How To Check If a Token Is Safe With Evidence

The 7-Point Evidence Framework

Safety Flowchart (When to Stop)

Step 1 — Contract Source & Bytecode Match

Start on the official explorer for the chain: Etherscan (ETH), BaseScan (Base), Arbiscan (Arbitrum), BscScan (BSC), etc. Paste the token address.

1. Look for “Contract: Verified” and a green check. Click “Contract” tab → “Code.” Confirm:
   • Compiler version (e.g., v0.8.24+commit) & equals what the deployer claims
   • Optimizer settings (enabled, runs count)
   • License (MIT/Apache-2.0); non-license ≠ scam, but standard licenses are a plus
2. Bytecode match: Explorers display “Matches deployed bytecode at …”. If partial or “similar,” be cautious.
3. Diff from OpenZeppelin: If it’s an ERC-20, compare functions to OpenZeppelin ERC-20. Non-standard additions like setTax(), enableTrading(), excludeFromFee(), setMaxTx() warrant careful review.
4. Proxy? If the contract says “Proxy,” check “Read as Proxy” → implementation address. Audit that implementation too.

Yellow flag: Unverified source means you can’t see what functions exist. Many rugs hide mint/blacklist logic behind unverified contracts.

Step 2 — Admin Powers (Mint, Pause, Blacklist, Taxes)

Rug mechanics frequently rely on hidden or overpowered admin functions. In the Contract “Read/Write” tabs, and in the verified code, search for:

Evidence to save: Screenshots of the functions, the owner address (and that it’s a multisig/timelock), and any require bounds on tax/limits.

Step 3 — Liquidity: Lock, Burn, or Rugable?

If the team can remove liquidity, price can nuke to zero. Check the main DEX pairs (Uniswap v2/v3, Base/Arbitrum variants) on Dexscreener or DexTools, then click the LP token:

1. Is LP burned? Look for LP tokens sent to 0xdead or 0x0000...dead.
2. Is LP locked? If locked, find the locker (e.g., Unicrypt, Team.Finance). Record lock duration and % locked.
3. Residual LP risk: Even with locks, verify that a meaningful % (e.g., >60–80% on early launches) is locked for months, not days.

Step 4 — Holder Distribution & Smart Money

In the explorer “Holders” tab, export the distribution. Exclude known contracts (LP, router, CEX wallets) and re-weight human wallets:

• Top holder threshold: A single externally owned account (EOA) > 20–30% is risky unless explained (vesting/treasury).
• Team wallets: If disclosed, they should be time-locked or vesting. Verify the timelock address.
• Smart money: Look for reputable funds/wallets with long holding periods. Tools: Dune, Nansen (paid), DeBank.

Evidence: CSV of holders (annotate contracts vs EOAs), and a note on any whale concentration.

Step 5 — Buy/Sell Simulation & Honeypot Tests

Before you risk capital, simulate a buy and a sell. Use multiple tools:

• Dexscreener / DexTools price impact & router paths
• TokenSniffer & GoPlus Token Security (automated checks)
• Explorer “Write” tab to read current tax/maxTx if exposed

Note: Some automated scanners produce false positives or miss proxy upgrades. Always corroborate with the contract code and a live micro-trade.

Step 6 — Deployer & Provenance (Clones, Upgrades)

Click the token’s “Contract Creator” link. Review the deployer’s other contracts and activity:

• Prior rugs? If the same deployer rugged before (liquidity pulled, mint abuse), weight heavily against.
• Clone templates: Many tokens clone standard templates. Diff vs a known-good commit (OpenZeppelin). Minimal diffs are safer.
• Proxy upgrades history: If upgradable, check change logs and who can upgrade (timelock? multisig?).

Evidence: Deployer address notes, list of previous contracts, and any news/audit links.

Step 7 — Communications & Commitments

Legit teams tend to leave verifiable breadcrumbs:

• Signed deploy announcements (e.g., EIP-4361 “Sign-In with Ethereum”)
• Public multisig/timelock addresses with instructions
• Audits from reputable firms (CertiK, Trail of Bits, OpenZeppelin, SlowMist)
• Clear disclosures on tokenomics/vesting with on-chain vesting contracts

Your Toolkit

CLI Recipes (Automate Key Checks)

ethers.js — Read owner, totalSupply, and try to detect dangerous functions

import { ethers } from "ethers";

// Set your RPC (Infura, Alchemy, Ankr, QuickNode, etc.)
const provider = new ethers.JsonRpcProvider(process.env.RPC_URL);

// Minimal ABI: ERC-20 + common risky functions
const ABI = [
  "function name() view returns (string)",
  "function symbol() view returns (string)",
  "function totalSupply() view returns (uint256)",
  "function decimals() view returns (uint8)",
  "function owner() view returns (address)",
  "function getOwner() view returns (address)",

  // suspected risky
  "function mint(address,uint256)",
  "function setTax(uint256)",
  "function setMaxTxAmount(uint256)",
  "function blacklist(address,bool)",
  "function pause()",
  "function unpause()"
];

const token = new ethers.Contract(process.env.TOKEN, ABI, provider);

(async () => {
  const [name, symbol, supply] = await Promise.all([
    token.name().catch(() => "n/a"),
    token.symbol().catch(() => "n/a"),
    token.totalSupply().catch(() => 0n)
  ]);

  // Try different owner functions
  let owner = "n/a";
  try { owner = await token.owner(); } 
  catch { try { owner = await token.getOwner(); } catch {} }

  console.log({ name, symbol, totalSupply: supply.toString(), owner });

  // probe risky functions by checking if they exist (will fail if not)
  const probe = async (sig) => {
    try { await token[sig](); return true; } catch { return false; }
  };

  const risky = {
    mintExists: await probe("mint"),
    setTaxExists: await probe("setTax"),
    setMaxTxExists: await probe("setMaxTxAmount"),
    blacklistExists: await probe("blacklist"),
    pauseExists: await probe("pause")
  };
  console.log({ risky });
})();

viem — Check proxy implementation & owner (EIP-1967)

import { createPublicClient, http, getStorageAt, isAddress } from "viem";
import { mainnet } from "viem/chains";

// EIP-1967 implementation slot = bytes32(uint256(keccak256('eip1967.proxy.implementation')) - 1)
const IMPLEMENTATION_SLOT = "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc";

const client = createPublicClient({ chain: mainnet, transport: http(process.env.RPC_URL) });

const toChecksum = (hex) => "0x" + hex.slice(-40);

const main = async () => {
  if (!isAddress(process.env.TOKEN)) throw new Error("Bad address");
  const slot = await getStorageAt(client, { address: process.env.TOKEN, slot: IMPLEMENTATION_SLOT });
  if (slot && slot !== "0x0") {
    const impl = toChecksum(slot);
    console.log({ proxy: true, implementation: impl });
  } else {
    console.log({ proxy: false });
  }
};
main();

Foundry — Simulate a small swap (sell) to catch honeypot

# Pseudocode pattern; actual script depends on router ABI/paths
# Use a forked RPC (anvil --fork-url $RPC) and cast/anvil to simulate a real swap.
# If the sell path reverts, investigate tax/maxTx/blacklist toggles.

# Example idea:
# 1) Approve router for token
# 2) SwapExactTokensForETHSupportingFeeOnTransferTokens
# 3) Observe if revert happens or output is ~expected with stated tax

CLI automation won’t catch everything (e.g., upgradeable behind timelocks), but it accelerates your first-pass scan.

Risk Scoring Rubric (Printable)

Interpretation: 11–14 = Lower risk (still crypto); 7–10 = Caution; ≤6 = Avoid.

FAQ: Common Myths & Edge Cases

External Links & References

Recap

• Don’t ask “Is it safe?” ask “What evidence says it’s not dangerous?”
• Verify source & bytecode, control admin powers, secure liquidity, check holders, simulate trades, review provenance, and demand verifiable comms.
• Two or more critical fails → walk away. Screenshots + hashes = your audit trail.

Want us to run this checklist on a specific token and deliver an evidence pack (PDF + links + hashes)?