Token Scanner

Pick a network, paste a token address and scan it. The result combines an on-chain read, Etherscan verification and GoPlus token security signals, states which providers answered, and gives a risk level only when there is enough data. The Security Analysis Archive keeps saved analyses separate from new scans.

Illustration: a token disc read by scan rings, with mint, pause, owner and blacklist modules around it, one flagged

A scan queries the connected providers (RPC node, Etherscan, GoPlus) for the address you enter. Nothing is filled in when a provider is missing or fails.

No token scanned yet

Choose a network, paste a token contract address and select Scan Token.

Method

What a scan reads

Provider keys and RPC URLs stay on the server. Each visitor is limited to ten scans a minute, identical scans within ten minutes reuse the stored result, and every result lists the providers consulted and how each call ended. Privilege detection matches 28 known function signatures.

01
RPC: eth_getCode, eth_call
Confirms contract code exists, then reads name(), symbol(), decimals(), totalSupply() and owner(). An address without code is reported as “Contract not found”, with no risk level.
02
RPC: eth_getStorageAt
Reads the EIP-1967 implementation, admin and beacon slots and EIP-1167 minimal proxies, then walks the implementation bytecode for privileged function selectors.
03
Etherscan V2: getsourcecode
Source verification, contract name, compiler, optimisation, ABI and the proxy implementation Etherscan reports, for the token and its implementation.
04
GoPlus: token_security
Honeypot and sell simulation, buy and sell tax, hidden owner, holder concentration, DEX liquidity, LP locks and reputation flags. Solana mints use the GoPlus Solana endpoint.

How to read a result

“Not available” means no provider returned that check. It is never counted as a pass, and it lowers completeness and confidence.
Without an on-chain read or a GoPlus record the result is “Insufficient Data”: no risk level is guessed.
Fee caps and blacklist logic can sit in code paths that selectors and provider flags do not reveal; detected setters are flagged for review.
A scan is an automated check of public data, not a security audit: tokens can hide privileged behaviour behind generic functions or external modules.

Technical references

Launching a token?

A research assessment reviews ownership, upgrade paths and economic controls before holders depend on them.

Discuss Your Security Requirements Address Intelligence