Ethereum token explorer: verify an ERC-20 before you buy

Reading a token page: supply, holders, transfers and decimals

Every serious explorer builds a dedicated page for each token contract it indexes. The layout differs, but the core fields are the same, and each one answers a specific question.

Total supply and decimals

ERC-20 contracts store balances as whole integers. The decimals value tells software where to put the decimal point. Most tokens use 18, like ETH itself. USDT and USDC use 6, so a raw balance of 1000000 means exactly one dollar. When a token page shows an absurd supply such as a quadrillion units, check the decimals before you panic, and when a supply looks tiny, do the same. Then ask whether the supply is fixed or can grow. A fixed-supply token has no mint function in its verified code; a stablecoin, by design, mints and burns constantly as users deposit and redeem.

Holders and holder concentration

The holder count is a rough popularity signal, and it is easy to fake: airdropping dust to 10,000 random addresses costs little now that gas is cheap. The more telling number is concentration. Open the holders tab and look at the top ten. For a mature token you will usually see exchange hot wallets, bridge contracts and liquidity pools near the top, and explorers label many of them. For a new token, if one unlabeled wallet holds 40% of supply, that wallet can crash the price whenever it likes. Also check whether the liquidity pool tokens are locked or burnt; if the deployer holds them, the liquidity can be pulled in one transaction.

Transfers

The transfers tab is the token’s heartbeat. A real token shows a steady stream of transfers between many different addresses, in both directions: people buy and people sell. Scroll back to the first transfers and you also see how the supply was distributed at launch, which is often the most honest document a project ever publishes. Our transaction explorer guide explains how to open any single transfer and read the logs behind it.

Verified contract and token metadata

A green check next to “Contract” means the explorer has compiled the published source code and confirmed that it produces the bytecode that is actually deployed. That is essential, because without source code you are trusting a black box. It is not an endorsement. A scam token can be perfectly verified; verification only means you can read exactly how it scams. Etherscan additionally lets projects submit a logo, website and social links, and it shows a token reputation label such as Suspicious, Spam or Unsafe for tokens flagged by its team and community. Treat a missing label as “no opinion”, never as “safe”.

Owner privileges: mint, blacklist, pause and fee-on-transfer

Once you have the verified code, open the Contract tab and look for what the owner can do. On Etherscan and Blockscout, the Read Contract section shows the current owner() and other role holders, while Write Contract lists every state-changing function. You do not need to be a Solidity developer to spot the dangerous ones by name. The smart contract explorer guide goes deeper into proxies and admin keys; here are the four powers that matter most for a token holder.

Mint. A function such as mint or issue lets the owner create new tokens. For stablecoins that is the whole business model. For a meme token that promised a fixed supply, it is a loaded gun pointed at every holder. Blacklist. Functions like addBlackList or blacklist let the owner freeze specific addresses. Pause. A pause switch stops all transfers at once. Fee-on-transfer. Some contracts skim a percentage of every transfer, and the dangerous version lets the owner raise that percentage later, up to 99% or even 100%.

Here is the part many guides skip: USDT has all four in some form. The verified TetherToken contract includes issue and redeem, addBlackList and destroyBlackFunds, pause, and a setParams function that controls a transfer fee through basisPointsRate and maximumFee. The fee is set to zero, and the code caps it at a low level, but it exists. It even has a deprecate function that can redirect calls to a new contract. USDC takes a different route: its address is a proxy, so Circle can upgrade the logic, and it has separate minter, pauser and blacklister roles. None of this makes the stablecoins scams. It makes them centrally controlled assets, which is what they are. The lesson is that the question is never “does the owner have powers?” but “are the powers bounded, disclosed and held by someone accountable?”

A quick test: check whether owner() returns the zero address. That means ownership was renounced and owner-only functions can no longer be called. It sounds reassuring, but it only helps if the contract has no other admin roles and is not an upgradeable proxy, since a proxy admin can replace the whole logic.

Honeypot signs and fake tokens with the same ticker

A honeypot is a token you can buy but not sell. The code lets transfers from the liquidity pool to your wallet succeed, and makes transfers from your wallet back into the pool fail or lose almost everything to a “tax”. On an explorer the pattern is visible if you look: plenty of buys, practically no successful sells from ordinary wallets, and a contract with a whitelist, a max-transaction limit that only applies to non-owners, or a sell fee that can be changed by the owner. Unverified source code on a freshly launched token with a big marketing push is the biggest warning sign of all.

Explorers show history, not the future, so pair them with a simulator. Services such as Honeypot.is simulate a buy and a sell against the current state and report the effective taxes. A clean result only describes that moment; the owner can flip a switch a minute later if the code allows it.

Fake tickers are a separate problem and they come to you. Scammers send worthless “USDT” tokens, or zero-value transfers of the real USDT, to wallets so that a look-alike address shows up in your history. The goal is address poisoning: you copy the wrong address from your own history next time you send. Etherscan hides zero-value token transfers by default, and wallets increasingly flag spam tokens, but the only reliable defence is to compare the whole address, not the first and last four characters. If a token appeared in your wallet that you never bought, do not try to sell or approve it. Our wallet explorer guide shows how to check and revoke token approvals.

Red flags vs what to check on the token page

Use the table as a short checklist. No single item proves a token is a scam, but three or more red flags on a new token are a very strong reason to walk away.

One honest caveat about the stablecoin row: USDT and USDC would “fail” the blacklist check, and that is fine. Their holders accept an issuer who can freeze addresses under legal orders. What you are really checking is whether the powers match what the project tells you. A community token that claims to be “fully decentralised” while the deployer can mint at will is lying, and the explorer shows it.

Where Etherscan, Blockscout and Ethplorer shine as token explorers

All three will show you supply, holders and transfers. The differences are in the details, and experienced users tend to keep two of them open side by side.

Etherscan has the richest token pages on Ethereum: holder charts, token reputation labels, project-submitted metadata, a built-in token approval checker and the most complete set of labeled addresses, which makes the holders tab far easier to interpret. For verifying a popular token, it is the default for good reason. The downside is that its API requires a key and its free tier has become stricter over 2025 and 2026. Our Etherscan review covers those limits.

Blockscout, the self-hostable explorer running at eth.blockscout.com, shows the same core token data with a clean interface and a token transfers view that decodes ERC-20, ERC-721 and ERC-1155 movements together. Its API works without a key, which is why our own tool uses it. It is the better choice when you want to script token checks or cross-verify what Etherscan shows. Details are in the Blockscout review.

Ethplorer was built around tokens from the start. Its strength is the wallet view: every ERC-20 in an address with prices, historical value and a clear token-by-token history, which makes it the easiest way to audit a portfolio or trace how a holder accumulated a position. For contract-level work it is less deep. The Ethplorer review explains where it fits.

If you just need the essentials, our free Ethereum explorer shows a token’s price, holders, supply and recent transfers with no account, and links straight to both Etherscan and Blockscout for the deeper checks. Developers who want to automate any of this should read the explorer API comparison first.

A two-minute routine before every token purchase

Put it together and the routine is short. Get the address from the issuer and confirm it on CoinGecko. Paste it into an explorer and check that the name, decimals and supply make sense. Open the holders tab and look at who owns the top of the list. Scroll the transfers for two-way trading. Open the contract, confirm it is verified, and scan the write functions for mint, blacklist, pause and fee setters, then check who the owner is. If the token is brand new, run a honeypot simulation. And if any step leaves you uneasy, the cheapest decision in crypto is not to buy.

None of this requires paid tools, only the habit of trusting addresses over names. That habit alone would prevent a large share of token losses reported every year.