How to read a token security scan: mint, proxy, taxes, owner rights

What a token security scan is

A token security scan reads the smart contract behind a token and reports what that contract allows its owner to do. Can new tokens be created after launch? Can the logic be swapped out? Does the contract take a cut on every trade? Who holds the supply? The scan does not read the whitepaper, the team page or the Telegram group. It reads code and on-chain state, and that is exactly why it is useful: code cannot be spun.

CoinVett's Token Safety Check pulls this data from GoPlus Security for any ERC-20 or BEP-20 contract and sorts it into three groups: contract security, trading security and ownership. Every line gets one of three marks, OK, Warning or Info, and nothing is added up. The trust score and the Safe/Caution/Risky/Danger badge are a different thing: they appear on the coin pages of tokens CoinVett already tracks, built from the same GoPlus signals but with fixed point deductions. The two surfaces do not always agree, so they get separate treatment below. One thing first, because it decides how you read everything else: the scan checks the contract, not the project. A result without warnings says none of the signals that were checked fired. It says nothing about whether the product works or whether the token will be worth anything next year.

Contract security: what the owner can still change

This group answers one question: is the contract you are looking at today the contract you will be dealing with tomorrow?

Verified source code

When a developer deploys a contract, only the compiled bytecode lands on-chain. Nobody can read that. Verifying the source means uploading the human-readable Solidity to a block explorer, which recompiles it and confirms the result matches the deployed bytecode. Unverified code is not proof of anything bad, but it means nobody outside the team can check what the contract does. For a token that wants your money, that alone is a reason to stop. Almost every serious project verifies on day one; it takes ten minutes.

Proxy contract

A proxy is a thin contract that forwards every call to a second contract holding the actual logic. The owner can point the proxy at a new logic contract at any time. The token address you hold stays the same; what it does can change completely. Upgradeable proxies are standard practice for large protocols that need to fix bugs (USDC, for example, is a proxy). For an anonymous memecoin, the same pattern means today's scan describes today's logic and nothing more. On the Token Safety Check a proxy shows as a Warning. In the coin-page trust score it costs 15 points, deliberately mild: the pattern is a risk multiplier, not a verdict.

Mint function

A mint function lets an authorised address create new tokens out of nothing. If the owner can mint, the owner can dilute every holder at will, or mint a billion tokens and dump them into the liquidity pool. On the Token Safety Check an active mint function is always a Warning, whatever the token. The coin-page trust score treats it as one of the heaviest signals, 30 points off, with one deliberate exception. Fiat-backed stablecoins such as USDT and USDC must be mintable, because new units are issued every time someone deposits dollars with the issuer. For those coins the coin page marks the mint line as an informational note and takes nothing off. The Token Safety Check does not know this exception: paste the USDT contract there and the mint line reads Warning, which is correct at its level, because the contract can mint. The scan checks the contract, not the reserve backing, and a mint function on a stablecoin is not a red flag but the business model.

Owner rights: blacklist, hidden owner, modifiable balances, retrievable ownership, transfer pause, modifiable tax, trading cooldown

Seven more things a contract owner can be allowed to do, and both surfaces read them from the GoPlus response. Four of them are about who holds the keys. A blacklist function lets the owner block specific addresses from transferring; USDT has one and uses it against sanctioned wallets, a memecoin uses it against anyone who tries to sell. A hidden owner means the contract claims ownership was renounced while another address keeps the privileges through a second route, so the "renounced" line on a block explorer is worth nothing. Retrievable ownership is the quieter cousin: ownership was handed over, but a function lets the owner take it back. Modifiable balances is the bluntest of the four: a function that lets the owner rewrite what any wallet holds. The other three are about what the owner can do to trading itself. A transfer pause lets the owner halt every transfer of the token; while paused, nobody can sell, whatever the reason for the pause. Modifiable tax means the owner can change the buy and sell tax after launch, so the tax you see is the tax for now. A trading cooldown forces a minimum wait between two trades from the same wallet, an anti-bot pattern that serious launches use too. Transfer pause and modifiable tax are the two control rights the trust score puts under its data cap; the cooldown is scored, but sits outside it. On the Token Safety Check the seven appear as separate lines in the ownership group: Warning when the flag is set, OK when GoPlus reports it as absent, Info when GoPlus did not report the field at all. An eighth line in that group, the per-address tax, sits outside the score entirely. It tells you whether the owner can hand one specific wallet its own tax rate, which, set high enough, stops that one address from selling while everyone else trades on. The trust score does not read it; the check shows it so you can.

The coin-page trust score weighs them heavily. Modifiable balances cost 40 points, more than any other single signal short of a honeypot; a hidden owner and a transfer pause 30 each, the same as an active mint function; retrievable ownership, a blacklist function and a modifiable tax 25 each. Any one of those six alone takes a token from 100 to below the Safe line. A worked case: a token with verified code, no mint, no proxy, ten wallets holding 60 percent of the supply and nothing else wrong scores 85, Safe. Flip the transfer-pause flag on and it scores 55, Caution, with the pause named in the owner-rights row. The trading cooldown is the odd one out at 10 points, the only owner right that does not push a token below Safe on its own: 90 on an otherwise clean contract, the same weight as a buy tax between 5 and 10 percent. It is mild for a reason. GoPlus notes that a cooldown can trip its own trade simulation, so a token with a cooldown may come back with a sell tax of 100 percent that is not really there. The sell-tax line then costs 25 points on top, and a token with nothing else wrong lands at 65, Caution. If you see a cooldown Warning next to a sell tax of 100 percent, that pairing is worth a look on a block explorer before you take the tax figure at face value. The stablecoin exception is the same as for the mint function: on fiat-backed stablecoins such as USDT and USDC, freezing and blacklisting addresses, pausing transfers and adjusting fees is how the issuer meets its compliance obligations, so the coin page shows an informational note about issuer controls and takes nothing off. The Token Safety Check applies no such exception and marks USDT's blacklist and transfer pause as Warnings, which is correct at its level.

Trading security: what happens when you buy and sell

Honeypot simulation

The scanner simulates a buy and a sell against the live contract. If the buy goes through and the sell fails or is taxed to nothing, the token is flagged as a honeypot. That is the single hardest signal in the report: a Warning on the Token Safety Check, and on the coin page a detected honeypot takes the trust score to zero, full stop. How honeypots are built, the SQUID case and the five contract patterns to look for are covered in our blog post on how to check if a token is a honeypot, so this guide does not repeat them.

Buy tax and sell tax

Many tokens charge a fee on every trade, coded into the transfer function. The scan shows both directions separately, and the asymmetry is what matters. A 2 percent tax on buys and sells funds a marketing wallet; annoying, but common. A 0 percent buy tax with a 35 percent sell tax is a honeypot in slow motion: cheap in, expensive out. The two surfaces draw the line in different places. The Token Safety Check marks a tax as a Warning only above 10 percent; anything up to that is OK. The coin-page trust score deducts 10 points for a tax between 5 and 10 percent and 25 points above 10 percent, in each direction independently, so a token that is punitive both ways loses 50 points on taxes alone. An 8 percent sell tax therefore passes as OK on the check and costs 10 points on the coin page. Read the percentage, not the colour. Two caveats. Some contracts let the owner change the tax after launch; that is the modifiable-tax line among the owner rights above, and where it is set, the tax you see is the tax for now. And if GoPlus reports no tax at all (an empty field, not a zero), the coin page treats it as a gap that caps the score; see the table below.

Ownership: who actually holds the supply

Holder count

The number of addresses that hold at least one unit of the token. Under 100 holders means the token has essentially no distribution; whoever launched it still controls the market. Under 1,000 is thin. On the Token Safety Check this line is Info only, never a Warning; the coin-page trust score deducts 20 points below 100 holders and 10 below 1,000. Holder count is easy to inflate with airdrops to random wallets, so read it together with the next line rather than on its own.

Top 10 holder share

How much of the supply the ten largest addresses control. Above 50 percent, a handful of wallets can crash the price by selling; above 80 percent, the token is a private club. The Token Safety Check warns above 50 percent; the coin-page score deducts 15 points above 50 and 30 above 80. Watch for false alarms: for a token with a locked liquidity pool, the pool contract itself is usually the largest holder, and a burn address or a vesting contract can sit in the top ten without anyone being able to sell from it. The raw number does not distinguish between a whale and a lock; you have to look at the addresses on a block explorer.

Locked liquidity

On a decentralised exchange, trading happens against a liquidity pool that someone funded. If the person who funded it can withdraw the pool at any time, they can pull the rug: remove the liquidity, and the token becomes unsellable. Locking the LP tokens in a time-lock contract or sending them to a burn address removes that option. The Token Safety Check reports what share of the pool's LP tokens is locked or burned. Below 50 percent is a Warning. If GoPlus reports no LP holder data, the line shows Info with a note that nothing was reported, not zero and not green. This line exists only on the check; it does not feed into the coin-page trust score below. Read it on its own.

How the CoinVett trust score is calculated

On coin pages, in the market table and in the compare view you will see a badge: Safe, Caution, Risky or Danger. This is the second surface, and it only exists for coins CoinVett tracks. It is built from the same GoPlus signals the Token Safety Check shows line by line, as a simple subtraction from 100, and the rules are public. The check itself never shows a score. The coin page shows a score and a badge, and its detail rows carry their own icons rather than the check's OK/Warning/Info marks.

80 and above is labelled Safe, 50 to 79 Caution, 20 to 49 Risky, below 20 Danger. Hold the thresholds against the table and the top label loses its glow. Safe starts at 80, and several single deductions leave a token there: ten wallets holding 61 percent of the supply, 85, Safe. An 8 percent buy tax, 90, Safe. A proxy on its own costs 15 points, which on paper would leave 85; in practice GoPlus rarely reports the owner and mint fields for a proxy contract, so most proxies sit at the data cap of 75 instead. Unverified source code costs 20 points, which on paper would still leave 80, but that case never gets there either: GoPlus returns none of the other risk fields for a closed-source contract, so the token hits the data cap at 75 anyway. The signals that push a token below 80 by themselves are the heavy ones: a honeypot, any of the four owner rights, a transfer-pause switch, a modifiable tax, an active mint function, a buy or sell tax above 10 percent, or ten wallets holding more than 80 percent of the supply. So Safe does not mean the contract passed every check. It means the known signals, added up, cost fewer than 21 points, and that ten specific fields were actually reported: the honeypot simulation, the mint check, the four owner rights, the transfer-pause and modifiable-tax checks, and the buy and sell tax. That second part is the cap in the last two rows: if GoPlus left any of those ten blank, the score is capped at 75 and the badge reads Caution at best, however clean the rest looks. Holder data, proxy, source code and the trading cooldown sit outside the cap: no points off when missing. Fiat-backed stablecoins are exempt from the mint, owner-rights, control-rights and tax part of the cap, because those rights are documented issuer design there; the honeypot cap applies to them like to everyone else. The low labels usually come from combinations, which is how real rug pulls look (a proxy plus an active mint plus concentrated holders), and that is what the score is built to catch. What it is not built to be is a guarantee.

The label names are blunt on purpose, so read them narrowly. A Safe badge means "the signals in the last scan added up to 80 or more, and the fields under the cap were reported", nothing more; for a fiat-backed stablecoin that cap shrinks to the honeypot simulation alone. The badge can sit on a token where ten wallets hold 61 percent of the supply, or on one that charges an 8 percent buy tax. A Danger badge means the score landed below 20, and that does not take several red flags at once: one detected honeypot subtracts 100 on its own. Neither is a recommendation for or against anything, and neither is a statement about price.

Unknown is not green

GoPlus does not return every field for every contract. Very new tokens, exotic chains and contracts with unusual structures come back with gaps. On the Token Safety Check those gaps show as Info with the note that no data was reported; a missing honeypot simulation is never rendered as a green OK. This matters more than it sounds: a scanner that silently treats "no data" as "no problem" produces green results for exactly the tokens that deserve the most scrutiny, the ones launched an hour ago. When you see Info on the honeypot line or the liquidity line, treat the token as unchecked.

The coin-page trust score handles gaps in two tiers. A missing field costs no points, because the score only subtracts for what it can see. But for the fields that decide sellability and control it refuses to say Safe without evidence: if GoPlus did not report the honeypot simulation, the mint check, one of the four owner-rights fields, the transfer-pause or modifiable-tax check, or either of the two tax figures, the score is capped at 75, Caution at best, and the coin page shows a note naming the missing data. Proxy, source-code, holder and cooldown gaps do not trigger the cap; they simply cost nothing. Fiat-backed stablecoins are exempt from every part of the rule except the honeypot part. So on any token that is not a fiat-backed stablecoin, a Safe badge tells you two things: those ten fields were reported, and whatever the scan found in them cost 20 points at most. Reported is not the same as clean: an 8 percent buy and sell tax shows up as two findings and still comes out at 80, Safe. On USDT or USDC the badge only vouches for the honeypot simulation, because the mint and owner-rights lines are read as issuer design there whatever they say, and a missing tax figure is not held against the issuer either. A Caution badge on an otherwise spotless token may just mean GoPlus left one of the ten blank. A Caution badge on a token that only lacks its tax figures is exactly this case: GoPlus could not measure the fee, so the page does not vouch for it. The note under the badge tells you which. If a coin matters to you, run its contract through the Token Safety Check as well and look for Info marks in the trading and ownership groups.

What the scan cannot see

• Intent. A contract with an active mint function might belong to a legitimate project that simply has not renounced yet, or to a scam waiting for volume. The code looks identical.
• Off-chain promises. "Liquidity will be locked next week" is not on-chain until it is.
• Future upgrades. If the contract is a proxy, the next version has not been written yet.
• The product. A perfectly clean contract can belong to a project with no users, no revenue and no plan. Contract safety and project quality are different questions.
• Native coins. BTC, ETH and SOL have no token contract. The scan covers ERC-20 and BEP-20 tokens by direct address; for coins already in CoinVett's database, Polygon and Arbitrum contracts may appear too.

Reading a scan in practice: four examples

Example one. Verified source, no proxy, no mint, all seven owner-rights fields reported as absent, the per-address tax reported as absent as well, honeypot simulation clean, 1 percent tax each way, 40,000 holders, top 10 at 22 percent, 100 percent of liquidity locked. On the check, nothing but OK and Info marks. On a coin page, score 100, label Safe, and no cap because all ten capped fields were reported. This is what an established DEX token looks like on paper. It tells you that none of the fifteen scored signals fired. It does not tell you the contract is harmless: GoPlus reports fields the score does not read, an anti-whale limit or a per-address tax for instance, and none of them moves the score. The anti-whale limit does not appear on the check either; the per-address tax does, but only as its own line. Whether the token is worth holding is a separate question the scan does not address either.

Example two. Verified source, proxy, mint active, 0 percent tax, 800 holders, top 10 at 61 percent, liquidity unknown. Score 100 − 15 − 30 − 10 − 15 = 30, label Risky. Nothing here is a smoking gun on its own. Together they describe a token where one party can change the rules, print supply and sells into a market it dominates. Three days after launch, this is the profile of most tokens that later go to zero.

Example three. USDT on Ethereum, and two different readings depending on where you look. On the Tether coin page the mint line carries an informational note instead of a warning and the trust score takes nothing off, because Tether is a fiat-backed stablecoin and issuing new units is its business model. The same goes for its blacklist function, its transfer-pause switch, its modifiable tax and the owner's right to rewrite wallet balances: the coin page lists all of them under issuer controls, as information, without a deduction. Paste the same contract into the Token Safety Check and the mint line reads Warning, and so do the blacklist, transfer-pause, modifiable-tax and balance lines: the check does not know what a stablecoin is, it sees a contract that can mint, freeze addresses, halt transfers, change its fee and change balances, and it says so. Both are right at their level. If the coin page treated USDT's mint function, blacklist, transfer pause, modifiable tax and balance control like a memecoin's, the most-used token in crypto would lose 150 points on those five lines alone (30, 25, 30, 25 and 40) and land at Danger, which would tell you the scoring is broken, not that USDT is dangerous. The other lines are read exactly as for any other token.

Example four, the Safe that is not clean. Verified source code, no proxy, no mint, all seven owner-rights fields reported as absent, honeypot simulation clean, 0 percent tax each way, 12,000 holders, top 10 at 64 percent. Score 100 − 15 = 85, label Safe. Ten wallets hold close to two thirds of the supply, and the badge is green. If those addresses can sell freely, they can move the price at will; if they are locks, nobody can sell from them, and the same 64 percent means something else entirely. Remember this one whenever the label looks reassuring: the score counts what it knows, and concentrated holders cost exactly 15 points, too few to flip the badge. Add one more signal, say an 8 percent buy tax, and the same token drops to 75, Caution. On the Token Safety Check the same contract shows a yellow Warning on the top 10 holder line and no score at all, and you would notice. The profile is not made up: among established tokens the top 10 is often a mix of exchange wallets, treasury wallets, vesting contracts and burn addresses, and only some of those can ever sell. The score cannot tell them apart; a look at the addresses on a block explorer can. Unverified source code, by the way, cannot produce this picture, and neither can most proxy contracts: GoPlus returns none of the other risk fields for a closed-source contract and rarely the owner and mint fields for a proxy, so both hit the data cap at 75 before their own deduction even comes into play.

Run any of these yourself: paste an address into the Token Safety Check, pick the chain, read top to bottom. Trading security first, then contract security, then ownership. A Warning or an Info mark in the trading group ends the exercise.

Frequently asked questions

Is a "Safe" label a reason to buy?

No. The label is a number: the known signals from the last scan, subtracted from 100, landed at 80 or above. That is compatible with an 8 percent buy tax or ten wallets holding 61 percent of the supply, as long as only one of them applies. It does not evaluate the project, the team, the market or the price, and CoinVett does not provide buy or sell recommendations.

Why does a legitimate token get a warning?

Usually because of a proxy or a mint function that the team has not renounced, because a vesting contract sits in the top 10 holders, or because the contract can pause transfers, a right many centrally run tokens keep for emergencies; the scan reports the right, not the intent. The warning is correct: those patterns exist. Whether they are a problem depends on who controls them, which is a question for the block explorer, not the scan.

Where does the data come from?

GoPlus Security, an on-chain security data provider that simulates trades and reads contract permissions for Ethereum and BNB Smart Chain tokens. Coins CoinVett already tracks are refreshed from its database; unknown addresses are scanned live and cached for 24 hours. The data source is shown on every result.

How often should I re-scan a token?

Before every purchase, and after any announced contract upgrade. A proxy token can change its logic between two scans; a team can renounce ownership or lock liquidity after launch. The result you saved last week describes last week's contract.

Notice: Security signals describe on-chain contract behaviour, not the quality or prospects of a project. Nothing on this page is investment advice.

Related guides

• How to check if a token is a honeypot
• How to recognize crypto scams
• Crypto security guide
• What are altcoins?