Risk disclosure

ScanZX is an information tool. Nothing in the product, its reports, its alerts or its marketing is financial, investment, legal or tax advice, a personal recommendation, or an invitation or inducement to buy, sell or hold any cryptoasset. We do not know your circumstances, your objectives or your capacity to bear a loss, and the product does not take them into account.

We are not authorised or regulated by the Financial Conduct Authority. Buying, holding and selling cryptoassets is generally unregulated in the UK. That has consequences people underestimate: the Financial Ombudsman Service and the Financial Services Compensation Scheme do not cover these transactions. If you lose money there is usually no complaints body to appeal to and no compensation to claim.

If you need advice, speak to someone authorised to give it.

The risk score is an ordinal severity index from 0 to 100. It is not a probability. A token scoring 78 showed more, and more severe, observed warning signs than one scoring 40. It does not mean a 78% chance of anything.

• 0–19 — low observed risk
• 20–44 — medium observed risk
• 45–69 — high observed risk
• 70–100 — critical observed risk

Every report also carries a confidence figure, which describes how much of the intended analysis actually completed. When a data source is missing or stale, confidence falls. Below a confidence of 35 the report is labelled insufficient data instead of a risk band, because a score built on too little evidence would be more misleading than no score at all. Treat that label as “we could not establish enough to tell you”, never as a low-risk result.

The wording is deliberate throughout the product. Reports describe observed risk, because that is what the analysis is capable of establishing.

A low observed risk score means the checks that ran did not surface significant warning signs. It is not a clean bill of health, an endorsement, an audit, or a prediction. Tokens with low scores can and do lose value or fail entirely.

Sophisticated projects are designed to pass automated checks. The absence of a detectable warning sign is weaker evidence than the presence of one, and you should weight it accordingly.

These are structural limits of the analysis, not gaps we intend to close:

• Intent and future conduct. Whether the people behind a token will withdraw liquidity, sell their holdings or abandon the project is not visible in on-chain data before it happens.
• Off-chain reality. Team identity and track record, private agreements, funding, legal standing, custody arrangements and off-exchange dealing are outside what we read.
• Upgradeable and privileged contracts. Where a contract can be changed or is controlled by privileged roles, today’s bytecode does not describe tomorrow’s behaviour. We report the capability when we can detect it; we cannot report how it will be used.
• Unverified source code. Where source is not published, analysis is limited to what can be inferred externally, and confidence is reduced accordingly.
• Novel techniques. The methodology detects patterns it knows about. New abuse patterns exist before detection for them does.
• Impersonation and social engineering. Fake tokens copying a real project’s name and branding, compromised social accounts and phishing sites operate outside the contract data. Always confirm you have the correct contract address from a source you trust.
• Market and macro risk. Price falls caused by sentiment, liquidity, regulation or wider market conditions have nothing to do with a token’s contract.

Reports are assembled from public blockchain nodes, block explorers, market-data providers and security data providers. We do not control those sources. They can be incomplete, delayed, rate-limited or wrong, and when one is unavailable we say so in the report and lower its confidence rather than substituting an assumption.

Chain coverage and the depth of analysis vary by network and by the type of scan you run. A deep scan performs more checks than a basic one; neither is exhaustive.

A report describes what was observed when it ran. Liquidity can be removed, ownership transferred and contract behaviour changed within minutes. A saved or shared report keeps the values it had when it was produced — that is deliberate, so the record does not silently rewrite itself, but it means an older report may no longer describe the token as it is now. Re-scan before acting on anything.

Monitoring and alerts run on a schedule set by your plan, not continuously. They depend on your device, your network and your notification settings. An alert may be delayed or fail to arrive, and no alert should be the only thing standing between you and a loss.

• Volatility. Prices can move sharply in both directions, without warning.
• Liquidity. You may be unable to sell at the price shown, or at all, if there is no one to take the other side.
• Custody. Lose your keys or seed phrase and the assets are gone permanently. ScanZX never asks for either, and never asks you to connect a wallet — anything that does, claiming to be us, is not us.
• Irreversibility. Blockchain transactions cannot be recalled. There is no chargeback.
• Regulation. Rules differ by country and change. It is your responsibility to check that what you are doing is lawful where you live.
• Tax. Disposals may create a tax liability. Keep your own records; a ScanZX report is not a tax record.

You are responsible for what you do with a report. Do your own research, use more than one source, and never commit more than you can afford to lose entirely. If a report and your own judgement disagree, do not assume the report is the one that is right.

The limits of our liability are set out in section 11 of the terms of service.