Before buying or holding any token, five checks catch the vast majority of technical scams: a verified contract, a locked liquidity pool, a passing honeypot check, no unlimited mint function, and no owner-only trading controls. All five are free and take a few minutes with public tools.
Key takeaways
- Every tool below is free and requires no signup or wallet connection.
- A "verified" contract means readable source code, not safe source code, read what it actually does.
- Unlocked liquidity is the single biggest rug-pull risk. Check the lock before anything else.
- These checks catch technical scams, not bad tokenomics or an inactive team. They're not investment advice.
Step 1: Confirm the contract address
Get the token's contract address from its official site or a trusted aggregator like CoinGecko or CoinMarketCap, never from a link in a Telegram group or an unsolicited DM. Copy the address exactly; scam tokens routinely deploy near-identical contracts at different addresses to impersonate a legitimate project.
Step 2: Check the contract on a block explorer
Paste the address into the block explorer matching the token's chain: Etherscan for Ethereum, BscScan for BNB Chain, Solscan for Solana. On the "Contract" tab, confirm the source code is verified (a green checkmark) so you can actually read what the contract does, and skim it for an unlimited mint function or an owner-only function that can pause trading or blacklist wallets.
Step 3: Check the liquidity lock
Search the token on Unicrypt or Team.Finance to see whether the liquidity pool is locked, and for how long. No lock, or a lock under a few weeks, means the developer can pull the underlying funds and drain the pool at any time. This single check catches most rug pulls before they happen.
Step 4: Run a honeypot check
Paste the contract address into Honeypot.is, which simulates both a buy and a sell transaction against the live contract. If the simulated sell fails or is taxed at an extreme rate, the token is very likely a honeypot, buyable but not sellable.
Step 5: Scan for mint and ownership risks
A scanner like TokenSniffer flags common contract-level red flags automatically: unlimited mint functions, hidden fees, proxy contracts that can be upgraded to add malicious code later, and ownership that hasn't been renounced. Treat its score as a starting point, then verify anything it flags directly in the contract source from Step 2.
What a clean check does and doesn't tell you
Passing all five checks rules out the most common technical scams. It does not evaluate the project's team, roadmap, competition, or whether the token will actually gain adoption. A technically clean contract can still be a poor investment. Treat this as a minimum bar before considering a token further, not a signal to buy.
FAQ
What is a honeypot token?
A honeypot is a token contract written so buyers can purchase it but can't sell it, usually via a hidden restriction in the transfer function. It looks tradeable in a wallet but the sell transaction always fails or is taxed at 100%.
Does a verified contract mean the token is safe?
Verified means the source code matches what's deployed and is publicly readable, not that the code is safe. A verified contract can still contain an unlimited mint function, a hidden fee, or owner-only trading controls.
What does "liquidity locked" actually mean?
It means the LP tokens representing the token/ETH (or token/BNB) trading pair are held in a time-locked smart contract, so the developer can't withdraw the underlying funds and drain the pool before the lock expires.
Can a token pass every check and still be a bad investment?
Yes. These checks rule out common technical scams, not poor tokenomics, an inactive team, or a project that simply fails to gain traction. Technical safety and investment quality are separate questions.