How to check a token contract before you buy

Most token rugs aren't clever. The contract simply gives its owner a power they shouldn't have: minting unlimited supply, freezing your balance, blocking sells or raising the sell tax to 100%. All of that is visible on-chain before you buy, if you know where to look.

These checks won't tell you whether a token is a good investment. They tell you whether the people behind it can take your money through the contract itself.

Solana (SPL and Token-2022)

• Mint authority. If a mint authority is still set, that key can create new tokens at any time and dilute everyone. For most established tokens it's revoked (set to none).
• Freeze authority. If it's set, that key can freeze your token account, so you can't sell or transfer. Legitimate stablecoins keep it for compliance, but on a new meme token it's a major red flag.
• Token-2022 extensions. The newer token program adds powerful options. Watch for:
  • a permanent delegate, which can transfer or burn tokens from any holder's account;
  • a transfer hook, which runs a custom program on every transfer (and can block sells);
  • transfer fees, a tax on every transfer, which may be changeable.
• Liquidity. Check where the liquidity is and how deep it is. If the LP tokens aren't burned or locked, the creator can withdraw the pool.
• Holder concentration. If a handful of wallets (excluding pools and exchanges) hold most of the supply, a few sells can crash the price.

In Discord, Solswift's /token checks mint and freeze authority, Token-2022 extensions, liquidity and top holders in one reply.

EVM chains (Ethereum, Base, Arbitrum, BNB Chain and others)

• Verified source code. If the contract isn't verified on the block explorer, you can't see what it does. Treat that as a warning on its own.
• Owner privileges. Look for functions only the owner can call: mint, blacklist, pause, setFee or setTax, setMaxTx, enableTrading. Each one is a lever that can be pulled against buyers.
• Upgradeable proxy. If the token is a proxy, the logic can be swapped for different code later. Find out who controls the upgrade (a multisig with a timelock is far safer than a single wallet).
• Ownership renounced? Renouncing removes the owner functions, but check that there isn't a second privileged role or a proxy admin that keeps the same powers.
• Honeypot behaviour. Some tokens let you buy but not sell. Simulation tools try a buy and a sell and report the effective taxes.
• Liquidity lock. As on Solana, unlocked LP means the pool can be pulled.

In Discord, ChainHop's /scan chain address reads the contract's bytecode and flags upgradeable proxies, mint, blacklist, pause, tax setters, max-tx limits, trading switches and non-renounced owners. Deep scans with GoPlus data are available to voters and Premium servers.

A 3-minute routine

1. Copy the contract address from the project's official site or docs, never from a chat reply.
2. Open it on the chain's block explorer (Etherscan, Basescan, Solscan and so on) and confirm it's the token you expect (name, decimals, supply).
3. Run an automated check (/scan or /token, or a public scanner such as GoPlus) and read every flag.
4. Look at liquidity and the top holders.
5. If anything is unclear, don't buy yet. The token will still be there tomorrow.

What automated checks can't tell you

Scanners are heuristics, not audits. They can miss new tricks, and a clean result doesn't mean a team won't simply sell their tokens. Use them to rule tokens out, not to rule them in.