Securityum reads Elysium directly to show what a contract can do, who can spend your tokens, and which activity on the addresses you watch looks unusual. Every flag comes with its evidence.
No simulation. No score. No flag means nothing was found by these checks. It never means safe.
[ Why it matters ]
A token can carry a mint switch, a blocklist, a sell tax you can't see, or a proxy that lets someone swap the code next week. The scanner reads the bytecode, proxy slots and verified source, and names each power with the line or selector that proves it.
Scan a contractEvery approve you ever signed is still live until you set it to zero. The inspector lists each allowance and operator with its current value read on chain, and gives you one revoke per row.
Inspect permissionsUnlimited approvals, a burst of transactions, many tokens leaving at once, a look-alike sender. Nine plain rules watch the addresses you choose, and each rule shows its numbers.
Watch an addressBefore you sign, paste the target and calldata. The preview decodes what the transaction asks for and scans the contract it calls. It does not simulate, and it says so on every result.
Preview a transaction[ How it works ]
Paste any address on Elysium. The scanner walks the bytecode, reads the EIP-1967 proxy slots, owner(), paused() and the verified source from the explorer, then lists every power it found with the evidence: a selector, a slot value, an opcode offset or a source line.
Bytecode + proxy slots + verified sourceCurrent allowance read on chain · one transaction per revoke
Connect or paste a wallet. Every Approval and ApprovalForAll it ever emitted is read from chain logs, the current allowance is read again, and each live permission gets one revoke transaction that you sign in your own wallet.
Allowances + operators + revokeNot simulated · decoded request + target scan
Paste the target and calldata from a wallet prompt. The preview decodes the call with a standard or verified ABI, checks the spender and the target, and marks anything it cannot decode as unknown. It never runs the transaction, so it never claims what will happen.
Calldata decode + target scan[ Features ]
Watch any public address. Nine rules run in your browser over its latest transactions: unlimited approvals, large HYPE out, bursts, failed streaks, token sweeps, look-alike senders and more. Each rule shows its threshold, and you can change it.
Open monitorOne feed for everything you watch. Wallets give rule hits; contracts you build or use give their admin events (upgrades, owner changes, pauses, role grants, mints) read from chain logs. Alerts show while the page is open; hosted delivery is planned.
Open alertsFile a report on a contract with the hash of your evidence and a 0.05 HYPE bond. Others can post counter-evidence for 3 days. One named resolver key may then decide within 4 days; if it does not, every bond is returned. The report ledger holds HYPE bonds. It is a new contract with no independent security review yet; try it with small amounts first.
Open ledger[ FAQ ]
Four things on Elysium: what a contract can do (proxy and upgrade path, owner powers, mint, pause, blocklist, fee switches, DELEGATECALL, SELFDESTRUCT, verified source), which spenders and operators can move your tokens (with a revoke button for each), which patterns on watched addresses look unusual (rules listed with their numbers), and what a transaction asks for before you sign it.
No. No flag means nothing was found by these checks. It never means safe. A scan reads code and storage at one block. It cannot see intent, off-chain keys, or a future upgrade. That is why every flag shows its evidence and there is no score.
No. The preview reads the request and the target. It does not simulate the transaction. It decodes the call with a standard or verified ABI and scans the target. Calldata it cannot decode is marked as unknown, never as harmless.
One resolver key, fixed in the contract at deployment: 0x98a5404a8224c0e43aa622c53b9e3059d24a3ea8, the key that deployed the ledger. It is shown on the reports page and can never be changed. Its verdict is a judgement, not proof. It cannot take any bond, it cannot file or counter, and if it stays silent for the 4-day verdict window every bond is returned.
No key ever reaches this site. Every reader works with a pasted address. Connecting a wallet only shares your address; revokes and reports open in your wallet for you to read and sign.
Every tool works without $SECURITYUM. The token is not needed for any feature. A future use for API and alert quotas is planned and unproven. The contract address is TBA until launch; check it only on this site and on our X account.
Every tool works without $SECURITYUM. The token is not needed for any feature.
Every reader here is free and works with a pasted address. No account, no email, no key. Connect a wallet only when you want to revoke or file a report.
Securityum