Burrow $BURROW

I.Contract autopsy

Source

Verified on RobinScan

Owner

No owner() accessor

Proxy

None detected

Supply

1,000,000,000

Bytecode

3,248 bytes

Functions

18recovered by EVMole

No findings in this layer.

II.Website autopsy

Captured scripts

3

Hardcoded addresses

0

External hosts

5

• infopersonal_sign in site scripts (1×)● inferred+

  Requests a message signature. Normal for sign-in flows. Present in 1 file(s). Presence alone does not show the site calls it, or that the call is malicious; wallet libraries bundle these strings.

  • Exh. E8personal_sign at origins/7b1a6b185021c4ef1b79a047d1e88bdff71580eca019e0a7d227aa5e72248dcb/js/core.js:451:59
• infoTrading happens off-site: www.ponsfamily.com● confirmed+

  The rendered page links users to: "Launch" → https://burrowpad.lol/launch; "Dark pool" → https://burrowpad.lol/pool; "Buy $BURROW" → https://www.ponsfamily.com/launchpad/0xb39619059eff1f992e157d32ff3e21407ca3233a (includes this token's address). Those destinations were not inspected in this scan; check them separately before trading.

  • Exh. E9Rendered link "Launch" → https://burrowpad.lol/launch
  • Exh. E10Rendered link "Dark pool" → https://burrowpad.lol/pool
  • Exh. E11Rendered link "Buy $BURROW" → https://www.ponsfamily.com/launchpad/0xb39619059eff1f992e157d32ff3e21407ca3233a

III.Cross-layer findings

• infoWebsite page is keyed to this token by its URL● confirmed+

  The scripts never hardcode 0xB39619059efF1f992E157d32fF3E21407ca3233a; the page reads it from its own URL (https://burrowpad.lol/coin/0xb39619059eff1f992e157d32ff3e21407ca3233a?ref=isolated) at runtime, and no other token contract is hardcoded.

  • Exh. E12Captured page URL https://burrowpad.lol/coin/0xb39619059eff1f992e157d32ff3e21407ca3233a?ref=isolated
• info"Dark pool" leads to a page for this exact token● confirmed+

  burrowpad.lol hardcodes the token address in its scripts (0xB39619059efF1f992E157d32fF3E21407ca3233a), so the site's trade path targets the submitted contract.

  • Exh. E15Trade destination loaded at https://burrowpad.lol/pool
  • Exh. E16Token address at burrowpad.lol origins/7b1a6b185021c4ef1b79a047d1e88bdff71580eca019e0a7d227aa5e72248dcb/js/pages/pool.js:7
• infoTrade destination burrowpad.lol can request: approve(), eth_sendTransaction● inferred+

  These wallet requests are present in burrowpad.lol's scripts (approve() ×1, eth_sendTransaction ×1). This is what a buyer arriving from the launch site may be asked to sign; presence is not misuse.

  • Exh. E17eth_sendTransaction at burrowpad.lol origins/7b1a6b185021c4ef1b79a047d1e88bdff71580eca019e0a7d227aa5e72248dcb/js/pages/pool.js:390
  • Exh. E18approve() at burrowpad.lol origins/7b1a6b185021c4ef1b79a047d1e88bdff71580eca019e0a7d227aa5e72248dcb/js/pages/pool.js:408
• info"Buy $BURROW" leads to a page for this exact token● confirmed+

  ponsfamily.com carries the token address in its URL (0xB39619059efF1f992E157d32fF3E21407ca3233a), so the site's trade path targets the submitted contract.

  • Exh. E21Trade destination loaded at https://ponsfamily.com/launchpad/0xb39619059eff1f992e157d32ff3e21407ca3233a
• infoTrade destination ponsfamily.com can request: approve(), Permit2 contract, eth_signTypedData, eth_sendTransaction● inferred+

  These wallet requests are present in ponsfamily.com's scripts (approve() ×3, Permit2 contract ×1, eth_signTypedData ×1, eth_sendTransaction ×5). This is what a buyer arriving from the launch site may be asked to sign; presence is not misuse.

  • Exh. E22eth_sendTransaction at ponsfamily.com origins/17a7eb80e767a9d70da3639f45bec7cf080c2f83c436310fadba53925d9ebb93/_next/static/immutable/chunks/0386rofmroyxz.js:1
  • Exh. E23eth_sendTransaction at ponsfamily.com origins/17a7eb80e767a9d70da3639f45bec7cf080c2f83c436310fadba53925d9ebb93/_next/static/immutable/chunks/04i5uwt5a1r0_.js:1
  • Exh. E24Permit2 contract at ponsfamily.com origins/17a7eb80e767a9d70da3639f45bec7cf080c2f83c436310fadba53925d9ebb93/_next/static/immutable/chunks/07srjrusjgd9l.js:1
  • Exh. E25approve() at ponsfamily.com origins/17a7eb80e767a9d70da3639f45bec7cf080c2f83c436310fadba53925d9ebb93/_next/static/immutable/chunks/2petoud-lxhwk.js:1
  • Exh. E26approve() at ponsfamily.com origins/17a7eb80e767a9d70da3639f45bec7cf080c2f83c436310fadba53925d9ebb93/_next/static/immutable/chunks/2zhb_m58y9-__.js:1

IV.Where the trade buttons lead

V.What remains unknown

• No owner() / getOwner() accessor. Control may use roles, a different accessor, or none.
• Chromium ran without its internal sandbox, inside the isolated capture service (no secrets or database access).
• Site redirected from https://www.ponsfamily.com to https://ponsfamily.com.
• 1 other linked page(s) were not inspected (limit 2).

VI.Exhibits

1. Exh. E1

   eth_getCode at block 92343391: 3248 bytes

   chain read · eth_getCode · block 92343391

2. Exh. E2

   RobinScan reports source verified (PonsV2LauncherToken)

   robin.etherscan.io

   open on explorer ↗
3. Exh. E3

   Saved token bytecode (3248 bytes)

   bytecode · A1 sha256 15a41f2df7dc…

4. Exh. E4

   REA/EVMole inferred 18 function candidates on token

   REA inspect_evm_interface · ev_51d5b23b4f68f5c… · A2 sha256 a59a625f6ca5…

5. Exh. E5

   REA browser scenario capture (network response bodies) of https://burrowpad.lol

   REA capture_browser_scenario · A3 sha256 f6cf75c38be5…

6. Exh. E6

   REA export_web_scripts manifest

   REA export_web_scripts · A4 sha256 a796a3d89df7…

7. Exh. E7

   REA JavaScript Application Graph for exported scripts

   REA analyze_javascript_application · ev_9e630f5b2e8ecd9… · A8 sha256 89fe840fc496…

8. Exh. E8

   personal_sign at origins/7b1a6b185021c4ef1b79a047d1e88bdff71580eca019e0a7d227aa5e72248dcb/js/core.js:451:59

   js/core.js:451:59 · A6 sha256 abb68d567655…

   ); let signature; try { signature = await withTimeout(eth.request({ method: 'personal_sign', params: [utf8Hex(message), address] }), 120000); } catch (e) { throw walletErr

9. Exh. E9

   Rendered link "Launch" → https://burrowpad.lol/launch

   https://burrowpad.lol/launch

10. Exh. E10

    Rendered link "Dark pool" → https://burrowpad.lol/pool

    https://burrowpad.lol/pool

11. Exh. E11

    Rendered link "Buy $BURROW" → https://www.ponsfamily.com/launchpad/0xb39619059eff1f992e157d32ff3e21407ca3233a

    https://www.ponsfamily.com/launchpad/0xb39619059eff1f992e157d32ff3e21407ca3233a

12. Exh. E12

    Captured page URL https://burrowpad.lol/coin/0xb39619059eff1f992e157d32ff3e21407ca3233a?ref=isolated

    https://burrowpad.lol/coin/0xb39619059eff1f992e157d32ff3e21407ca3233a?ref=isolated

13. Exh. E13

    REA browser scenario capture (network response bodies) of https://burrowpad.lol

    REA capture_browser_scenario · A9 sha256 bfb70a5b5f86…

14. Exh. E14

    REA export_web_scripts manifest

    REA export_web_scripts · A10 sha256 e129c938e63f…

15. Exh. E15

    Trade destination loaded at https://burrowpad.lol/pool

    https://burrowpad.lol/pool

16. Exh. E16

    Token address at burrowpad.lol origins/7b1a6b185021c4ef1b79a047d1e88bdff71580eca019e0a7d227aa5e72248dcb/js/pages/pool.js:7

    js/pages/pool.js:7:22 · A13 sha256 dc1c47fe261e…

    pool.js'; const EXPLORER = 'https://robinhoodchain.blockscout.com'; const FALLBACK_CA = '0xb39619059eff1f992e157d32ff3e21407ca3233a'; const SIG_KEY = 'bp_pool_sig'; const SLIPPAGE_BPS = 300n; const ETH = Z.ETH; const pool

17. Exh. E17

    eth_sendTransaction at burrowpad.lol origins/7b1a6b185021c4ef1b79a047d1e88bdff71580eca019e0a7d227aa5e72248dcb/js/pages/pool.js:390

    js/pages/pool.js:390:47 · A13 sha256 dc1c47fe261e…

    ); } async function sendTx(w, tx) { try { return await w.provider.request({ method: 'eth_sendTransaction', params: [{ from: w.address, ...tx }] }); } catch (e) { throw new Error(e?.code ===

18. Exh. E18

    approve() at burrowpad.lol origins/7b1a6b185021c4ef1b79a047d1e88bdff71580eca019e0a7d227aa5e72248dcb/js/pages/pool.js:408

    js/pages/pool.js:408:114 · A13 sha256 dc1c47fe261e…

    it waitReceipt(w.provider, await sendTx(w, { to: token, data: ercIface.encodeFunctionData('approve', [S.info.address, amt]) })); i++; } runStep(i, 'confirm in your wallet'); 

19. Exh. E19

    REA browser scenario capture (network response bodies) of https://ponsfamily.com

    REA capture_browser_scenario · A14 sha256 7f858198d56d…

20. Exh. E20

    REA export_web_scripts manifest

    REA export_web_scripts · A15 sha256 2816de405831…

21. Exh. E21

    Trade destination loaded at https://ponsfamily.com/launchpad/0xb39619059eff1f992e157d32ff3e21407ca3233a

    https://ponsfamily.com/launchpad/0xb39619059eff1f992e157d32ff3e21407ca3233a

22. Exh. E22

    eth_sendTransaction at ponsfamily.com origins/17a7eb80e767a9d70da3639f45bec7cf080c2f83c436310fadba53925d9ebb93/_next/static/immutable/chunks/0386rofmroyxz.js:1

    _next/static/immutable/chunks/0386rofmroyxz.js:1:3094 · A17 sha256 a9fb07d3ae25…

    ,maxPriorityFeePerGas:(0,s.toHex)(a.maxPriorityFeePerGas)}}return await r.request({method:"eth_sendTransaction",params:[t]})}default:throw Error(`Unsupported sign intent: ${a}`)}}}}let m=async e=>{let[

23. Exh. E23

    eth_sendTransaction at ponsfamily.com origins/17a7eb80e767a9d70da3639f45bec7cf080c2f83c436310fadba53925d9ebb93/_next/static/immutable/chunks/04i5uwt5a1r0_.js:1

    _next/static/immutable/chunks/04i5uwt5a1r0_.js:1:1948 · A18 sha256 53605e8b0333…

    ransaction"),i=m.get(e.uid);try{return await e.request({method:i?"wallet_sendTransaction":"eth_sendTransaction",params:[s]},{retryCount:0})}catch(t){if(!1===i)throw t;if("InvalidInputRpcError"===t.name

24. Exh. E24

    Permit2 contract at ponsfamily.com origins/17a7eb80e767a9d70da3639f45bec7cf080c2f83c436310fadba53925d9ebb93/_next/static/immutable/chunks/07srjrusjgd9l.js:1

    _next/static/immutable/chunks/07srjrusjgd9l.js:1:35672 · A19 sha256 d81dbe7c42c1…

    rn e&&n?{launcher:e,feeRouter:n}:null}e.i(29710).ROBINHOOD_WETH_ADDRESS,e.s(["PERMIT2",0,"0x000000000022D473030F116dDEE9F6B43aC78BA3","feeRouterAddress",0,i,"getSponsorAddresses",0,s,"isSponsorConfigured",0,function(){retu

25. Exh. E25

    approve() at ponsfamily.com origins/17a7eb80e767a9d70da3639f45bec7cf080c2f83c436310fadba53925d9ebb93/_next/static/immutable/chunks/2petoud-lxhwk.js:1

    _next/static/immutable/chunks/2petoud-lxhwk.js:1:7905 · A40 sha256 0db032bebb28…

    ress"},{name:"spender",type:"address"}],outputs:[{type:"uint256"}]},{type:"function",name:"approve",stateMutability:"nonpayable",inputs:[{name:"spender",type:"address"},{name:"amount",type:

26. Exh. E26

    approve() at ponsfamily.com origins/17a7eb80e767a9d70da3639f45bec7cf080c2f83c436310fadba53925d9ebb93/_next/static/immutable/chunks/2zhb_m58y9-__.js:1

    _next/static/immutable/chunks/2zhb_m58y9-__.js:1:35374 · A42 sha256 34f34a9e304a…

    c20Approve",0,function(e){return{to:e.token,data:(0,n.encodeFunctionData)({abi:r.erc20Abi,functionName:"approve",args:[e.spender,e.amount]})}},"sendWalletCallBundle",0,h],217221)},280331,e=>{"use strict