Why verify a contract?
Every token and every app you use is a smart contract, and a contract does exactly what its code allows. That includes freezing your balance, charging a 90% fee on sells or letting its owner print new supply. Nobody reviews a contract before it goes live.
You do not need to read Solidity fluently. A few minutes on a block explorer answers the questions that matter: is this the real contract, can I read its code, and who can change the rules?
Established tokens and protocols have been reviewed by many people over years. Verification matters most for new and small tokens, and for any contract you are about to approve.
Check a contract on a block explorer
Each network has its own explorer. They share the same layout, so these steps work on all of them.
| Network | Explorer |
|---|---|
| Ethereum | Etherscan |
| Arbitrum | Arbiscan |
| Base | Basescan |
| Optimism | Optimistic Etherscan |
| Polygon | Polygonscan |
| BNB Chain | BscScan |
| Avalanche | Snowtrace |
| Linea | Lineascan |
Get the address from an official source
Use the project's website or documentation, then compare it with a token aggregator such as CoinGecko. Never trust an address posted in a Telegram group, a reply or a DM. Scam tokens copy names and tickers exactly.
Open the Contract tab
A verified contract shows a check mark and its full source code. If you only see bytecode, nobody can easily check what it does: treat that as a serious warning.
Check whether it is a proxy
If the explorer shows "Read as Proxy" and "Write as Proxy", the address you see only forwards calls to an implementation contract. Open the implementation and review that code, and find out who can upgrade it.
Read the owner
Under "Read Contract", call
owner()or check the admin roles. Click the address it returns: is it a regular wallet, a multisig such as Safe, or a timelock contract?Look at real activity
Check recent transactions and the holders tab. Healthy tokens have many different wallets buying and selling. A few wallets holding most of the supply, or only buys and no sells, are warning signs.
The powers that matter
Most of the risk in a token contract sits in a handful of functions. Search the source for them, then check who can call them.
Owner and admin roles
Look for: owner(), Ownable, AccessControl roles
- Reassuring: Ownership renounced, or held by a multisig behind a timelock
- Worrying: A single wallet (EOA) that can call every admin function
Minting
Look for: mint(), _mint() called outside the constructor
- Reassuring: Fixed supply, or minting capped and governed
- Worrying: An admin can create unlimited new tokens
Pause and blacklist
Look for: Pausable, whenNotPaused, blacklist or isBlocked mappings
- Reassuring: Common in regulated stablecoins such as USDC and USDT
- Worrying: In a small token, often used to stop holders from selling
Transfer fees
Look for: transfer() logic, _taxFee, setFee(), setTax()
- Reassuring: No fee, or a fee fixed in the code
- Worrying: A fee the owner can raise, up to taking everything
Upgradeability
Look for: "Read as Proxy" tab, EIP-1967 proxy, upgradeTo()
- Reassuring: Upgrades need a multisig and a timelock delay
- Worrying: One key can replace the code at any moment
Red flags in contract code
One of these is a reason for caution. Two or more, and you should not hold the token.
| Red flag | Severity | Why it matters |
|---|---|---|
| Unverified source code | High | You cannot know what the contract does. Legitimate projects publish their source. |
| Sell-only restrictions | Critical | Max-transaction limits, cooldowns or whitelists that apply only to sells are how honeypots work. |
| Changeable fees | Critical | An owner who can set the tax can set it to 100%. |
| Unrestricted admin mint | Critical | New supply can be printed and dumped on holders. |
| Delegatecall to a changeable address | Critical | A hidden upgrade path: the owner can swap the logic without a visible proxy. |
| Proxy controlled by one wallet | High | Safe today, anything tomorrow. Look for a timelock and a multisig. |
| Blacklist in a small token | High | Lets the owner freeze any holder, including you. |
| Owner can change balances | Critical | Balances are whatever the owner says they are. |
How to read an audit
An audit is a code review by a security firm such as Trail of Bits, OpenZeppelin, Consensys Diligence or Spearbit. It lowers risk; it does not remove it. Many exploited protocols had been audited.
Check the report
- Published in full on the auditor's own site, not just a badge
- Names the commit or addresses reviewed
- Matches the code actually deployed
Check the findings
- Critical and high issues marked as fixed
- Scope covers the contracts you will use
- Recent enough for the current version
What ChainBridge checks automatically
When you pick a token, ChainBridge queries the GoPlus security API for its contract. Read token safety checks for the full list.
- Blocked: honeypots, tokens holders cannot fully sell, and sell taxes above 10%.
- Warning you must acknowledge: unverified source code, upgradeable proxy, mintable supply, pausable transfers, blacklist, owner-changeable tax or balances, hidden owner, and counterfeit or airdrop-scam flags. Well-known tokens with expected admin powers, such as USDC, are not flagged for those.
- Imported tokens: a token added by contract address shows a not-in-list warning and its security result before you import it.
- Simulation: the exact swap is simulated at review, and a transaction that would revert is blocked. See transaction simulation.
Automated checks miss things a human sees, such as a team that can dump its own supply. Use them as a first filter, not a verdict.