Skip to content
ethexplorer.org

Technical guide · Verified source · Proxies

Ethereum smart contract explorer: read the code that holds your money

Verified source, Read and Write tabs, ABIs, proxies, events and admin keys, explained in plain language. Finish with a five-step check you can run on any address.

Regulated exchange since 2013

  • Etherscan · Sourcify · Blockscout
  • EIP-1967 proxies
  • Tenderly & Phalcon traces

By ethexplorer.org editorial team Updated 11 min read

Every token, NFT collection, lending market and bridge on Ethereum is a smart contract: bytecode stored at an address, executed by every node exactly as written. An Ethereum smart contract explorer is the part of a block explorer that turns that bytecode back into something you can inspect. It shows you the source code if the author published it, lets you call functions without writing a line of code, lists the events the contract emitted and tells you who deployed it.

You do not need to be a Solidity developer to get value from it. Knowing what “verified” really means, how to spot a proxy and where to find the admin keys is enough to avoid a large class of risks. This guide goes through the contract page tab by tab, then ends with a five-step routine. For token-specific checks like holder concentration and honeypots, see our companion token explorer guide.

What “verified source code” means on Etherscan, Sourcify and Blockscout

A contract address stores only bytecode. Anyone can claim that a certain Solidity file produced it; verification is how an explorer checks the claim. The author submits the source files, the compiler version, the optimiser settings and the constructor arguments. The explorer compiles them and compares the result with the bytecode on-chain. If they match, the source is published next to the contract with a green check mark.

Etherscan distinguishes an Exact Match, where the author’s code and constructor arguments reproduce the deployed contract, from a Similar Match, which Etherscan applies automatically when a new contract’s bytecode matches one already verified. Similar matches are handy for factory-deployed clones, but they ignore constructor arguments, which can change how a contract behaves. When the stakes are high, prefer an exact match.

Sourcify, an open-source verification service originally incubated at the Ethereum Foundation, uses the metadata file that the Solidity compiler embeds as a hash at the end of the bytecode. It now calls the two outcomes exact match and match; you will still see the older names “full” and “partial” in many tools. An exact match means everything, including comments and file paths, is byte-identical. A match means the executable code is identical but metadata differs. Both prove the logic; the renaming happened because “partial” made people think a contract was unverified. Blockscout supports its own verification methods (flattened source, standard JSON input, Hardhat and Foundry plugins) and integrates with Sourcify, so a contract verified on Sourcify can show up as verified on Blockscout too. Our Blockscout review covers this in more detail.

Reading the Read Contract and Write Contract tabs

Once a contract is verified, the explorer knows its ABI and builds two forms. Read Contract lists every view and pure function. Calling them is free, needs no wallet and returns the current on-chain value: a token’s totalSupply(), a vault’s owner(), whether a protocol is paused(). It is the fastest way to answer factual questions about a contract without trusting anyone’s dashboard.

Write Contract lists the functions that change state. The explorer asks you to connect a wallet, fills the parameters into a real transaction and hands it to your wallet to sign. This is genuinely useful when a project’s website is down and you need to withdraw, or when you want to revoke an approval without a third-party site. It is also where mistakes happen: amounts are in the token’s smallest unit, so 1 USDC is 1000000 and 1 WETH is 1000000000000000000. For non-developers, the Write tab is better used for reading than clicking: the list of state-changing functions tells you what the owner and users can do.

ABI and function selectors, in plain language

The ABI (application binary interface) is a JSON description of a contract’s functions and events: names, parameter types and return types. Explorers use it to decode transactions. When you send a transaction to a contract, its input data starts with a four-byte function selector, the first four bytes of the keccak-256 hash of the function signature. Everything after the selector is the arguments, each padded to 32 bytes.

// Three ERC-20 functions and their 4-byte selectors
function transfer(address to, uint256 amount) external returns (bool);   // 0xa9059cbb
function approve(address spender, uint256 amount) external returns (bool); // 0x095ea7b3
function balanceOf(address account) external view returns (uint256);     // 0x70a08231

// selector = first 4 bytes of keccak256("transfer(address,uint256)")
// calldata of a transfer:
// 0xa9059cbb
//   000000000000000000000000<recipient address, 20 bytes>
//   <amount as a 32-byte unsigned integer>

That is why an explorer can label an unverified contract’s transaction as transfer: it recognises 0xa9059cbb from public signature databases even without the contract’s ABI. It also explains a phishing trick. Selectors are only four bytes, so attackers can craft functions with meaningless names that collide with familiar selectors, or name a malicious function claimRewards. Decoded names are hints; the verified source is the truth. Our transaction explorer guide walks through decoding input data on a real transaction.

Proxies: EIP-1967, UUPS and the implementation address

Contracts cannot be edited after deployment, so upgradeable systems split into two: a small proxy that holds the state and the address users interact with, and an implementation (logic) contract that holds the code. The proxy forwards every call with delegatecall. Upgrading means pointing the proxy at a new implementation. USDC is a good real example: 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 is a proxy, and the token logic lives in a separate implementation contract that Circle can replace.

EIP-1967 standardised where proxies store that pointer: the implementation address sits in storage slot 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc, and the admin in 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103. Because the slots are fixed, explorers can detect proxies and show “Read as Proxy” and “Write as Proxy” tabs that use the implementation’s ABI. In a transparent proxy, the upgrade function lives in the proxy and only an admin can call it. In a UUPS proxy (from ERC-1822), the upgrade function lives in the implementation itself, which keeps the proxy lean but means a buggy implementation can brick upgrades. Beacon proxies point many proxies at one beacon that names the implementation.

For your safety check, the key point is simple: when you read a proxy, you are not reading the code that runs. Click through to the implementation, check it is verified, and then find out who can call the upgrade. Whoever controls that key controls every token in the contract.

Events, logs and bytecode

Contracts emit events to record what happened: Transfer, Approval, OwnershipTransferred, Upgraded, Paused. Each event becomes a log in the transaction receipt, with up to four indexed topics and a data field. The Events tab on a contract page is a chronological feed of these logs, and for security it is gold. An Upgraded event two days ago, a new RoleGranted to an unknown address or an OwnershipTransferred to a fresh wallet are exactly the kind of changes that precede incidents.

The bytecode tab shows the raw deployed code. For unverified contracts it is all you have. Tools can decompile it into rough pseudo-code, and our open-source picks such as Otterscan and other self-hosted explorers can trace it on your own node. Since the Pectra upgrade in May 2025 there is another case to recognise: an ordinary wallet address with a short code of 0xef0100 followed by an address is an EIP-7702 delegation, meaning that account currently runs the code of another contract. Modern explorers label it, and it deserves the same scrutiny as any contract.

Contract creator and creation transaction

Every contract page shows who created it and in which transaction. That one line answers a surprising number of questions. Was it deployed by the team’s known deployer, or by an address funded an hour earlier from an exchange? Was it created directly or by a factory contract, as with Uniswap pools or Safe wallets? What constructor arguments were passed? Clicking the creator also shows what else that address deployed; a history of abandoned tokens is a pattern, not a coincidence. Our address explorer guide explains how to profile a wallet quickly.

Check a contract in 5 steps

Run this routine on any contract before you approve tokens or deposit funds. It takes about five minutes on Etherscan or Blockscout.

  1. 1 STEP 01

    Confirm the address and creator

    Get the address from the project’s docs, then open it on an explorer. Check the contract creator and the creation transaction: who deployed it, when, and from which factory.

  2. 2 STEP 02

    Check verification status

    Look for an exact or full match on Etherscan, Sourcify or Blockscout. No verified source means you are trusting bytecode you cannot read.

  3. 3 STEP 03

    Resolve the proxy

    If the explorer marks a proxy, open the implementation address and read that code instead. Note who can upgrade it.

  4. 4 STEP 04

    Find the admin powers

    In Read Contract, check owner(), roles and the proxy admin. Is it a single wallet, a multisig or a timelock with a delay?

  5. 5 STEP 05

    Read events and simulate

    Scan recent events for upgrades, role changes and pauses, and simulate your own transaction in a tool such as Tenderly before signing.

Security checks: admin keys, timelocks and audits

Most large losses in DeFi are not exotic math bugs; they are keys. So after you have resolved the proxy, look at who holds power. Call owner(), check roles such as DEFAULT_ADMIN_ROLE, MINTER_ROLE or PAUSER_ROLE, and find the proxy admin. Then open each of those addresses. An externally owned account means one private key can change the system. A Safe multisig is better, and its page shows the signer threshold, such as 4 of 7. A timelock contract is better still: changes must be queued and wait a public delay, often 24 to 48 hours or more, before they execute, giving users time to exit. You can see queued operations as events on the timelock’s own page.

Audits are the next layer. An audit report should name the exact commit or contract addresses it reviewed; compare that with what is deployed, because audited code that was later changed is unaudited code. Check that the report comes from the auditor’s own site, not only from the project. A bug bounty and a public incident history are further signals. None of these makes a contract risk-free, which is why the size of your position should always reflect how much you can afford to lose.

Going deeper: Tenderly, Phalcon and trace explorers

A standard explorer shows the top-level call and the events. Complex transactions, such as flash loans, multi-hop swaps and exploits, happen in internal calls that you only see in a trace. Tenderly replays any transaction with a full call tree, state changes and a line-by-line debugger, and it can simulate a transaction you have not sent yet, which is the single best habit before signing something large. Phalcon Explorer by BlockSec focuses on invocation flow, fund flow and balance changes, and security researchers use it heavily to reconstruct attacks. Both are compared with other options in our Etherscan alternatives roundup.

For everyday checks you will still live on Etherscan or Blockscout. Etherscan has the largest pool of verified contracts and labels, and its review covers the contract tools in depth. Blockscout is self-hostable with a keyless API, useful when you want to automate checks, as our explorer API guide explains. And for a quick first look at any address, whether it is a contract, verified or a proxy, our free Ethereum explorer answers in seconds.

Habits that make contract pages easy to read

Start every check with the address, never the name. Read the proxy’s implementation, not the proxy. Treat Similar Match and missing verification as reasons to slow down. Look at the Events tab for the last few weeks before you look at the code, because recent changes are where surprises hide. And when a transaction is complex or valuable, simulate it first. With those habits, a smart contract explorer stops being a wall of hex and becomes the most honest documentation any protocol has.

Frequently asked questions

01

What is an Ethereum smart contract explorer?

It is the contract view of a block explorer: source code, ABI, Read and Write tabs, events, bytecode, the creator and the creation transaction for any contract address. Etherscan and Blockscout both offer it, and our live explorer shows whether a contract is verified or a proxy.
02

What does “verified contract” mean on Etherscan?

The explorer compiled the source code the author submitted, with the same compiler version and settings, and got the bytecode that is deployed at that address. It proves the code you read is the code that runs. It does not prove the code is safe or honest.
03

What is the difference between a Sourcify exact match and a match?

An exact match (formerly “full” or “perfect”) means the recompiled bytecode is identical including the metadata hash, so even comments and file names match. A match (formerly “partial”) means the executable code is identical but the metadata differs, for example in comments or variable names. Both prove the logic.
04

How do I find the implementation of a proxy contract?

Explorers detect standard proxies and show the implementation address with “Read as Proxy” and “Write as Proxy” tabs. For EIP-1967 proxies the address is stored in slot 0x3608…2bbc, and each upgrade emits an Upgraded(address) event you can see in the logs.
05

Is it safe to use the Write Contract tab?

It is as safe as the transaction you sign. The tab connects your wallet and sends a real transaction to the contract, so a wrong parameter can lose funds. Use it only on contracts you trust, double-check units (most tokens use 18 decimals) and simulate first when the amount matters.

Keep exploring