← All signals / ← Tous les signaux

Danger signal Roadmap

This detection is documented but not yet emitted by the live pipeline - it is on the roadmap, so you will not see it on analyzed tokens yet.

Proxy Implementation Is a Known Scam

The implementation behind the proxy is byte-identical to a confirmed mass-scam factory.

Analyzer: Bytecode Patterns
Slug: proxy_implementation_known_scam

What it means

The runtime bytecode of the resolved implementation matches a known scam-factory hash from RektRadar's clustered bytecode map. The clean-looking proxy shell delegates all of its logic to a contract that is a copy-paste of a confirmed mass-scam template.

Why it matters

This is a near-certain verdict reached through the proxy: the shell is camouflage, the logic is a known scam. Tooling that only inspects the proxy address sees nothing wrong - following the delegatecall is what exposes it.

How RektRadar detects it

Hashes the resolved implementation's runtime bytecode (keccak256) and matches it against the known scam-factory cluster hashes; a hit raises this flag alongside known_scam_bytecode.

Recent tokens with this signal

Loading recent tokens…

Analyze a token →

Related signals

Suspicious Function Selectors - The bytecode exposes function selectors known to enable rugs (sweepETH, removeLiquidityNoFee, etc.). Source Unverified - No verified source on Etherscan - analysis falls back to bytecode-only signals. Very Small Contract - The bytecode is too small to be a real ERC-20 - likely a proxy front for malicious logic. Known Scam-Factory Bytecode - The contract's bytecode is byte-identical to a confirmed mass-scam factory we have already flagged thousands of times. DELEGATECALL Opcode - The contract can execute external code in its own context - the basis of upgradeable/proxy logic.