You don't need to be a developer to spot a scam token. Every contract on Etherscan is publicly readable. The panda watches investors hand over money without ever looking at the code. Two minutes on Etherscan beats trusting a Discord admin's word every time.
Why Can't I Just Trust the Team?
Because "the team" might not exist, might exit tomorrow, or might have hidden a backdoor in the code. A slick website and hype say nothing about what the contract actually does. The contract code is truth. Everything else is marketing. This is part of the broader Ethereum security toolkit.
According to BSCScan data in 2025, over 70% of failed token projects had at least one suspicious pattern in the contract code that could have been spotted in under 5 minutes. You're looking for facts, not feelings.
Prerequisites: What You Need
- The token contract address from official sources only
- A browser with Etherscan.io (or BscScan.com for BSC)
- Time required: 2-3 minutes
No coding knowledge needed.
What Are You Actually Looking For: 5 Red Flags
The goal isn't to audit the contract like a professional. You're screening for obvious landmines. A legit contract will pass all five checks. A scam typically fails at least three.
Red Flag 1: Unverified contracts
If the "Code" tab shows "Contract source code not verified", stop. Unverified contracts hide malicious functions. According to Etherscan documentation, verified contracts display source code publicly. If the team won't verify, they're hiding something.
Red Flag 2: Unlimited mint function
Look for mint() without a cap. If found, the team can print infinite tokens and crash the price. DexScreener tracks this pattern.
Red Flag 3: Pause function
Search for pause(). If the owner can freeze transfers, users can't sell. Dead asset.
Red Flag 4: Hidden taxes
If transfers have a tax variable >5% not disclosed upfront, the team is skimming every trade.
Red Flag 5: Backdoor functions
Look for emergencyTransfer() or adminWithdraw(). If only the owner can call them with no delay, the team can steal funds anytime.
Step-by-Step: Reading Your First Contract
Step 1: Find the contract address
Go to the token's website or official social media (not random Discord). Copy the contract address (usually labeled "Ethereum Address" or "Contract Address"). It looks like 0x1234...abcd.
Step 2: Paste into Etherscan
Open Etherscan.io. Paste the contract address in the search bar. Hit enter.
You'll land on the contract's page. You should see:
- Contract name (top left)
- Total supply and holders (top right)
- A series of tabs: "Transactions", "Analytics", "Code", "Read as Proxy", "Write as Proxy"
Click the "Code" tab.
Step 3: Check verification status
At the top of the Code tab, look for:
- ✅ "Source code verified": good sign
- ❌ "Not verified": stop here
Step 4: Scan for the 5 red flags
Use your browser's find function (Ctrl+F) to search:
mint→ check for a cap. No cap = red flag.pause()→ if found withonlyOwner, red flag.tax→ if >5% and hidden, red flag.emergencyWithdraw()oradminTransfer()→ if only owner can call with no delay, red flag.renounceOwnership()→ if called (owner is0x000...), that's actually a green flag.
Step 5: Check the owner
Scroll down to find Contract Owner address.
- Owner is
0x0000...0000= renounced, can't be rugged ✅ - Owner deployed 50+ tokens in a month = factory deployer ⚠️ (might be a rug farm)
Troubleshooting Common Confusions
"The code has a mint() function but I don't see a cap. Am I reading it wrong?"
Search for maxSupply or MAX_SUPPLY in the code. If it exists and mint() checks against it, there's a cap and it's fine. If neither exists, the mint is uncapped. It's a red flag.
"What if the code is over 10,000 lines long?"
Just search for the 5 keywords (mint, pause, tax, emergencyWithdraw, renounceOwnership). Don't try to read the whole thing. 90% of token contracts are boring standard code; 10% contain the red flags.
"The contract is verified but the team hasn't launched yet?"
Yes. Presale code differs from final tokens. Always check the actual token contract.
"I found a function I don't recognize. Is it a red flag?"
Not necessarily. Token contracts have standard functions for trading (transfer, approve, swap). Unusual functions like stake() or reflect() are normal for yield tokens. You're only looking for the 5 specific patterns. If you want to dig deeper, see how to spot honeypots on BSC.
FAQ
Q: If the contract is verified, can I assume it's safe?
A: Verified means the code is visible, not that it's audited. A verified scam is still a scam. The 5 checks filter out obvious rugs.
Q: Can I use this method on BSC or Solana tokens?
A: Yes. BSC uses BscScan (same interface as Etherscan). Solana uses Solscan (similar layout). The 5 red flags apply across all chains.
Q: What if I see a contract that passes all 5 checks but the price still crashes?
A: The code might be clean, but the team might abandon the project or do poor marketing. Code safety ≠ investment returns. This is a DYOR tool, not a moon meter.
Q: Is renouncing ownership always good?
A: It removes rug-pull risk but also means no one can fix bugs or upgrade the contract. Trade-off. Legit projects often keep ownership for flexibility; scams often renounce to appear safe. Look at the contract's age and track record.
Q: Do I need to understand Solidity to use Etherscan's code view?
A: No. You just need to recognize function names and keywords. Reading code != writing code.
What Comes Next
The contract passed your 2-minute scan. But code safety is one thing; market fundamentals are another. Check DeFi's TVL on DefiLlama to see if the token has real utility. Verify the team's track record. Look at the token's trading volume and holder count on DexScreener.
Every token on Ethereum is an open book. The code doesn't lie. The panda has seen enough wallets lose money on unverified contracts. Your two minutes of due diligence save years of regret.
