How to Read a Contract on Etherscan

You should never sign a transaction from a wallet without at least glancing at what the contract is. Etherscan gives you everything you need to do that in under 30 seconds. Here is what to actually look at.

The Contract tab

Search the address on etherscan.io. If you see a green checkmark next to "Contract Source Code Verified," someone has uploaded the exact Solidity that was compiled to the bytecode on-chain. If it is unverified, close the tab and walk away from whatever wanted you to sign that.

Read Contract

Lists every view function on the contract. No gas, no signature, just reads. For any ERC-20, check totalSupply, owner, paused. For any DeFi pool, check balances, reserves, fee. If you see functions like blacklisted or maxTxAmount, that token can rug you.

Write Contract

Every state-changing function. Connect wallet, expand the function, see the parameters. This is where you would actually call something if the frontend was down. Also where you spot suspicious functions: mint on a token that claimed to be capped, rescueTokens on a vault that claimed to be trustless.

Proxy contracts

Most modern DeFi lives behind a proxy. You interact with a proxy address, but the logic sits in an implementation contract that the proxy delegates to. On Etherscan, you'll see "This contract is a proxy that uses implementation contract 0x...". Click through to the implementation to read the real logic. Whoever controls proxy upgrades controls everything.

Red flags in 30 seconds

• Unverified source.
• Owner is an EOA, not a multisig or timelock.
• mint exists on a token that markets itself as fixed-supply.
• Blacklist / pause / setTaxes / setFees functions with no timelock.
• Recent deploy (days old) claiming years of history.
• Contract balance holds most of the token supply.

Green flags

• Verified source, matches a known audit.
• Owner is a Gnosis Safe with multiple sigs.
• Timelock on all admin functions.
• Proxy admin is a multisig, not a hot key.
• Well-known token contract addresses (WETH, USDC) referenced correctly.

The one thing worth memorizing

Almost every rug pull leaves fingerprints on Etherscan before the frontend breaks. Take 30 seconds. Read the contract.