Show

Security

GoPlus Security

Ethereum

Aavegotchi

Two automated security scanners returned opposite verdicts on the same official Aavegotchi GHST contract on Ethereum on September 11, 2026, with GoPlus Security flagging address 0x3F382DbD960E3a9bbCeaE22651E88158d2791550 as a honeypot even as Honeypot.is classified the identical token as low-risk with a 0% simulated sell tax, leaving the "Aavegotchi GHST honeypot flag" unresolved rather than proven.
The disagreement matters because a honeypot label signals a token buyers can acquire but cannot sell, and a false positive on a token listed on both Binance and Coinbase carries reputational weight disproportionate to any verified on-chain harm. No exploit, loss figure, or first-alert date has been established from the evidence reviewed here. For related coverage, see <a href="https://www.coincu.com/ripple-ai-agents-corporate-treasury-platform/" rel="noopener noreferrer nofollow">Ripple Adds AI Agents to Treasury Platform Acquired for $1B</a>.
<h2 id="what-was-flagged-and-which-ghst-contract-does-it-concern">What was flagged, and which GHST contract does it concern?</h2>
The canonical Ethereum GHST contract is 0x3F382DbD960E3a9bbCeaE22651E88158d2791550, an address the official Aavegotchi token page and Etherscan both identify as the "Aavegotchi: GHST Token," matching the on-chain token name "Aavegotchi GHST Token" returned by both scanners. For related coverage, see <a href="https://www.coincu.com/bitget-api-cfd-trading-gold-forex-stock-indices/" rel="noopener noreferrer nofollow">Bitget API Adds CFD Trading for Gold, Forex and Stock Indices</a>.
At 09:37:26 UTC on September 11, 2026, GoPlus Security returned is_honeypot='1' for that address on chain ID 1, <a href="https://etherscan.io/address/0x3f382dbd960e3a9bbceae22651e88158d2791550#code" rel="noopener noreferrer nofollow">the verified contract on Etherscan</a> showing open-source code and eight active Uniswap and SushiSwap liquidity pools. That flag confirms a scanner classification, not a demonstrated exploit or universal inability to sell. For related coverage, see <a href="https://www.coincu.com/chatgpt-financial-services-junior-bankers/" rel="noopener noreferrer nofollow">ChatGPT for Financial Services: What Happens to Junior Bankers?</a>.
<figure style="margin:24px 0;padding:24px;border:1px solid #d1d5db;border-left:4px solid #6554c0;border-radius:8px;background:#f8fafc;font-family:Arial,Helvetica,sans-serif;color:#111827">
 GoPlus Ethereum GHST honeypot flag
 1
 <figcaption style="margin:0;font-size:14px;line-height:1.6;color:#374151">
 GoPlus returned is_honeypot='1' at 2026-09-11 09:37:26 UTC for the official Ethereum GHST contract. This confirms a scanner flag, not an exploit or universal inability to sell. Honeypot.is returned isHoneypot=false. The linked explorer provides contract context; the scanner observation comes from the supplied research API snapshot.
 </figcaption>
</figure>
The scope is Ethereum only. The official page separately lists a Polygon contract at 0x385eeac5cb85a38a9a07a70c73e0a3271cfb54a7 and a Base contract at 0xcD2F22236DD9Dfe2356D7C543161D4d260FD9BcB, and the Ethereum scanner results cannot be generalized to those deployments. A shared ticker or token name never establishes contract identity; only a chain-and-address match against an authoritative reference does.
The GoPlus response also returned owner_change_balance='1', transfer_pausable='1' and external_call='1', while reporting buy_tax='0', sell_tax='0' and, notably, cannot_sell_all='0'. Those secondary fields describe code capabilities the scanner detected; the response supplied no failing trace or causal explanation for the honeypot classification itself.
<h2 id="the-bonding-curve-token-behind-the-warning">The bonding-curve token behind the warning</h2>
GHST launched on Ethereum in 2020 through a bonding curve that closed in March 2023, capping supply at a figure the official page now displays as 52,747,802 tokens, closely matching the 52,747,802.71 total supply both scanners read on-chain.
Aavegotchi's origins are tied to Polygon, which it selected in earlier phases to <a href="https://www.coincu.com/aavegotchi-polygon-blockchain-q3-2023/" rel="noopener noreferrer nofollow">build a custom blockchain for its 2023 launch</a>, a history that explains why GHST exists as a multi-chain token with distinct contracts requiring separate scrutiny. GoPlus recorded 8,935 holders on the Ethereum contract, with the largest single holder, a contract address, holding roughly 41% of supply.
The token remains actively traded rather than abandoned, with GHST changing hands at <a href="https://etherscan.io/address/0x3f382dbd960e3a9bbceae22651e88158d2791550" rel="noopener noreferrer nofollow">$0.063257</a> as of 09:36:46 UTC on September 11, down about 11.87% over 24 hours, against a market capitalization near $3.34 million and 24-hour volume of roughly $766,000. No evidence links that decline to the scanner flag; the market snapshot establishes neither event timing nor causation.
<h2 id="does-the-contract-code-support-the-honeypot-warning">Does the contract code support the honeypot warning?</h2>
Etherscan's displayed source is a MiniMeToken implementation, a well-known controller-based ERC-20 variant, and its exposed logic contains several gates worth examining before drawing conclusions. This mirrors patterns seen in other flagged tokens, including a recent <a href="https://www.coincu.com/snt-token-honeypot-flag-owner-balance-controls/" rel="noopener noreferrer nofollow">SNT token honeypot flag centered on owner balance controls</a>, where code capability and exercised authority proved distinct questions.
The verified code shows enableTransfers(bool) restricted by an onlyController modifier, a transfer() function that requires transfersEnabled to be true, and a transferFrom() that exempts the controller from the normal allowance and transfer-enabled branch. The internal doTransfer() can also invoke the controller's onTransfer hook.
Those mechanisms exist in code, but the present-day controller address, its effective permissions, and whether governance restricts it were not independently resolved at any pinned block. GoPlus returned owner_change_balance='1' and transfer_pausable='1', which align with the capabilities visible in the source, yet the scanner did not attribute its flag to these functions, and doing so remains a plausible investigation lead rather than an established cause.
Verified source code is evidence for inspection, not a guarantee of safety or a proof of malice. A control that can pause transfers is materially different from one that is paused, and neither scanner reported that transfers were disabled at the time of the scan.
<h2 id="what-a-successful-7-500-61-ghst-transfer-does-and-does-not-prove">What a successful 7,500.61 GHST transfer does and does not prove</h2>
On-chain activity on the same day shows the token moving. Etherscan marks transaction 0x5c981ec6fe40a1d1acf14edc4310ff8972ff29ac022c123083debe95919aaf86 as a success at block 25953110, timestamped 08:57:35 UTC on September 11, 2026, recording a transfer of 7,500.61 GHST via transferFrom.
<div class="on-chain-data" style="background:#0d1117;border-left:3px solid #f7931a;padding:16px 20px;margin:20px 0;border-radius:4px">
 ON-CHAIN DATA
 <ul style="margin:0;color:#e6edf3">
 <li>Transaction hash:<a href="https://etherscan.io/tx/0x5c981ec6fe40a1d1acf14edc4310ff8972ff29ac022c123083debe95919aaf86" rel="noopener noreferrer nofollow" style="color:#f7931a">0x5c98...aaf86</a></li>
 <li>Amount: 7,500.61 GHST (raw 7500610000000000000000)</li>
 <li>From: 0xF3AAc0CE294a96B1703B9b93d393e6D240B6Bd98 → 0xbDEABfF0c074407e86AabFF104B8e1CD791b0210</li>
 <li>Block: #25,953,110 (September 11, 2026, 08:57:35 UTC)</li>
 </ul>
</div>
That receipt proves one thing precisely: a single transferFrom completed on Ethereum. It is not a DEX swap, it does not confirm that the sender exchanged GHST for another asset, and one wallet's successful transfer cannot be generalized into universal sellability, particularly without confirming the sender is not a privileged or exempt address.
<h2 id="what-sell-simulations-and-liquidity-actually-demonstrate">What sell simulations and liquidity actually demonstrate</h2>
Where GoPlus flagged the token, Honeypot.is returned the opposite verdict during the same research window, reporting simulationSuccess=true, isHoneypot=false, a risk level of "low," and a simulated sell tax of 0% on the Uniswap V2 GHST-WETH pair.
<figure style="margin:24px 0;padding:24px;border:1px solid #d1d5db;border-left:4px solid #6554c0;border-radius:8px;background:#f8fafc;font-family:Arial,Helvetica,sans-serif;color:#111827">
 Honeypot.is simulated sell tax
 0%
 <figcaption style="margin:0;font-size:14px;line-height:1.6;color:#374151">
 Honeypot.is reported 0% sell tax, simulationSuccess=true and isHoneypot=false for the Ethereum Uniswap V2 GHST-WETH pair during the 2026-09-11 09:36:47–09:37:26 UTC retrieval window. This is a scanner simulation, not an independently inspected sale or a guarantee of sellability. GoPlus flagged the same token; no common evaluated block was captured. The linked explorer provides contract context; the result comes from the supplied research API snapshot.
 </figcaption>
</figure>
Honeypot.is selected Uniswap V2 pair 0xaB659deE3030602c1aF8C29D146fAcD4aeD6EC85, created in September 2020, and its holderAnalysis reported 100 analyzed holders, 100 successful and 0 failed, with zero siphoned. Per the tool's documentation, holderAnalysis counts a sample of analyzed holders rather than all token holders, so this is a scanner result, not 100 independently inspected sales.
The two results are not directly reconcilable because no common evaluated block was captured, the pair-selection defaults differ, and the responses report different liquidity and holder figures. A simulation depends on wallet, amount, route and block state, and a passing simulation on one Uniswap V2 route does not guarantee sellability across every pool or future block.
The honest reading is that observable evidence points in conflicting directions: one scanner flags the token, a second simulates a clean sale, and one real transferFrom succeeded. That combination supports a scanner-disagreement finding, not a false-positive verdict and not a confirmed honeypot.
<h2 id="how-readers-can-verify-the-ghst-warning-themselves">How readers can verify the GHST warning themselves</h2>
The reproducible sequence is read-only and does not require risking funds. First, authenticate the address and chain by matching the official Aavegotchi token page against Etherscan, confirming the Ethereum contract is 0x3F382DbD960E3a9bbCeaE22651E88158d2791550 and not the Polygon or Base deployment.
Second, inspect the verified source on the explorer, focusing on the controller-gated transfer functions rather than assuming the presence of a pause function equals an active restriction. Third, corroborate against transaction records and pool liquidity, distinguishing a token transfer from a completed swap and separating true contract blocks from ordinary slippage, approval, gas or insufficient-liquidity failures.
What a single scanner result cannot establish is intent, the cause of a flag, or a universal outcome for all holders; a passing simulation and a failing flag can coexist when the underlying methods and blocks differ. Broader market mood offered no resolution either, with the market-wide Fear &amp; Greed reading at 56, or "Greed," a Bitcoin-driven sentiment gauge that says nothing specific about GHST holders.
No verified GHST-specific community reaction, exploit transaction, loss figure, or incident-specific project response was obtained, and those gaps are stated here rather than filled with speculation.
<h2 id="faq-aavegotchi-ghst-and-the-reported-honeypot-flag">FAQ: Aavegotchi GHST and the reported honeypot flag</h2>
Is Aavegotchi GHST a honeypot? The evidence does not support a verdict. GoPlus flagged the Ethereum contract as a honeypot while Honeypot.is did not, and no exploit or blocked sale was independently verified.
Why might a security scanner flag a token as a honeypot? Scanners detect code capabilities such as pausable transfers or owner balance changes, and run simulated trades; a flag can reflect a detected capability or a simulation condition rather than a proven, exercised restriction, and the GoPlus response supplied no specific cause here.
Does a successful GHST sale prove the token is safe? No. The verified 7,500.61 GHST movement was a transferFrom, not a swap, and even a successful sale from one wallet on one route at one block cannot establish universal sellability.
How do I confirm the correct GHST contract? Match the chain and full address against the official Aavegotchi token page before trusting any scanner output, since Ethereum, Polygon and Base each use a different GHST contract and results do not transfer between them.
The next concrete triggers to watch are an original dated alert with a failing trace from GoPlus, a block-pinned independent buy/sell simulation, and an on-chain read of the current controller's permissions, any of which would move this story from scanner disagreement toward a resolved answer.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The post <a href="https://www.coincu.com/aavegotchi-ghst-honeypot-flag-on-chain-analysis/" rel="noopener noreferrer nofollow">Aavegotchi GHST Honeypot Flag: What On-Chain Data Can Show</a> was initially published on <a href="https://coincu.com/" rel="noopener noreferrer nofollow">Coincu</a>.

Aavegotchi GHST Honeypot Flag: What On-Chain Data Can Show

Table of Contents

Coincu

Other articles published on Sep 11, 2026

Join our free newsletter for daily crypto updates!