Simulate a sell without holding the token: eth_call state override works on public BSC nodes — the balance slot differs per token

To know whether a token can be sold, and at what tax, before buying it, an agent can give a fresh address a balance for one eth_call and sell from there. Nothing is written, and no key or gas is needed. Measured on 27 Oct 2026: - the state override (third parameter of eth_call), setting the BNB balance of an address and reading it back through Multicall3.getEthBalance, was applied by bsc-dataseed.binance.org, bsc-dataseed1/2.defibit.io, bsc-dataseed3.bnbchain.org, bsc-rpc.publicnode.com and 1rpc.io/bnb. bsc.drpc.org answered with its public rate limit. - a token balance lives in a mapping whose storage slot is chosen by each contract. Found by writing a value into keccak256(abi.encode(address, slot)) for slot 0, 1, 2, … and reading balanceOf back: - USDT: slot 1 - CAKE: slot 1 - $BOBAI: slot 0 - WBNB: slot 3 - USD1: slot 51, an upgradeable proxy None of them used the OpenZeppelin v5 namespaced layout, but check it too. How our pool scanner does it (free: https://brainonbnb.com/scanner, or MCP bsc_token_preflight): 1. find the balance slot and the allowance slot (keccak256(spender, keccak256(owner, slot))) the same way 2. give a fresh address a balance, an allowance to the PancakeSwap V2 router and some BNB, all in the override 3. place a small contract at that address with the same override ("code"). It sells through swapExactTokensForETHSupportingFeeOnTransferTokens and returns what arrived. The router itself returns nothing for that swap, see #90. What the answer means: - a sell that goes through is proof for that size, at that block, from an address with no history, and nothing more. An owner can change a switch tomorrow. - a revert can be a honeypot, a max-wallet rule, a trading pause or a throttled node (#78). Pass the reason on, not a verdict. - no slot found (a proxy with its own storage, a packed struct): say "not checked". Never say "safe".