Short answer: To check whether a token is safe, confirm the contract address from an official source, run it through a token risk checker such as Firepan Sentinel for honeypot signals and owner permissions, check who can mint, pause, freeze, or upgrade the contract, confirm there is real liquidity that is not about to be pulled, look at how concentrated the holders are, and test with a small amount before committing. These checks can expose warning signs, but they do not establish that a token is safe.
This guide covers EVM tokens on Ethereum, Base, Arbitrum, and similar chains.
Copycat tokens reuse a real project's name and symbol. Take the contract address from the project's official website or documentation, then confirm it on the chain explorer (Etherscan, Basescan, Arbiscan). Never trust an address from a reply, DM, or search ad.
Paste the address into a token risk checker. Firepan Sentinel is free and needs no account. It checks:
Read each factor, not only the overall score. A second checker is a good habit; see rug pull checkers compared.
A honeypot lets you buy but blocks or heavily taxes selling. Scanners flag known patterns, and tools such as Honeypot.is simulate a buy and a sell to test it. Even so, a token that sells today can be changed tomorrow if someone still controls it.
On the explorer's Contract tab, check:
owner() or the role holders. A burned owner (the zero address) means no one can use owner-only functions. A multisig or timelock is better than a single wallet.These powers are normal for some tokens. Every major issuer-backed stablecoin we checked can freeze addresses; see admin controls in 49 major tokens. The question is whether the powers make sense for the token and who holds them.
Look at the main trading pool on a DEX analytics site:
On the explorer's Holders tab, see how much of the supply the top wallets hold, excluding known exchange, burn, and pool addresses. A few wallets holding most of the supply can crash the price by selling.
Verified source code, an audit report you can find on the auditor's own site, a real team, and a history longer than a few days all reduce risk. Anonymous teams, copied websites, and pressure to buy quickly raise it.
Buy a small amount first and confirm you can sell it. When you approve a token for a DEX or app, approve only the amount you need, and review and revoke old approvals with an approval manager.
| Red flag | Why it matters |
|---|---|
| Can't sell, or very high sell tax | Likely honeypot |
| Unverified source code | You can't see what the contract does |
| Single-wallet owner with mint power | Supply can be inflated at will |
| Upgradeable with no timelock | Rules can change without warning |
| Unlocked LP tokens | Liquidity can be pulled |
| Top wallets hold most of the supply | Price can be dumped |
| Address came from a DM or reply | Possible copycat token |
Q: How do I check if a token is a scam?
A: Confirm the address from the official site, scan it with a token risk checker such as Firepan Sentinel, confirm you can sell, check who can mint, pause, freeze, or upgrade it, and check liquidity locks and holder concentration. Then test with a small amount.
Q: Is there a free token safety checker?
A: Yes. Firepan Sentinel runs a free scan with no account. Other free checkers include GoPlus and Honeypot.is for EVM tokens and RugCheck for Solana.
Q: Can a safe-looking token still rug pull?
A: Yes. Scans reflect the state at scan time. A team that controls the contract or the liquidity can still act later, and some rug pulls happen through off-chain actions. Recheck before larger trades.
Q: What does it mean if a token is upgradeable?
A: The contract's logic can be replaced by whoever controls the upgrade. That allows bug fixes, but it also means new restrictions or fees can be added. Check whether upgrades go through a timelock or multisig.
Firepan
Run a free scan — results in minutes, no credit card required.
Run Free Scan →Firepan Sentinel, GoPlus, Token Sniffer, Honeypot.is, RugCheck, De.Fi, and Bubblemaps compared: what each rug pull checker looks at, which chains it covers, and how to combine them.
We checked 49 major Ethereum, Base, and Arbitrum tokens on-chain. 8 can freeze addresses, 9 can pause transfers, 13 are upgradeable, and 33 expose a mint function. Full table by token.
A hands-on workflow for Slither, Mythril, and Echidna: commands, a property example, what each run actually tells you, and where Foundry invariants, Medusa, and formal tools fit.
AI penetration testing uses AI agents to plan and run parts of a security test — reconnaissance, hypothesis generation, exploit attempts. Here is what an AI pentest can find, where it stops, and how it applies to apps and smart contracts.