Contract verification just means "the source code is public", not "the token is authentic". Scam projects can easily copy the open-source code of a real token, deploy an identical contract, and then verify it on a block explorer—showing a reassuring green checkmark even though the deployer address is completely different from the real one. Finding out who the issuer is and whether they can be trusted is what actually tells the real token from the fake.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
1. First, understand what "verified" really checks
On block explorers like Etherscan, a token showing "Contract Source Code Verified" means only one thing:
The on-chain bytecode of the contract corresponds exactly to the source code submitted by the developer.
The official Ethereum documentation clearly points out that the contract name, token symbol, and even the holder distribution can all be faked; these are just data stored within the ERC-20 contract and can be set arbitrarily by the contract developer. The same symbol can be used by countless contracts, and the "verified" label on a block explorer does not mean "this is the officially issued token".
For example: the real ARB token and a counterfeit wARB token may both appear as "verified" on Etherscan, but what really distinguishes them is the deployment address and the issuer behind each.
2. The real thing you need to check: the Deployer Address
Step 1: Find the "creator" address of the contract on the block explorer
What to do: Open the token's contract details page and find the "Created by" or "Creator" field.
How to do it:
On Etherscan, the token details page under the "Contract" tab will show "Created by" and an address.
Click on this address to review its transaction history and on-chain behavior.
When is this step complete: You have obtained the address that created this token contract.
Step 2: Compare against the creator address published through official channels
What to do: Go to the token project's official website, GitHub, or official X (Twitter) account and look for their publicly disclosed contract deployment address.
How to do it:
If the project has never publicly shared a deployment address, or if the address they published does not match the one you see on the block explorer, that is a red flag.
Look up the token's official contract address on CoinGecko or CoinMarketCap, and use that address to check whether the creator matches.
When is this step complete: You have confirmed that the contract creator address exactly matches the deployment address officially announced by the project.
3. If the issuer address checks out, examine these additional details
If the creator address is correct but you still have doubts, you can continue investigating the following risk points:
Check 1: Whether there are "mint" or additional issuance privileges
What to do: Under the contract's "Write Contract" or "Read Contract" tab, look for privileged functions such as
mint(),pause(),setTax().How to do it: If the owner of these functions has not renounced ownership (
renounceOwnership), it means the project team can still mint new tokens at any time, which poses a potential risk.
Check 2: Liquidity pool depth
What to do: Check the size of the token's liquidity pool on Uniswap or other DEXs.
How to do it: Scam tokens usually have extremely small liquidity pools, with tiny buys or sells causing violent price swings, because the scammers do not want to commit real money of their own.
Check 3: Whether the community has already flagged it as a "scam" on the block explorer
What to do: Look on Etherscan, BscScan, or Solscan to see if the contract address carries a red warning tag.
How to do it: The community and block explorer teams have already identified and labeled a large number of scam tokens; those marked can usually be ruled out immediately.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Common reasons for failure
"I only looked at the green checkmark and assumed it was the real token": The official Ethereum documentation explicitly warns that scam tokens can use exactly the same name and symbol, and can obtain the green checkmark for source code verification, because the explorer verifies that the code matches—not that the token is official. What actually keeps you safe is verifying the contract address through official channels, not trusting any icon, name, or "verified" label.
Prerequisite: You have already obtained a token's contract address and are planning to buy or interact with it.
Risk warning: If you buy a fake token, your real assets are not directly stolen, but the fake tokens have no liquidity and cannot be sold or transferred, meaning the real money you put in goes straight to zero. If you approve the fake token to a malicious contract, scammers may use the approval to transfer those fake tokens out of your wallet, but they normally cannot affect real tokens through an approval given to a fake token—even so, the best approach with any suspicious token approval request is to always reject it.
After completing all the checks above, how can you be sure you haven't been tricked?
Take the token's contract address, find the project's official website, and compare the contract address listed on the official site character by character with the address you hold. Then go back to the block explorer, click on the "Creator" field, and see whether that creator address is a well-known address with a normal transaction history, rather than a brand-new address created today. Only when both match does the risk drop to a minimum. If anything still doesn't match along the chain of "official website vs. contract address vs. creator", simply skip this token.
