Before buying any new token: verify the contract address against official sources, check Token Sniffer for scam patterns, review holder distribution on Etherscan, confirm liquidity is locked and adequate, look at the team and GitHub activity, and simulate a buy+sell on honeypot.is. These six checks take under five minutes and filter out the vast majority of scam tokens and rug pulls.
How to Check if a Token Is Safe Before Buying
4 min read
The short version
The difference between a legitimate new token and a scam token is usually invisible from the price chart. Both can show green candles. Both can have active Telegram groups. The only way to tell them apart is looking under the hood at the contract code, who holds the supply, and whether you can actually sell after you buy. These checks look under the hood for you.
How It Works
Six verification checks in order. Check 1: Verify the contract address. Go to the official project website or their verified Twitter/X. Find the contract address they publish. Copy it. Compare it character-by-character to what you are about to buy. Scammers create tokens with the same name/symbol but different contract addresses. One wrong character and you buy a worthless clone. Check 2: Token Sniffer scan. Paste the contract address into tokensniffer.com. It analyzes the code for: hidden mint functions (team can create infinite tokens), sell restrictions (honeypot behavior), proxy patterns (code can be changed after you buy), and high/modifiable fees. A score below 50/100 is a major warning. Check 3: Honeypot simulation. Paste the address into honeypot.is. It simulates a buy and then a sell. If the simulated sell fails or shows 90%+ tax: walk away immediately. You will not be able to sell. Check 4: Holder distribution. On Etherscan, check the Holders tab. Look for: top non-contract wallet holding more than 10% (dump risk), whether the deployer wallet still holds a large share, and if liquidity pool tokens are held by a known lock contract (team.finance, Unicrypt) or by the deployer. Check 5: Liquidity lock. The LP tokens (representing the trading pool) should be locked in a timelock contract, not sitting in the deployer wallet. Use DexScreener or the DEX info page to find the LP token holder. If it is the deployer address: they can pull liquidity at any moment. If it is a lock contract: check the lock duration (under 30 days is concerning). Check 6: Team and development activity. Does the team have verifiable identities (LinkedIn, previous projects)? Is there a GitHub with real commits (not just a forked contract with no changes)? Is there a working product or just marketing? Anonymous team + no product + aggressive marketing = high probability scam.
Running all 6 checks on a new token in 4 minutes
A token called ALPHA is trending. You want to evaluate it. (1) Contract: official website links to 0xABC...123 on Ethereum. You verify on Etherscan that this address matches the token name and has verified source code. (2) Token Sniffer: score 82/100. No hidden mints, no proxy. There is a 3% buy/sell tax (disclosed in their docs). Acceptable. (3) Honeypot.is: buy simulation succeeds, sell simulation succeeds with 3% tax deducted. Not a honeypot. (4) Holders: top wallet (besides the pool and known exchanges) holds 4.2%. Healthy distribution. No single whale dominates. (5) Liquidity: LP tokens locked on team.finance for 12 months ($800K liquidity). Pool is deep enough for your trade size. (6) Team: 3 doxxed founders with LinkedIn profiles and previous crypto projects. GitHub has 200+ commits over 6 months. Working beta product. Result: all checks pass. This does not guarantee profit (the token could still fail for business reasons) but it is not a scam. You can proceed with your investment thesis knowing the structural risks are low.
What People Get Wrong
If the chart looks healthy, the token is safe
Scam tokens deliberately pump the chart to attract buyers. Honeypots show only green candles (everyone can buy, nobody can sell). Rug pulls show healthy volume right up until the moment liquidity is pulled. The chart tells you about past price action, not about contract safety or sell functionality.
Verified source code means safe
Verified means you can read the code, not that the code is safe. A verified contract can still contain: owner-only mint functions, adjustable sell taxes, blacklist functions, and other mechanisms that are visible in the code but overlooked by casual buyers. Verification is necessary (unverified is worse) but not sufficient.
One passing check is enough
Sophisticated scammers pass multiple checks and fail on one. A token might have locked liquidity (pass check 5) but have a hidden mint function (fail check 2). Or it might pass Token Sniffer but have 90% concentrated in one wallet (fail check 4). Run all six. The combination catches what individual checks miss.
Keep Reading
Sources & Further Reading
- Token Sniffer
Automated contract analysis for scam patterns and code quality scoring
- Honeypot.is
Simulate buy/sell to verify you can actually exit a token position
- DexScreener
Token charts with liquidity info, holder data, and contract verification status
Questions People Also Ask
- How long do these checks take?
- Under 5 minutes for all six. Token Sniffer and honeypot.is give results in seconds. Etherscan holder check is one click. Liquidity lock verification takes 30 seconds. The team/GitHub check takes 1-2 minutes. Faster than reading one shill post on Twitter, and infinitely more useful.
- Should I do this for every token including major ones?
- For tokens listed on major centralized exchanges (BTC, ETH, USDC, UNI, AAVE): no, these have been vetted thousands of times. For any token you find on DEXs, Twitter, or Telegram that is NOT on Coinbase/Binance: absolutely yes, every time. The permissionless nature of DEXs means zero vetting has occurred.
- What if 5 of 6 checks pass but one fails?
- It depends which one fails. Failed honeypot simulation (check 3): never buy, period. Failed holder concentration (check 4): high risk but not necessarily a scam (could be early-stage legitimate project). Failed team check (check 6): higher risk but some legitimate projects are anonymous. Use judgment, but never ignore a failed honeypot or Token Sniffer critical flag.