Static Checks Said "Not a Honeypot." Live Simulation Disagreed. Twice, in 5 Random Tokens.

I ran 5 fresh, randomly picked Base tokens through AgentRisk M2M today — no cherry-picking, just tokens someone handed me to test. Two of the five produced a result worth writing about.

The two interesting cases

Both tokens passed static honeypot detection cleanly: is_honeypot: false, no blacklist function, no obvious sell-blocking logic in the bytecode. By a code-reading checker's standards, they looked fine.

Then live sell simulation — actually querying Uniswap V3's QuoterV2 for a real sell quote, right now, across every standard fee tier — came back sellable: false on both. Not one fee tier worked. Not a timeout, not a partial failure — a consistent, complete inability to get a sell quote.

json
{
  "is_honeypot": false,
  "sell_simulation": { "sellable": false },
  "findings": [{
    "code": "SELL_SIMULATION_FAILED",
    "severity": "critical",
    "message": "Live sell simulation failed across all fee tiers — this token may not be sellable right now, even though static checks did not flag it as a honeypot."
  }]
}

Why this happens

Static analysis reads the contract's code for known bad patterns — blacklist mappings, tax functions set to 100%, pause switches. It's looking for evidence of intent. But a contract can be entirely "clean" by that standard and still be unsellable right now for reasons that only show up in the current pool state: liquidity that's been pulled to near-zero on one side, a pair that technically exists but has no real depth, or timing-dependent mechanics that don't read as malicious code but produce the same real-world outcome — you can't get out.

Sell simulation doesn't ask "does this code look suspicious." It asks "if I tried to sell right now, what would actually happen." Different question, and apparently a meaningfully different answer for 2 out of 5 tokens today.

The honest caveat: what an agent does with this signal matters

Both of these tokens scored risk_score: 38 — under my should_execute threshold of 45. An agent that only reads the boolean should_execute field would still have bought both. An agent that reads the actual findings array and treats a critical severity entry as a hard stop would not have. That gap is worth being explicit about — a single risk score number, however well-calculated, can hide a critical individual signal if a consuming agent doesn't look past the top-line boolean.

Where this fits

AgentRisk M2M is a pre-trade risk API for Base — honeypot detection, deployer wallet freshness, brand impersonation, on-chain LP lock verification, cryptographically signed receipts, and this live sell simulation. Paid per call via x402, 0.15 USDC, or 3 free full scans per wallet on the public UI.

Repo: github.com/Neurobyteio/agentrisk
Try it: agentrisk.dev