Every meme coin loss that follows the pattern of “I bought it and then could not sell” or “the developer minted more tokens” was preventable with a pre-buy contract check. The smart contract is the definitive source of truth about what a token can and cannot do. This guide teaches you to read the signals without needing to understand Solidity or Rust.
This guide extends the safety framework in our scam prevention guide and pairs with the specific checks in our honeypot detection guide and token approval management guide.
What Does “Verified Source Code” Mean and Why Does It Matter?
On Ethereum and Base, navigate to the token’s contract address on Etherscan or Basescan. Click the “Contract” tab. If you see a green checkmark and readable Solidity code, the contract is verified. If you see only bytecode (a long hexadecimal string), the contract is unverified.
According to CertiK security research, over 70% of confirmed scam tokens on EVM chains had unverified source code. Verification alone does not guarantee safety — a contract can be verified and still contain malicious functions — but unverified code is a strong negative signal. Legitimate projects verify their contracts because transparency builds trust.
On Solana, the verification model works differently. SPL tokens use a standard program, and the key safety checks are on the token’s authority settings rather than custom contract code. Solscan displays these directly on the token page.
Which Contract Functions Are Red Flags?
mint (can create new tokens, diluting your holdings), blacklist (can block specific wallets from transferring), pause (can halt all transfers), setFee or setTax (can increase sell tax to 99% after you buy), and upgradeTo (proxy pattern that lets the developer change the entire contract after deployment).| Function / Authority | Risk | Where to Check (EVM) | Where to Check (Solana) |
|---|---|---|---|
| Mint / Mint Authority | Developer can create unlimited new tokens | Etherscan: Read Contract → totalSupply, mint function | Solscan: Token page → Mint Authority field |
| Freeze Authority | Developer can freeze any wallet’s tokens | Not standard ERC-20 (check for blacklist instead) | Solscan: Token page → Freeze Authority field |
| Blacklist / isBlacklisted | Developer can block wallets from selling | Etherscan: Read Contract → search “blacklist” | N/A (Solana uses freeze authority) |
| Pause / Unpause | Developer can halt all token transfers | Etherscan: Read Contract → paused() boolean | N/A |
| Owner / renounceOwnership | Owner can call privileged functions | Etherscan: Read Contract → owner() | Solscan: Update Authority field |
| Proxy / upgradeTo | Entire contract can be swapped post-deployment | Etherscan: “Read as Proxy” tab visible | Rare on Solana |
For EVM tokens, the owner() function reveals who controls the contract. If the owner address is a regular wallet (not a burn address like 0x000…dead), the owner retains the ability to call all restricted functions. “Renounced ownership” means the owner called renounceOwnership(), setting the owner to the zero address. Verify this on Etherscan by checking whether owner() returns 0x0000000000000000000000000000000000000000.
For Solana tokens, check two fields on Solscan: Mint Authority and Freeze Authority. Both should show “Revoked” or null. If either shows an active wallet address, the developer retains control. Tokens graduated through Pump.fun automatically have both authorities revoked. Tokens deployed directly on Raydium may not.
How Do RugCheck and GoPlus Automate These Checks?
RugCheck assigns a risk rating from “Good” to “Danger” based on a weighted score. The factors it checks: Is mint authority revoked? Is freeze authority revoked? Is LP burned or locked? What is the top holder concentration? Is the token on known scam lists? A “Good” rating does not guarantee safety, but a “Danger” rating is a reliable stop signal.
GoPlus Token Security API checks over 30 risk factors for EVM tokens. The most critical: can the contract be paused? Is there a blacklist function? Can the owner modify the tax rate? Is the contract a proxy? Does a simulated sell transaction succeed? DEXScreener integrates GoPlus data on many token pages, surfacing red flags directly in the trading interface.
TokenSniffer provides a complementary check by comparing the contract’s bytecode against a database of known scam contract templates. If the code is substantially similar to a previously confirmed scam, TokenSniffer flags it. Cross-referencing RugCheck/GoPlus with TokenSniffer gives you two independent safety assessments.
What Does a Professional Audit Report Actually Tell You?
Check for audits on the project’s website and verify them directly on the auditing firm’s website. Fake audit claims are common. CertiK maintains a public directory of all projects they have audited. If a project claims a CertiK audit, verify it in their directory before trusting it.
Audit reports classify findings by severity: Critical, High, Medium, Low, and Informational. Any unresolved Critical or High finding means the contract has known exploitable vulnerabilities. Check whether findings were addressed (the audit report should note this) or left open.
The vast majority of meme coins are not audited. The absence of an audit is normal for small-cap tokens and does not automatically mean the contract is dangerous. But for tokens asking you to stake, lock, or provide liquidity (operations that give the contract extended control over your funds), an audit is a reasonable minimum standard.
Frequently Asked Questions
Can a verified and audited contract still be a scam?
Yes. Verification and audits reduce risk but do not eliminate it. A verified contract with a proxy pattern can be upgraded after the audit. A contract can pass an audit and still contain subtle logic errors that the auditor missed. Audits are a snapshot of the code at one point in time. Always combine audit checks with ongoing monitoring of owner actions and contract state.
How long does it take to check a token’s contract safety?
Using automated tools, under three minutes. Paste the contract address into RugCheck (Solana) or GoPlus (EVM), review the results, check the top holders on a block explorer, and verify LP status. Manual source code review takes longer (30-60 minutes for a skilled developer) and is only necessary for high-value decisions like staking or LP provision.
What does “renounced ownership” mean and is it always safe?
Renounced ownership means the developer called a function that permanently removes their admin privileges over the contract. No one can call restricted functions like mint, pause, or blacklist after renouncement. However, renouncement is irreversible and also means legitimate bugs cannot be fixed. It is generally a positive signal for meme coins because it removes the developer’s ability to rug pull.
Are Pump.fun tokens automatically safe?
Pump.fun tokens have mint and freeze authorities revoked automatically upon graduation. This removes two major rug pull vectors. However, the token creator can still coordinate a dump by holding a large supply percentage, and the Pump.fun contract does not prevent bundled launches or insider accumulation. Pump.fun reduces contract-level risk but does not eliminate supply-concentration risk.
What is a proxy contract and why is it dangerous?
A proxy contract separates the contract’s storage from its logic. The owner can deploy new logic code and point the proxy to it, effectively changing how the contract works without changing the address. This means a contract that passed an audit can have its entire logic replaced afterward. Proxies are common in legitimate DeFi protocols for upgradability, but in the context of meme coins, they represent a backdoor for the developer to modify the token’s behavior after deployment.
