Fake Tokens and Copycats: How to Verify a Contract Before You Swap

Deploying an ERC-20 named USD Coin with the symbol USDC costs a few dollars in gas and requires permission from nobody. That isn't a flaw in the system — it is the system. Names and symbols are strings a deployer chose and stored in a contract. Nothing onchain enforces uniqueness, and nothing ever will.

So the only thing that identifies a token is its contract address. The name in your wallet, the logo, the symbol in a picker: all of it is metadata attached to an address by someone, and every piece of it can be copied exactly.

Where token lists stop protecting you

Curated token lists solve this well for the popular few thousand assets. If you're swapping ETH for USDC, the list has your back and there's nothing to think about.

The problem is the shape of the risk. Lists cover established tokens; new and long-tail tokens aren't on them, so you paste an address instead. Which means the moment you have the least protection is precisely the moment you're doing the riskiest thing — buying something new, thin, and unvetted. "I just use the token list" is a perfectly good habit that stops working exactly where people actually lose money.

Three ways people land on the wrong contract

• Copied from the wrong place. A search result, a reply under the announcement post, a group chat pin edited after everyone stopped looking. Scam addresses are deliberately seeded into the places people copy from — that's the entire product.
• Right ticker, wrong chain. The real project lives on Ethereum, and someone deployed the same ticker on a chain where it doesn't exist. Same symbol, plausible logo, a pool with just enough liquidity to look alive.
• Address poisoning. A dusting transaction drops a lookalike address into your history, matched to the first and last few characters of one you use regularly. Later you copy from history on autopilot.

The check, in about forty seconds

1. 1Start from the project, not from search. The docs page or the site linked from the project's own verified profile. Prefer docs over a social post — documentation gets maintained, posts get impersonated.
2. 2Confirm with a second independent source. A major data aggregator's per-chain contract listing, or the block explorer's token page. Two sources agreeing is a meaningfully different claim than one source asserting.
3. 3Compare the whole address. All of it, or at minimum both ends plus a chunk from the middle. Vanity prefixes exist specifically to defeat the glance-at-the-first-four habit, and they work.
4. 4Read the token page like a skeptic. Age, holder count, transfer history, whether source is verified, how much liquidity actually exists. A token deployed yesterday with forty holders isn't automatically a scam — but you should know that's what you're buying.
5. 5Sanity-check the quote itself. If a $200 trade shows enormous price impact, the pool is tiny. That's a hard fact about your trade and usually a useful fact about the token.

Honeypots and fee-on-transfer tokens

Two contract behaviors account for an outsized share of confused "why did my swap break" moments, and both are visible in advance if you know what you're looking at.

A honeypot lets you buy and quietly prevents you from selling — through a transfer restriction, a blocklist, or a whitelist that only the deployer is on. The buy executes perfectly. It's the exit that doesn't exist, and you don't find out until you need it.

A fee-on-transfer token takes a cut on every transfer, so less arrives than was sent. This isn't always malicious; plenty of legitimate tokens do it deliberately. But it breaks routing that assumes what goes in comes out, which makes it a common cause of swaps that revert for no visible reason or deliver noticeably less than quoted.

The practical tell for both is the same question: is anyone else successfully selling? On the explorer, a token whose transfers only ever flow one direction — or where the only sells come from a single address — is telling you exactly what will happen when it's your turn.

What tooling can do, and what it can't

SwapRoute's picker is chain-aware and searchable by contract address, and it can read ERC-20 metadata directly from the chain when a token isn't in the registry. That makes your selection unambiguous — USDC on Base doesn't get quietly confused with USDC on Arbitrum, and pasting an address gets you that address rather than something that resembles it.

What no tool can do is tell you a token is legitimate. That's a claim about intent and about a project's future, and it is not in the bytecode. Anyone selling an automated verdict on it is overselling. An interface can guarantee you route the thing you picked; picking correctly stays with you, and it's worth being honest about that division of labor.

One related habit: an approval granted to a contract outlives the trade that prompted it. If you did swap into something you've since gone cold on, revoking the allowance is the cleanup step almost everyone skips.

The short version

• The address is the token. Everything else is a label someone chose.
• Get the address from the project; confirm it against a second source.
• Compare the full string, not the ends.
• Read the token page: age, holders, liquidity, and whether sells actually go through.
• If the price impact looks absurd for a small size, believe the number.

This is a forty-second habit that stops one of the few crypto mistakes with no recovery path. Slippage you can re-quote. A bad chain you can bridge back from. Buying the wrong contract is simply over.