How to read a token contract on Etherscan

The address is the token

A ticker is a label someone typed. Ethereum does not reserve USDT, PEPE, or any other symbol for one contract. Two contracts can print the same name, and a wallet will often show the name the contract returns from its own functions. The thing you can check is the address: 42 characters starting with 0x, on a specific chain.

Etherscan, at etherscan.io, is a block explorer for Ethereum. It reads the chain and shows transactions, holders, and, when a publisher has submitted it, the source that compiles to the bytecode. It is not an exchange and it does not score a token as safe. This guide is a way to read that page before you approve anything. The token checker runs a separate pass over public security sources. Use both. Neither one is a buy signal.

Type etherscan.io yourself. A search ad for a lookalike domain is a common way a fake explorer collects a wallet connection. This site never asks you to connect a wallet or to paste a seed phrase. An explorer does not need those either.

Open a contract you can name

Start with a contract whose issuer is public, so you can see what a normal page looks like before you apply the same clicks to a token a stranger sent you. The canonical Ethereum USDT contract is 0xdAC17F958D2ee523a2206206994597C13D831ec7. Paste that full address into Etherscan's search. Do not search the word USDT and click the first result. Search by symbol returns every contract that claims the symbol.

The token page should show the name, the symbol, the decimals, and the same contract address you pasted. Ethereum USDT uses 6 decimals, not the 18 decimals many other tokens use. A wallet that assumes 18 will display a nonsense balance. Decimals are a display fact, not a safety fact, but a mismatch is a sign you are not looking at the contract you think you are.

A second useful comparison is canonical WETH, 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2. That contract wraps ether: deposit locks ETH and credits WETH, withdraw burns WETH and returns ETH. It is not an issuer minting unbacked tokens into a pool. If a page about a new token uses the same confident layout as these two, the layout is not the evidence. The functions are.

1. Type etherscan.io. Paste the full 0x address. Confirm the address on the page matches every character, not only the first and last four.
2. Read the name, symbol, and decimals. If you arrived from a link, ignore the link's label and read the address again.
3. Open the Contract tab. Note whether the source is verified, whether Etherscan shows a proxy or an implementation, and the compiler line if one is shown.
4. Open Read contract (or Read as proxy, if that is the view Etherscan offers). Look for owner, mint, blacklist, pause, and tax or fee setters.
5. Open Holders. Separate exchange and burn addresses from a deployer wallet. Then decide whether you still need the token at all.

What verified source does and does not mean

On the Contract tab, a verified contract is one where a person submitted source and Etherscan matched it to the bytecode on chain. You can read the functions in a browser. An unverified contract shows bytecode. You can still see transactions, but you cannot read the rules in source form. Unverified source is a reason to slow down. The checker treats a source that GoPlus or honeypot.is marks as not open as a warning, and it says the other flags are incomplete. Verified source is not the opposite of a scam. A honeypot can be verified. Verification only means the text matches the code that runs, or the code of the implementation if you are looking through a proxy.

Read the compiler version and whether optimization was on, if the page shows them. You are not trying to reproduce the build. You are checking that you are in the source view and not staring at a wall of bytecode by mistake. If Etherscan offers a similar-match note, that means the source resembles another verified contract. Resemblance is not identity. A copied fair contract with one changed line in transfer is a different contract.

Proxy contracts are the easy place to read the wrong file. The address people trade is often a proxy: a small contract that delegatecalls an implementation. The proxy address stays put so wallets and pools do not have to move. The implementation can be replaced by whoever holds the admin key. EIP-1967 is the common standard for where that implementation address is stored. Etherscan often shows Read as proxy and Write as proxy when it detects this. Read that view. The proxy's own bytecode is mostly a forwarder. The transfer rules live in the implementation, and tomorrow's implementation may not be today's.

Functions that change the deal after you buy

You do not need to audit the whole file. You need the functions that let someone else decide what your balance can do. In an ERC-20, the standard surface is transfer, transferFrom, approve, allowance, balanceOf, and totalSupply. EIP-20 defines those. Extra functions are where the privileges sit. The companion guide on mint, owner, blacklist, and proxy goes through each privilege. On the Etherscan page, this is the short list.

Owner, or an equivalent admin, is the address allowed to call the privileged functions. If owner() returns the zero address, an Ownable-style gate should reject onlyOwner calls. That does not cover a separate proxy admin, a hidden owner in another variable, or a function that can take ownership back. The checker has separate rows for a hidden owner and for ownership that can be reclaimed, because those show up in GoPlus's record when that source has one.

Mint, issue, or any function that increases supply lets the caller create tokens. Blacklist, or a freeze list, lets the caller stop chosen addresses from transferring. Pause lets the caller stop transfers generally. A tax, fee, or slippage setter lets the caller change what a later sell pays. On canonical USDT, blacklist and pause are how a centralized issuer complies with sanctions and halts the contract. Tether can freeze USDT. That is a published property of that stablecoin, and the checker labels it as issuer context on the canonical address instead of telling you not to buy. The same function names on a token minted yesterday, with a ticker that imitates a known coin, are not context. They are the mechanism that blocks sellers.

Write contract is the tab that would send a transaction. You do not need it for reading. Connecting a wallet to an explorer, or to a site that framed an explorer, is a separate risk. Reading is a GET in the browser.

Holders, the creator, and the first transactions

The Holders tab lists addresses and balances. A large holder is not automatically the attacker. Exchanges custody coins for customers, so a Coinbase or Binance address can sit near the top of a major token without being a single person about to sell. The burn address and the dead address, 0x000000000000000000000000000000000000dEaD, hold tokens that are conventionally out of circulation. The interesting row on a new token is a deployer or an unlabeled wallet with a large unlocked share.

The checker turns that idea into a number only when a source actually returns holders. GoPlus's holder list, ignoring burn addresses and holders it marks locked, warns when one wallet has at least half the supply and treats 80 percent or more as critical. If the source returns no holder list, the row is not checked. It is not marked clear. RugCheck's top-holder figure is used the same way on Solana. Etherscan's holder tab is still worth reading yourself, because a label like 'exchange' or 'deployer' is context the percentage does not carry.

The contract creator is on the page. Open that address. Look at the other contracts it deployed and whether it still holds a large balance or the liquidity tokens. A creator that deployed twenty tokens this week is a fact you can see from the address page. It is not a statistic this guide invents a rate for. It is a reason to assume the person can deploy a twenty-first.

Early transfers tell you whether liquidity was added, whether a large share moved to a locker or to the dead address, and whether the same wallets are buying and selling with each other. This is slower than a score. It is also the record the score is summarizing. Pair it with the liquidity guide before you treat a lock badge on a chart site as the end of the job.

A page that looks fine and is not

Picture a verified contract, compiler line filled in, logo on the token page, and a name one letter off a known coin. The transfer function checks a blacklist mapping, and a second function lets the owner set a sell fee. Nothing on the green verification badge mentions either function. The badge means the source matches. The source is where the fee and the blacklist are written. If you cannot find those functions because the file is long, search the source for blacklist, pause, mint, onlyOwner, setFee, and delegatecall. Search is not an audit. It catches the obvious levers.

Picture the opposite miss. You search a ticker, open a verified contract with a clean owner() of the zero address, and buy. The address was a different deployment from the one your friend holds. Their copy is the proxy with an admin key. Yours is an imitation with a mint. Matching names are cheap. Matching every hex character of the address is the check.

Etherscan also shows token approvals for an address, including at the token approval checker the site publishes. An approval is a spender allowed to move your tokens up to an amount. Unlimited approvals are a normal part of some decentralized exchanges and the usual path of a drainer. Reading the contract of the token does not revoke an approval you already signed. That is a separate action, on a tool you reached by typing the address, after you have read what you are revoking.

What to do with the page

If the contract is unverified, or the proxy view shows an admin you do not know, or mint and blacklist sit on a token that is not a known stablecoin, stop. Paste the same address into the checker and read the rows, including any that say not checked. Then decide whether the token is worth a signature at all. A low score does not cancel a function you just read. A critical score does not need a second opinion from a stranger in a chat.

If you are looking at canonical USDT, USDC, DAI, WETH, or WBTC, expect issuer or wrapper powers and read the methodology for how this site labels them. Expecting those powers on a random address that reused the ticker is how the copycat works.

• The address on the page matches the address you intended, character for character, on the chain you intended.
• You opened the implementation, not only the proxy bytecode.
• You can say, in one sentence, who can mint, blacklist, pause, or change a fee, and whether that person is a known issuer.
• The largest holders are labeled in a way you understand, or you have treated an unlabeled concentration as a reason to stop.
• You did not connect a wallet to the explorer. You did not paste a seed phrase anywhere.
• You ran the same address through the checker and read every row that is not clear, including context and not checked.

Questions