How scam tokens trap buyers
Anyone can deploy a token and add a liquidity pool. Most scam tokens look normal on a chart and swap normally when you buy. The trap is in the contract code, and it springs when you try to leave.
Honeypot
The contract allows buys but rejects sells from anyone except the owner. The price chart only goes up, because nobody can sell. Your tokens are worthless the moment you buy.
Hidden sell tax
Every sell sends a share of the tokens to the owner. A 30% sell tax means that $1,000 of tokens returns about $700. Some contracts let the owner raise the tax after launch, up to 100%.
Owner controls
Functions that let the owner mint new supply, pause transfers, blacklist your address or edit balances. Legitimate tokens sometimes have them, but they can turn any token into a trap overnight.
Counterfeits
A token named USDC or a popular meme coin, at a different contract address. It trades in its own pool, usually with little liquidity, and is worth nothing outside it.
What ChainBridge checks
ChainBridge queries the GoPlus token security API for both tokens of a swap. GoPlus analyses the contract and reports flags; ChainBridge turns them into one of four verdicts.
| Verdict | Raised by | Effect |
|---|---|---|
| Danger | Honeypot; holders cannot sell their full balance; sell tax above 10% (including 100%) | Swap blocked: the button reads “Swap blocked: unsafe token” |
| Caution | Any sell tax up to 10%; any buy tax; owner powers such as minting, pausing transfers, blacklisting, changing balances or the tax; unverified or upgradeable contract; hidden owner; creator linked to past honeypots; flagged as counterfeit or airdrop scam | You must tick “I understand the risks and want to swap this token” before the swap is enabled |
| Unchecked | The check failed or the security provider has no data for this token | Not blocked; a note asks you to verify the contract yourself |
| No risks | No flag raised, or the token is on ChainBridge’s curated list | Nothing shown; the swap proceeds normally |
Two refinements keep the check useful:
- Curated tokens skip the call. Native coins and the tokens in ChainBridge's built-in lists are known contracts and are treated as safe without an API call.
- Expected admin powers are not flagged. Well-known tokens such as major stablecoins can be paused or blacklisted by their issuer. When GoPlus marks a token as trusted, only its taxes are reported, not these permissions.
A second, local check looks for impersonation: a token whose symbol belongs to a known token but whose address does not match, look-alike Unicode characters in the name or symbol, names containing links or airdrop claims, and addresses on a scam blacklist. Any of these shows a “Suspicious token detected” warning and disables the swap button.
Where the checks run
- When you import a token. Pasting a contract address in the token selector shows “Checking token safety…”, then “No risks found”, “Use caution” or “Dangerous token” with the reasons, before you add it.
- In the token list. Tokens you imported carry a small badge: No risks, Caution, Danger or Unchecked. Hover it to read the reasons.
- On the review screen. Both tokens are checked again. The swap button waits for the result (“Checking token safety…”), then blocks, asks for acknowledgement or proceeds.
The review screen then simulates the real transaction. That catches a different class of problem: a swap that would revert right now, for example because a transfer tax exceeds your slippage tolerance. See transaction simulation.
What the checks cannot catch
- Liquidity pulls. A team can remove its liquidity and leave holders with a token nobody can buy. The contract stays “clean” throughout.
- Later changes. An upgradeable contract can be swapped for a malicious one after you buy, and an owner can raise a modifiable tax. These powers raise a caution, but the abuse happens later.
- Brand-new tokens. A token deployed minutes ago may have no security data yet. It shows as Unchecked, not as dangerous.
- Outages. If the security provider is unreachable or rate limited, the verdict is “Safety check unavailable”. ChainBridge does not block on missing data, so the decision is yours.
- Insider selling. A large holder dumping on the market is legal for the contract and invisible to the check.
A manual checklist before you buy
For any token outside the built-in lists, take five minutes before the first swap.
Get the address from the source
Copy the contract address from the project's official site or documentation, not from a chat, reply or search ad. Compare the full address, not the first and last characters.
Open it on the block explorer
Check that the source code is verified, when it was deployed and who owns it. Ownership renounced to the zero address removes most owner powers. See how to verify smart contracts.
Look at holders and liquidity
A few wallets holding most of the supply, or a pool with very little liquidity, means a few people can crash the price. Locked liquidity is better than liquidity the team can withdraw.
Read the ChainBridge verdict
Import the token and read every reason listed. A caution you do not understand is a reason to stop, not to tick the box.
Test with a small amount
Buy a small amount, then sell part of it. If the sell fails or returns far less than expected, you have lost little and learned a lot.
For the social side of scams, such as fake airdrops, impersonated teams and pressure tactics, read DeFi scam red flags.