Reading a Scam Token Contract
Four keyword searches in published source code identify most tokens designed to take money. No programming knowledge required.
Priya Raman · 2 min read
Verified contract source is published on block explorers and almost nobody opens it. These four searches take ten minutes and catch the majority of malicious tokens.
Search zero: is it verified
If the explorer shows bytecode rather than readable source, nobody can inspect what the contract does.
That alone is sufficient reason to stop. An unverified contract for a token being actively promoted is a deliberate choice.
Search one: mint
A function that creates new tokens.
Restricted to the constructor is fine. Callable by an owner with no cap means supply can be increased at will, which makes any valuation meaningless.
Look at what precedes the function. A modifier such as onlyOwner tells you exactly who can call it.
Search two: pause, blacklist, blocklist, canTransfer
Functions that prevent transfers.
A global pause is common and sometimes legitimate as an emergency control. A function blocking specific addresses from transferring is the honeypot mechanism: you can buy and you cannot sell.
The question is who can call it and whether it can target individuals.
Search three: fee, tax, setFee
A percentage taken on each transfer.
A fixed fee disclosed up front is a design choice. A fee an owner can change after launch is a sell-blocking mechanism in another form, because it can be set high enough to make selling pointless.
Check whether a maximum is enforced in code and who can call the setter.
Search four: owner, renounce
Who holds privileged functions.
A single externally owned address means one person controls everything. A multi-signature means several parties are required. Ownership renounced to the zero address means no privileged function can ever be called, which is a strong commitment and also means bugs cannot be fixed.
The fifth search: upgradeable, proxy, delegatecall
Whether the logic can be replaced.
An upgradeable contract means the code you read today can be different tomorrow. Your assessment covers the current version and whoever holds the upgrade keys.
What this does not catch
Subtle logic errors. Economic design flaws. A well-hidden backdoor. Malicious behaviour in a contract the token interacts with rather than in the token itself.
For those you need an audit by a specialist, and audits vary considerably in rigour.
The realistic assessment
Tokens that take retail money are rarely subtle. They have an unlimited mint, a transfer blocker, or an owner who can change the fee, and every one of those is findable by searching for a word.
Ten minutes, before buying rather than after. And for anything intended as a holding rather than an experiment, whether the token is listed on a venue with its own review process, such as a licensed exchange with a published address, is a second filter applied by people with money at stake.
Move any remaining funds to a wallet with a newly generated seed phrase before anything else. Then revoke token approvals, and report the incident to your local authorities and the exchange involved. Do not pay anyone who promises to "recover" your coins. That is a second scam, aimed at victims of the first.