Checking a token contract
Anyone can create a token, give it any name, and copy any logo. The name proves nothing. The contract address is the only identity a token has.
Creating a token costs a few pennies and no permission. You choose the name, the symbol and the logo, and none of those are unique or checked by anyone. There are thousands of tokens called USDC that are not USDC.
What cannot be duplicated is the contract address — the location on the network where the real token lives. Everything on this page is about establishing which address that is, and what the contract at it is allowed to do.
The address is the identity. The name is decoration.
Two tokens can share a name, a symbol and an icon. They cannot share an address. Any check that stops at the name has checked nothing.
Get the address from the source, not from a search
The order here is the whole point, because a contract address copied from the wrong place is a fake token no matter how carefully you inspect it afterwards.
- The project's own site or documentationReached by typing the domain, not through an advertisement or a link in a message. This is the primary source for what the project says its address is.
- A second independent listingA large data site or the project's entry on an exchange that lists it. If the address matches what the project publishes, you have two sources agreeing.
- Compare the whole stringNot the first four and last four characters. Vanity addresses that match at both ends are cheap to generate, and the display in most apps shows you exactly those ends.
What is not a source: a message that arrives, a reply under a post, an address in an image, or the top result in a paid search slot. All four are used constantly, because they are where somebody about to buy is looking.
What "verified source code" means
On Ethereum-style networks an explorer may show a contract as verified. This means the readable source code published there compiles to exactly the bytecode running at that address — the code you can read is the code that executes.
That is useful and it is narrow. Verification says nothing about whether the code is safe, sensible or honest. A verified contract can contain a function that lets its owner drain every holder, and the verification badge sits happily above it. Ethereum's own documentation is explicit that this is not a correctness check.
Verified means readable, not safe
An unverified contract is a reason to stop, because you cannot see what it does. A verified one is not a reason to proceed — it only means somebody could look, not that anybody did.
The two settings that decide what can be done to you
Beyond the code, tokens carry permissions, and these are readable without understanding a line of programming.
Can more be created? On Solana this is the mint authority: an account allowed to issue new units at will. If it is still set, supply is whatever the holder of that key decides, and any figure quoted for total supply is a snapshot rather than a limit. Setting it to null removes the ability permanently. Ethereum-style tokens express the same thing through a mint function and whoever is allowed to call it.
Can your tokens be frozen? On Solana this is the freeze authority: an account allowed to freeze a token account so its holder can no longer transfer or burn what is in it. Also optional, also removable by setting it to null. Where it exists, being able to sell is a permission somebody else holds.
Neither setting is automatically sinister. Regulated stablecoin issuers keep freeze powers deliberately, and say so, because they need to comply with orders to seize funds. The problem is not the setting existing — it is the setting existing on something presented as a decentralised token nobody controls.
Reading the holder list
Explorers show how a token is distributed. A handful of addresses holding most of the supply means a handful of decisions can move the price to zero, and no amount of enthusiasm elsewhere changes that arithmetic.
Read it carefully, though. A large balance may be an exchange holding coins for thousands of customers, a liquidity pool, or a locked contract. The count alone is a prompt to look, not a verdict.
These checks reduce a risk, they do not remove it
Everything here concerns the token being what it claims to be. A genuine token can still lose all its value, and most do. See how a launch is built for the part that has nothing to do with contract code.
Sources
Where the factual claims on this page come from. Each was read on the date shown.