Hackers onyour side.
Hacker Stocks reads the code behind every token on Robinhood Chain and scores what its keys can do: mint, freeze, upgrade, drain. Paste an address and see it in seconds.
Most people sign contracts they have never read. Hacker Stocks reads every token on Robinhood Chain so you know who holds the keys.
Every contract has keys. We show you who holds them.
Scanning tells you what could go wrong. The rest of the kit does something about it, and all of it lives on Robinhood Chain where anyone can check it.
X-ray
Any address, read from its live code in seconds.
X-ray
Any address, read from its live code in seconds.
- Follows EIP-1967, beacon and minimal proxies to the code that actually runs.
- Lists every privileged function and who holds it: a wallet, a contract, a role or nobody.
- Scores 0 to 100 with every point it lost printed next to the reason.
The board
The busiest tokens on the chain right now, priced by safety.
The board
The busiest tokens on the chain right now, priced by safety.
- Ranked by transfers in the last 600 blocks and refreshed every minute.
- Robinhood stock tokens are always listed, with their issuer controls spelled out.
- Copycat tickers and lookalike letters are flagged.
Gaps
Price gaps between stock token pools: free money, or bait?
Gaps
Price gaps between stock token pools: free money, or bait?
- Every Robinhood stock token that trades in two or more pools, read live.
- What a gap pays after pool fees and gas, and how big a trade it carries, swapped tick by tick.
- Pushed pools, thin pools, ghost prices and lookalike tickers are flagged. Nothing here trades for you.
Wallet checkup
Who can spend your tokens without asking again.
Wallet checkup
Who can spend your tokens without asking again.
- Finds every live token approval a wallet has given on Robinhood Chain.
- Scores each spender with the X-ray and flags unlimited ones.
- Revoke in one transaction you sign yourself. Reading needs only an address.
Bounty escrow
Projects lock ETH so white-hats get paid first.
Bounty escrow
Projects lock ETH so white-hats get paid first.
- The pool is locked on chain for 30 to 730 days, so it cannot vanish the day a report lands.
- Hunters put only a hash of their report on chain, which proves when they found it.
- Every award sends a share to the aid pool.
Aid pool
A public fund for people hit by hacks.
Aid pool
A public fund for people hit by hacks.
- Every grant is proposed in public with a reason and an evidence hash.
- It waits two days on chain, where the guardian can stop a bad one.
- Then anyone can execute it and the ETH goes straight to the victim.
Score oracle
Scores on chain, readable by any contract.
Score oracle
Scores on chain, readable by any contract.
- Each attested score is stored with a hash of the full report.
- A vault, a launchpad or a lending market can refuse a token that has not been cleared.
- One view call: scoreOf(token).
Paste an address. Read its keys.
The scan reads the live bytecode, follows proxies to the logic that runs, finds who holds the keys and lists every privileged function. Verified source on Sourcify gives exact names. Nothing comes from a project's own claims.
The chain, priced by safety.
The busiest tokens on Robinhood Chain right now, ranked by transfers in the last 600 blocks. Robinhood stock tokens are always listed. Click any row for its X-ray.
| Token | Score | Activity |
|---|
No black box. Every point explained.
Every score starts at 100 and loses points for each power and finding, by severity. The same code always gets the same score, and every report shows exactly what moved it.
- Powers come from the code that actually runs. Proxies are followed to their implementation.
- Verified source gives exact function names. Unverified code is matched by selector and counts against the score.
- A power held by a renounced owner weighs nothing. Held by a contract it weighs half. Held by a single wallet it weighs in full.
- Stock tokens keep issuer controls by design. They are listed in full under Issuer controls, never hidden, and on a recognised Robinhood stock token they weigh a quarter, because a regulated issuer holds them.
- The same code always gets the same score. The method version is printed on every report.
Make your contract check first.
The Hacker Stocks oracle stores each attested score with a hash of the full report. A vault, a launchpad or a lending market on Robinhood Chain can refuse a token that has not been cleared, in one view call.
interface IHackerOracle { function scoreOf(address target) external view returns (uint8 score, uint64 at, bytes32 reportHash, bool exists); } // refuse tokens the oracle has not cleared (uint8 score, , , bool exists) = IHackerOracle(ORACLE).scoreOf(token); require(exists && score >= MIN_SCORE, "token not cleared");
When anyone can ship a contract in a minute, someone has to read it before you sign.
Straight answers.
Is a high score a guarantee?
No. A score says what a contract's code allows its keys to do and who holds them. It cannot see a bug in logic that looks harmless, a phishing site, or a key that gets stolen tomorrow. Treat it as a fast first read, not an audit.
Why do stock tokens show freeze and pause?
Robinhood stock tokens come from a regulated issuer, who keeps controls like pausing, freezing and reissuing balances. Hacker Stocks lists every one of them under Issuer controls so you know your balance depends on the issuer. On a recognised Robinhood stock token those controls weigh a quarter of what they would on an anonymous coin, and the report says so.
Does the checkup need my keys?
No. Reading approvals needs only your address. Revoking is an ordinary approve(spender, 0) transaction that you sign in your own wallet.
How does a bounty report stay private?
You write the report in your browser and it is hashed together with a secret salt. Only the hash goes on chain, which proves when you had it. You send the text to the project yourself, through the contact in the bounty's terms.
Who decides aid grants?
The aid pool's owner proposes each grant in public with a reason and an evidence hash. It then waits two days on chain, during which the guardian can cancel it. After that anyone can execute it, and the ETH goes straight to the recipient.
Where does the data come from?
Robinhood Chain's public RPC for code, storage, balances and logs, and Sourcify for verified source. No private feeds, no project's own claims.
Join the white-hats.
Projects that want to be found safe, and holders who want to stay that way.