How to spot a fake token contract before you buy, a 10-minute checklist using contract address, decimals, and holder data

Buying a new token on a DEX can feel like grabbing a “cheap phone” from a street stall. The box looks right, the sticker looks right, and the price is exciting, but inside can be empty plastic. A fake token contract works the same way, it copies the name and ticker, then traps buyers with bad rules. Early 2026 has more fast launches, more copycats, and more “buy-only” honeypots. So you need a routine that is boring, repeatable, and fast. This checklist is built for that, using only what you can see on a block explorer: contract address, decimals, holders, and transactions. Start with the contract address (name and ticker are cheap costumes) An explorer-first approach to token safety, checking the contract before swapping, created with AI. If you do only one thing, do this: treat the contract address as the identity, and treat the token name as marketing. Where to click on the explorer (2 minutes) Open your block explorer for the chain you’re using. Paste the contract address (not the token name) in the search bar. On the token page, look for the Token Tracker or token overview area. Click Contract to see code details, then click Transactions to see activity. Red flags you can see instantly Wrong chain: The address is on a different network than the token you think you’re buying. No token page: You land on a normal wallet address page, not a token contract tracker. Unverified contract: In the Contract tab, there’s no verified source. That doesn’t prove scam, but for a retail buyer it’s an easy “skip”. Also watch the classic copycat trick: scammers create a token with the same symbol, then push a “contract address” in Telegram. Your job is to match the address with an official source, and not with a forwarded message. If you want a fast external scan as a second opinion (not a guarantee), tools like Token Sniffer contract checks can surface common issues like mint risk or suspicious patterns. Still, your own eyes on the explorer matters more than any score. Decimals and supply sanity checks (fake math shows up here) Decimals looks boring, but it’s where a lot of fake token contract confusion starts. If decimals are weird, price displays get weird, wallets show strange balances, and scammers use that confusion to sell a “cheap” illusion. The 3-click decimals check (about 90 seconds) On the token page, go to the Contract tab. Open Read Contract (sometimes called “Read”). Find and call decimals(). What “normal” looks like: many tokens use 18 decimals, some use 6, 8, 9, and so on. The point is not “must be 18”. The point is must match what the project claims. If a site says 18, but decimals() returns 9, something is off (either scam, or sloppy team, both are a risk). Now do the same with supply: In Read Contract, check totalSupply(). Compare that with the supply shown in the token tracker area. Red flags tied to supply: Total supply changes a lot in a short time, that can mean minting. Max supply is “claimed” off-chain, but on-chain there is no cap, or there is a mint function available. Supply is astronomic (like absurd zeros) and the marketing leans on “cheap per token” pricing. Cheap unit price isn’t value, it’s just decimals and supply. This is also where copycats hide. A scammer can copy the name, logo, and ticker, but they often forget (or don’t care) to match decimals and supply story. Contract tab deep-check: proxies, mint, blacklist, and “trading enabled” switches This is the part that feels like reading terms and conditions. It’s also where you catch the sharp hooks. A fake token contract often uses one of these patterns: Upgradeable proxy that can be changed later Owner controls that block sells Taxes that jump after you buy Blacklist or whitelist gates What to look at, in order (3 to 4 minutes) Go to Contract: Code: Look for “verified” status and read the high-level comments. Read Contract: Look for admin and state variables. Write Contract (even if you can’t use it): It shows what the owner can change. Key items: Proxy or upgradeability: Many explorers show hints like “proxy” or separate read pages. If it’s upgradeable, ask a simple question: who controls upgrades, and is that a multi-sig or one wallet? Ownership: In Read Contract, call owner() (or similar). If owner is not renounced, it’s not auto-scam, but it’s a control risk. Minting: Search in Code for “mint”, “_mint”, “setMinter”. Unlimited mint is one of the easiest slow rugs, price just dies later. Blacklist or whitelist: Search for “blacklist”, “whitelist”, “bot”, “isExcluded”, “isBlacklisted”. These can be used to block selling for normal buyers. Trading toggles: Search for “tradingEnabled”, “enableTrading”, “swapEnabled”. A common honeypot style is trading “enabled” only for a few addresses. For a beginner-friendly explanation of how contract review fits into DeFi safety, the checklist in how to check a smart contract is useful background. Holders and transactions: the on-chain crowd tells you the truth A token can look clean in the contract tab, but still be a trap because of holder control and liquidity games. Holder distribution check (2 minutes) On the token tracker page, click Holders. Look at the top 10 holders and the % each holds. What “healthier” often looks like: No single wallet holding a scary share (context matters, but huge concentration is danger). If there is a big holder, it’s a known lock contract, burn address, or liquidity pool contract (you still verify, not assume). Red flags: Top holder is a normal wallet with a massive percentage. Many top holders are brand-new wallets with no history. A cluster of wallets created around the same time, moving tokens in circles. Transaction pattern check (2 minutes) Click Transactions. Scan recent activity, then click a few transfers. Watch for: One-way flow: many buys in, very few sells out. Odd approvals: big approvals requested by the token contract are a sign to slow down. Liquidity pull behavior: sudden big moves tied to pool contracts (often you see it as large swaps and then silence). If you want a plain-language breakdown of how honeypots trap sellers, read what a honeypot token scam is. Even if you never use their platform, the behavior patterns are the same. The 10-minute checklist (screenshot-friendly) Visual 10-step checklist for quick contract screening, created with AI. Check (10 minutes total) Where to look Safer sign Red flag Contract address match Explorer search bar Matches official sources Shared only in chats Chain and standard Token tracker, Contract Correct chain, ERC-20 style Wrong chain or weird format Decimals Contract, Read, decimals() Matches claimed decimals Mismatch or strange values Total supply Read, totalSupply() Stable, explainable Changes fast (minting) Source verification Contract, Code Verified source Not verified Proxy upgrade risk Contract page hints, Code Clear admin controls Upgradeable with one-wallet admin Owner permissions Read, owner() and functions Limited controls Pause, blacklist, trading toggles Tax rules Code search for fee/tax Reasonable, fixed Extreme tax, changeable tax Holder concentration Holders tab Spread out Few wallets hold most Activity sanity Transactions tab Buys and sells both exist Buys only, sells fail signs For deeper research on scam token detection methods at a research level (if you like reading papers), see TokenScout scam token detection. If you already bought, do this now (damage control) Stop adding more. Then: Try a small test sell (tiny amount). If it fails, don’t keep trying big. Don’t sign random “fix” links. Scammers often send fake support pages next. Revoke token approvals using a reputable approval tool (many traders use revoke sites), then move remaining funds to a fresh wallet if you suspect wallet drain risk. Save transaction hashes, you’ll want them for reports and for your own records (tax, disputes, lessons learned). Closing thoughts (and a safety note) A fake token contract is usually not “genius hacking”. It’s normal tricks, pushed fast, while you’re in a hurry. Slow down, open the Contract tab, check decimals, check holders, and let the chain show you what’s real. This post is not financial advice. It’s a safety routine for risk control, and it doesn’t remove risk. If something feels rushed or unclear, skipping the trade is also a valid strategy.