokens on Robinhood Chain are a special case. Their issuer can pause, block and burn by design, because the assets are regulated. The scan recognises them by the issuer's beacon in their code, never by their ticker, because copies with the same symbol are common.