How do you check whether a token is the real one?

Anyone can copy a name

Anyone can deploy a smart contract on Ethereum, including scammers.¹ ERC-20 contracts can use the same name and symbol as other contracts. ethereum.org says you cannot count on those fields for security.¹

An explorer just shows what the contract says. Etherscan's token page takes the token's name from the token's own code.² So whoever writes the contract picks the name you see.^1,2

What a fake can copy

ethereum.org studies a fake token called wARB, made to look like the real ARB token.¹ It lists what fakes can copy:

• The name and symbol. Same or nearly the same as the real token's.¹
• The holders. Balances live inside the contract, so its author can give any address any balance. About 16% of wARB sat with the address that deployed the real ARB.¹
• The transfers. The contract produces its own Transfer events, so a scammer can make them show anything.¹

So a long holder list, famous holders or busy transfers prove nothing on their own.¹

What a fake can't copy

ethereum.org's rule is simple: scam tokens cannot use the same contract address.¹ The best source for the real address is the organisation whose token it is, usually on its website.¹

Two more clues it mentions: real tokens usually have plenty of trading liquidity, and Etherscan marks many tokens already reported as scams.¹

Reading a token page

Etherscan's advice is to do your own research before acting on any token, especially when value moves.⁴

Verified source code

A contract runs on the chain as bytecode, which people can hardly read.⁵ Its authors write it in a language such as Solidity, then compile it.⁵

"Verified" means someone uploaded the source code, and the explorer checked that it compiles to the same code that is on the chain.^5,6 This matters because the code a project advertises may differ from what actually runs.⁵

Verified code can be read and checked by anyone, including auditors.^5,6 Blockscout notes that its tools to read and use a contract only work once the contract is verified.⁷

But verified is not the same as safe. Etherscan says plainly that source code verification does not mean a contract is safe to use.⁸ ethereum.org adds a catch: in the common "partial" kind of verification, someone can add misleading comments or variable names.⁵

Who created it

A contract's page also shows its creator: the address that deployed it, and the transaction that did so.^8,9 Don't confuse this with the holder list: in ethereum.org's wARB example, the real ARB deployer held about 16% of the fake only because the fake's author gave it that balance.¹