How Jepeta reaches a result

Scope

Jepeta accepts one exact ERC-20 contract address on Base chain 8453. The public scanner is read-only: it does not connect to a wallet, sign a transaction, execute a trade, custody assets or modify a token.

Jepeta is not a smart-contract audit, safety guarantee, price prediction, market-wide census or investment recommendation.

What Jepeta checks

• Honeypot: explicit GoPlus Security signal. The required value must be known.
• Mintability: explicit GoPlus Security signal for whether new supply can be minted. The required value must be known.
• Taxes: observed buy and sell tax values from GoPlus when available. Missing values remain unavailable.
• Holder concentration: concentration calculated from the observed GoPlus holder sample, up to ten holder records. It is not a full holder-distribution audit.
• LP lock: observed lock coverage in the returned LP-holder sample. It is not proof that all liquidity is locked.
• Liquidity: USD liquidity from the largest exact matching Base pair returned by DEX Screener. Missing market context remains unavailable rather than becoming zero.
• Data quality: Jepeta policy describing evidence completeness and source condition separately from the risk decision.

Sources

GoPlus Security supplies the security evidence used for required honeypot and mintability checks and additional public security signals. DEX Screener supplies market context such as liquidity when available. Jepeta records source status so partial, rate-limited or unavailable upstream data is visible instead of silently normalized.

PASS, WARN and BLOCK

• PASS: no configured BLOCK or WARN condition was observed in the available evidence. PASS is not a statement that the token is safe.
• WARN: one or more material risk conditions, data-quality conditions or source-quality conditions require review before execution.
• BLOCK: a configured hard blocker was observed, such as an explicit honeypot condition.

The numeric risk score is an observed heuristic score. It is not a probability of loss.

Fail-closed behavior

Required uncertainty does not become a reassuring result. If GoPlus cannot provide a required honeypot or mintability boolean, Jepeta does not coerce the unknown value to false and does not issue PASS. Coverage gaps return HTTP 422; upstream unavailability can return HTTP 503; rate limits return HTTP 429 or an equivalent provider-specific error. DEX Screener context may be partial or unavailable, but missing market values remain null and are reflected in source status and data quality.

Data quality is not risk

Risk and evidence completeness are separate concepts. A low or degraded data-quality state means the evidence is incomplete or a source is impaired; it does not mean the token has low risk. Jepeta exposes both dimensions so a human or agent can decide whether the evidence is sufficient for its own execution policy.

Freshness

Every successful scan includes an observed_at timestamp. Public Evidence pages are timestamped snapshots and can become stale as contracts, liquidity and market conditions change. For a current execution decision, run a fresh scan for the exact contract instead of treating an older snapshot as current.

Explainability contract

Human-facing Scan and Evidence results expose the same explanation chain:

1. Reason - why the current PASS, WARN or BLOCK was issued, using the decision semantics and public warnings.
2. Signal - the public fields observed for the result, such as honeypot, mintability, warnings and data quality.
3. Source - the upstream source and its reported availability state.
4. Observed at - the timestamp attached to the observation.
5. Methodology version - the version used to interpret the public result.

This chain only uses public preview/evidence fields. Paid-only or private evidence is not exposed by the explainability UI.

Public evidence boundary

The free preview exposes the decision, heuristic risk score, honeypot and mintability booleans, taxes when available, observed holder and LP metrics, liquidity context, data quality, source status, warnings and timestamp. Detailed dangerous-permission evidence, deeper activity context and other paid-report fields remain outside the public page.

Machine references

The canonical machine-readable methodology is methodology.json. API fields and error behavior are documented in openapi.json and human API documentation. Machine-contract changes are recorded in changelog.json.