The one-sentence version
Issuing a token on Ethereum takes only a few minutes and a small amount of gas fees; names and icons can be anything you want. This has led to three common types of scams: Fake Tokens (the name is USDT, but the contract address belongs to a scammer), Honeypots (the contract contains logic that allows only specific addresses to sell, meaning you can buy but cannot sell), and Rug Pulls (the project team withdraws liquidity and runs away). The key to identifying them is not looking at the name or the price, but looking at the contract address, the permissions within the contract code, and simulating a sell transaction before buying.
This article has three layers:
- Layer 1: The Intuition: A shop with an entrance but no exit
- Layer 2: Real-World Use: Squid Game tokens, airdropped fake tokens, rug pulls
- Layer 3: Principles and Engineering Key points
Layer 1: The Intuition
1.1 A shop with an entrance but no exit
Imagine a shop with a sign saying "Hot items, prices rising every day!". You go in and buy something, and indeed, the price is rising. But when you try to sell it back, the counter says, "System maintenance, buybacks suspended." You later discover: this shop was designed with only an entrance from the very beginning.
Honeypot tokens work exactly like this:
- Buying works normally;
- The price keeps rising because people can only buy and no one can sell, attracting more people;
- Only the project team's address can sell, allowing them to eventually sweep all the money out of the pool at once.
1.2 Fake Tokens
Suddenly, you have 1,000 "USDT" in your wallet. Don't get excited: anyone can deploy a contract named USDT and "airdrop" it to thousands of addresses. They are worthless, and their purpose is usually to:
- Induce you to go to a certain website to "swap" or "claim," where they trick you into signing an authorization (see "Unlimited Authorization");
- Mix into your transaction history to facilitate address poisoning.
Layer 2: Real-World Use
- Squid Game Token (2021): Issued using the fame of the popular series, the price rose tens of thousands of times within a few days. Buyers discovered they could not sell (due to restrictions in the contract), after which the project team withdrew the liquidity, the price went to zero, and the website and social media accounts vanished.
- Airdropped Fake Tokens: Almost every active address has received them. Common names include well-known stablecoins, tokens of famous projects, or even just a URL ("Visit xxx to claim rewards").
- Rug Pull: The project team holds the majority share of the liquidity pool, or the contract retains permissions such as "arbitrary minting," "changing fees to 100%," or "blacklisting addresses," allowing them to withdraw liquidity or sell at the opportune moment. On-chain security companies record tens of thousands of such scams every year.
Layer 3: Principles and Engineering
3.1 Common Implementations of Honeypots
| Method | Principle |
|---|---|
| Blacklist / Whitelist | Checks the sender in transfer; if the address is not on the whitelist, the sell transaction will revert |
| Adjustable Fees | The contract owner can set the sell fee to 99% or 100% |
| Sell Limits | Only a very small amount can be sold at a time, or there is a cooldown period |
| Hidden Owner | Appears to have "renounced ownership," but actually retains control through another variable or proxy |
Deceptive balanceOf |
The displayed balance is inconsistent with the actual transferable balance |
| Dependency on External Contracts | Critical logic is placed in an external contract that can be swapped at any time |
3.2 Detection Methods
| Method | Description |
|---|---|
| Verify Contract Address | Only trust the contract address officially announced; tokens with the same name have different addresses on different chains (e.g., native USDC vs. bridged USDC.e on Arbitrum) |
| Token Whitelist | Wallets only display tokens in the whitelist as "real assets" and gray out the rest |
| Simulate Sell | Before buying, use a mainnet fork or eth_call to simulate "buying and then immediately selling" to see if it succeeds and how much you actually receive |
| Read Contract Code | Is the source code verified on the explorer? Are there owner functions like blacklist, setFee, mint, or pause? Who is the owner? |
| Check Liquidity | Are the LP tokens for the liquidity pool locked or burned? Is liquidity concentrated in a few addresses? |
| Check Holder Distribution | Do the top few addresses hold the vast majority of the tokens? |
Third-party "token security detection" services automatically perform most of the checks above, but they can also be bypassed by new methods and should only be used as a reference.
3.3 How Wallets Should Display Tokens
- Default hide unknown tokens and zero-amount transfers, or clearly mark them as "unverified";
- Do not display the price for unknown tokens (scammers can easily manufacture an artificially high "price");
- If a URL appears in the token name or symbol, treat it as suspicious;
- When a user clicks an unknown token, remind them: "Do not visit the website mentioned, and do not sign any authorization."
3.4 Rules for Users
- For tokens from unknown sources: do not touch, do not sell, and do not go to the website mentioned to "claim";
- Simulate a sell transaction before buying a new token;
- Checking the contract address is more important than checking the name;
- The more absurd the price rise and the more urgent the promotion, the more vigilant you should be.
Summary
| Layer | Key points |
|---|---|
| Three types of scams | Fake Tokens (same name, different address), Honeypots (can buy but not sell), Rug Pulls (withdrawing liquidity) |
| Honeypot Principle | Blacklists, adjustable fees, hidden owners, replaceable external logic |
| Detection | Verify address, whitelist, simulate sell, read contract permissions, check liquidity and holdings |
| Wallet | Default hide unknown tokens and do not display their price |