How to check a smart contract before you interact

You do not need to read code to avoid the majority of contract disasters. Most losses come from a small number of checkable conditions.

1. Is the contract verified?

A verified contract has published source code that a block explorer has confirmed compiles to the deployed bytecode. Unverified means nobody outside the deployer knows what it does.

Treat an unverified contract as hostile. There is no legitimate reason for a project asking for your money to hide its source. This one check eliminates a great deal.

2. What can the owner do?

Even in verified code, a non-developer can search for the functions that matter. Look for:

• mint — can the owner create unlimited new tokens? That dilutes you to nothing at will.
• pause / blacklist — can they stop you selling, or block your specific address? Honeypot tokens work exactly this way: you can buy, and then cannot sell.
• setFee / setTax — can the transfer fee be changed after you buy? A fee raised to 99% is a trap.
• onlyOwner — how many functions are restricted to one address, and is that address a single key or a multisig?

Many explorers now surface these automatically. If the owner can mint, pause or tax at will, the token’s rules are whatever they decide tomorrow.

3. Understand what you are approving

This is where most wallet drains happen. To let a contract move your tokens you grant an allowance. Two things surprise people:

• Allowances are frequently unlimited. Many interfaces default to approving the maximum possible amount, so the contract can move every token of that type you hold — now and any you acquire later.
• They persist indefinitely. The approval remains after you finish, until you revoke it. A protocol compromised a year later can still act on an allowance you granted today.

Read the approval screen. Your wallet shows which contract and what amount. If it says unlimited and you are making a one-off swap, set a specific amount instead.

4. Recognise a malicious signature request

Not every signature is a transaction. Some requests ask you to sign a message that grants permissions off-chain — a technique used heavily on fake mint and airdrop sites.

Warning signs: a signature request you did not initiate; a request appearing immediately after clicking a link from a direct message or advertisement; a request whose content your wallet cannot decode into something readable; or any prompt on a site reached from an unsolicited source. When in doubt, reject it. A legitimate action can always be repeated.

5. Revoke old approvals

Make it a habit. Use a reputable revocation tool — reached by typing the address directly, since fake revocation sites exist and are exactly the kind of trap that catches security-conscious users — and clear allowances you no longer need, especially unlimited ones and any to protocols you no longer use.

6. Treat “audited” carefully

An audit is a point-in-time review by fallible people, often of a version that later changed. Plenty of audited protocols have been exploited.

Useful questions: who performed it, is the report public, what severity issues were found, were they fixed, and has the contract been modified since? “Audited by” with no linked report is marketing.

7. Prefer time-tested contracts

The strongest available signal is survival. A protocol holding significant value for years without an exploit has been under continuous attack by well-funded adversaries and has held. That is a harder test than any audit.

New contracts are unproven by definition, regardless of how good the code looks.

A pre-flight checklist

• Contract verified on a block explorer
• No unlimited mint, pause, blacklist or mutable-fee functions — or ownership renounced
• Approval scope understood, and limited where practical
• Signature request initiated by me, on a site I navigated to directly
• Protocol has meaningful operating history and value at stake
• Using a wallet holding only what I can afford to lose

What to read next

You have finished the Earning & DeFi path — and all four paths. The glossary covers any term you want to revisit, and the learning hub shows your progress.