Someone drops a contract address in a group chat. The chart looks alive. The site looks polished. Your wallet is one approve away from finding out whether you can actually sell.
Nothing here is financial advice; it’s a risk-triage checklist. “Is this safe?” is the wrong question if you expect a guarantee. The useful question is: what does a cheap, automated pass/fail look like before I size a position or sign an approval? Here’s what to check, what each check actually catches, and where automated scans fall short.
The Checks That Matter (and What Each Catches)
Honeypot / sell simulation
The nastiest scam: you can buy the token but the contract blocks selling for everyone except the deployer. A simulation runs a buy-then-sell in a fork and reports whether the sell succeeds, and at what tax. If a buy goes through but the simulated sell reverts, that’s a honeypot. Walk away.
Buy/sell tax
Some tokens skim a percentage on every trade. A 5% tax is a design choice; a 40% sell tax (or one the owner can raise to 100% after you buy) is a slow-motion rug. Check both the current tax and whether the owner can change it.
Liquidity depth and lock
Can you exit without collapsing the pool? Thin liquidity means your own sell tanks the price. Worse is unlocked liquidity: if the LP tokens aren’t locked or burned, the deployer can pull the entire pool (the classic “rug pull”) and leave you holding a token with nothing to sell it against.
Holder concentration
If one or two wallets (that aren’t the locked LP or a known bridge) hold most of the supply, they can dump the float on you at any moment. Widely distributed supply is safer than a chart that looks great because nobody has sold yet.
Contract permissions
Read what the owner can do: mint new supply, pause transfers, blacklist addresses, or modify tax. A renounced owner can’t rug via these; an owner who kept mint rights can dilute you to zero.
Basic ERC-20 sanity
Is it even a standard token contract, or a look-alike with a modified transfer function? A verified source on the block explorer is table stakes; unverified contracts hide their logic for a reason.
$1 contract scan (Base)
Contract risk scanner runs those checks and returns a 0–100 risk score, a SAFE / CAUTION / AVOID-style verdict, and a table (honeypot, taxes, liquidity, holders, permissions). Humans pay $1 with a card; agents call the same POST /v1/contract-scan endpoint over x402 when they hit an unknown token mid-flow and need a structured verdict, not a browser tab.
The approve Trap Nobody Warns You About
Even a legitimate token can drain you through approvals. When you approve a dapp to spend your tokens, many request an unlimited allowance. If that dapp (or a contract it trusts) is later compromised, the attacker can move your full balance, no further signature needed. Two habits: approve only the amount you’re actually transacting, and periodically revoke stale allowances with a tool like Revoke.cash or your wallet’s built-in allowance manager.
How Agents Change the Workflow
A trading or research agent can’t open ten browser tabs and eyeball a chart. It can hit a paid endpoint, get a structured JSON risk object, and branch on it: proceed, flag, or refuse. That’s why this utility is dual-rail: card for people, HTTP 402 / x402 for machines, so an agent can pay a cent-scale fee to vet a token before it ever signs a transaction.
Limits You Should Expect
Automated scans are a filter, not insurance. Simulators can be fooled by contracts that behave differently under real conditions. Indexers lag, so a brand-new pool may be under-reported. LP and treasury wallets can look like whales. A green check removes the obvious garbage so you can spend real attention on what survives; it does not replace reading the source, knowing the team, or simply refusing tokens you can’t evaluate.
Fast answers
Does a good score mean it’s safe to buy?
No. It means it passed automated checks for known scam patterns. Rug mechanics evolve; treat the score as one input, not a verdict.
What’s the difference between a honeypot and a rug pull?
A honeypot blocks you from selling from the start. A rug pull lets you buy and sell normally until the team removes liquidity or dumps supply. Different mechanisms, same outcome for you.
I have raw calldata, not a token. What does it do?
Decode it first with the ABI decoder ($1) to see the function and arguments before you sign.
How to think about it
Safety on-chain is a stack of imperfect signals: sellability, tax, liquidity lock, holder spread, owner permissions, and the approvals you’ve already signed. Automate the cheap ones so your attention goes to the judgment calls. Start with a $1 scan, and keep the rest of the crypto utilities handy, for agents and humans alike.