What is a smart contract?

A smart contract is code deployed to a blockchain that runs exactly as written, automatically, without a person or company operating it in the middle. A token is a smart contract that tracks who owns how many units and defines the rules for transferring them — who can send to whom, whether a tax applies, whether new units can be created, and so on.

The critical thing to understand: once deployed, a contract's core logic generally can't be changed (unless it's specifically built to be upgradeable — more on that below). Whatever rules are written into the code at deployment are the rules that govern the token forever, for better or worse.

Why the contract address matters

A token's name and symbol are just metadata — arbitrary text anyone can set when deploying a contract. Nothing stops someone from deploying a token called "USD Coin" with the symbol "USDC" that has nothing to do with the real one. The contract address — a unique 42-character identifier starting with 0x — is the only thing that actually distinguishes one token from another on a given chain.

This is why every serious research step starts with the address, not the name: pulling up the token from an official source, confirming the address before buying, and pasting that exact address into any tool you use to check it.

How to verify a contract

  • Check for source verification. A verified contract has its human-readable source code published on the relevant block explorer, matched against the deployed bytecode. This lets anyone — including automated scanners — actually read what the contract does.
  • Read (or have a tool read) the permission structure. Who is the owner? What can the owner do — mint new tokens, blacklist addresses, pause trading, change fees?
  • Check for proxy patterns. Some contracts are deployed as "proxies" that can have their underlying logic swapped out later by an admin — meaning the rules you're reading today could be replaced tomorrow without a new deployment. This is normal for some legitimate infrastructure, but on a random token it's a serious red flag.
  • Check the constructor and deploy history. When was it deployed, by which wallet, and does that wallet have a track record?

Common contract scams

  • Hidden mint functions — the owner can create unlimited new tokens at will, diluting or destroying value for existing holders.
  • Honeypots — the contract allows buying but blocks or heavily taxes selling, trapping funds.
  • Blacklist functions — the owner can block specific addresses from trading or transferring, sometimes used to trap buyers after a pump.
  • Fee/tax manipulation — buy/sell taxes can be changed after launch, sometimes set to 100% right before a rug.
  • Fake liquidity locks — a "locked" liquidity claim that isn't actually enforced by the contract or lock service being referenced.

Security best practices

  • Never trust a token name or logo — always verify by contract address.
  • Prefer verified contracts; treat unverified contracts on unfamiliar tokens as a strong warning sign.
  • Check for mint, blacklist, and pause functions before buying, not after.
  • Understand that "ownership renounced" reduces but doesn't eliminate risk — some dangerous functions don't require an owner at all.
  • Use an automated scanner to do this reading for you — it's faster and less error-prone than manually parsing Solidity.