TOKEN SECURITY
How to read token risk flags without trusting a score
Understand honeypot indicators, contract controls, missing data, and the next checks to make before interacting.
Start with identity
Copy the contract address from the project’s independently verified source and choose the exact network. A familiar symbol or name is not enough to identify a token. Treat every automated result as a question to investigate, not permission to buy.
A selling check has limits
Honeypot.is explains that it simulates buying and selling to look for restrictions, and warns that behavior can change later. A successful test at one moment is not a promise that you can exit a position tomorrow.
Honeypot.is: how the checker works ↗Separate capabilities from intent
A proxy, minting function, blacklist, or pause capability deserves context. Ask who controls it and how it can change. Legitimate projects may have these controls. A flag alone does not establish fraud. Missing provider values remain unknown.
GoPlus: field definitions ↗Use a second source
Review the address on the appropriate block explorer. Compare current contract controls with the project’s documentation. Check whether an independent audit applies to the deployed version. Our scanner does not evaluate the project team, authenticate the token, or establish that liquidity is available.
Make uncertainty visible
Record what you could confirm, what you could not, and when you checked. If the uncertainty is material, pause. A saved report is a record of a check, not a certificate.