How to Verify a Smart Contract Before Signing

How to verify a smart contract before approving a transaction: Etherscan source verification, function decoding, and simulation tools.

What you'll need (prerequisites)

• Self-custodial wallet
• A second device for verification
• Block explorer (Etherscan, Solscan, etc.) familiarity

Step-by-step

1. Step 1: Why contract verification matters

   A verified contract is one whose human-readable Solidity source has been published and compiled to match the exact bytecode deployed on-chain. Verification lets you and auditors actually read what a contract does before you approve or sign. An unverified contract is opaque bytecode, meaning you are trusting it blind, which is a major red flag for anything that will hold your funds.

2. Step 2: Check the verified status on the block explorer

   Look the contract address up on the relevant block explorer (Etherscan, Basescan, Arbiscan, and so on) and open the Contract tab. A green checkmark and a Contract Source Code Verified banner mean the published source matches the deployed bytecode. If the tab shows only raw bytecode with no source, treat it as unverified and proceed with strong caution.

3. Step 3: Read the source and detect a proxy

   Skim the verified source for owner powers such as mint, pause, blacklist, or arbitrary withdrawal functions. Many contracts are proxies: Etherscan shows a This contract is a proxy banner plus Read as Proxy and Write as Proxy tabs that point to the implementation contract holding the real logic. Always open and read that implementation too, since a proxy can be upgraded to entirely new code.

4. Step 4: Confirm the official address and check for audits

   Get the contract address from the project's OFFICIAL site or documentation — never from a random link, ad, or DM — because scammers deploy fake-token clones with identical names and tickers. Cross-check the address on the explorer's token page and look for published audits from reputable firms. A verified contract at the wrong, impostor address is still a scam.

5. Step 5: Sanity-check permissions with tooling

   Use the explorer's Read Contract and Write Contract tabs to inspect owner, paused, and allowance values directly. For unverified or obfuscated contracts, a decompiler like Dedaub (app.dedaub.com/decompile) reconstructs readable logic from bytecode, while token-safety scanners such as GoPlus or Token Sniffer flag honeypot and high-tax patterns. Simulating the transaction in your wallet or Tenderly previews exactly what it will do before you sign.

6. Step 6: Decide before you sign

   Verified plus audited plus a confirmed official address dramatically lowers risk, but it is never a guarantee — audits miss bugs and upgradeable contracts can change after review. Unverified, opaque, or upgrade-heavy contracts with broad owner powers warrant strong caution or walking away entirely. When in doubt, do not sign; no yield is worth handing an unknown contract control of your wallet.

Common errors and fixes

• Approval can't be revoked due to insufficient gas. Revoke transactions cost the same gas as a normal token transfer. Top up the wallet with a small amount of native gas token before revoking.
• Funds already drained. On-chain theft is generally irreversible. Document everything, file police / IC3 / Chainalysis Reactor reports, and contact the protocol team if a known exploit. CEX-side funds may be recoverable if the attacker on-ramped to a regulated exchange.
• Suspected key leak but no losses yet. Move all funds immediately to a freshly created wallet. Burn the old seed. Audit every device the seed touched (browser extensions, cloud backups, email).
• Cannot identify the malicious contract. Use Etherscan's "advanced filter" to filter by token approvals and unusual contract calls. Run the suspicious tx through Tenderly to decode the call.
• Phishing email looks real. Always verify by typing the URL manually. Real exchanges and protocols never email asking for seed phrase, password, or 2FA codes — full stop.

FAQ