Intermediate level
Research a token from its contract outward. Confirm the exact address, check what powers remain over the supply and your balance (minting, freezing, upgrades, transfer taxes), read the holder list with pools, exchanges and vesting contracts set aside, measure pool depth against market cap, and turn the unlock schedule into a calendar. Audits and social buzz come last, and none of it tells you whether the price will rise.
Start from the address, never the ticker
A ticker is a label anyone can reuse. Deploying a token with a popular name, symbol and logo costs a few dollars, and copies of anything trending appear within minutes. The only identity a token has is its contract address on EVM chains, or its mint address on Solana, and every check below starts there.
Get the address from a source the project controls, reached from your own bookmark rather than from a reply or a direct message. Then confirm it in two independent places: a data aggregator’s token page, which lists the contract for each chain, and the block explorer itself. A token that exists on several chains has a different address on each, so check the one for the chain you will actually trade on (the guide to living on more than one chain explains why).
Now paste it into the token safety checker for a first pass on liquidity, pair age, authorities and holder concentration. That pass narrows the field quickly. The rest of this guide is how to read what it shows, and how to check the things no automated tool can.
What the contract can still do
A token is a program. The question that matters is which powers over it still exist and who holds them, and the answer looks different on each chain family.
On Solana: authorities and extensions
| Check | What it allows | What you usually want to see |
|---|---|---|
| Mint authority | Creating new tokens at will, diluting every holder | Revoked, or held by a program whose issuance rules are published |
| Freeze authority | Freezing a specific token account so it cannot move or be sold | Revoked, unless the token is a regulated asset that needs it |
| Token-2022 extensions | Extra behavior on the mint: a transfer fee, a transfer hook that runs a program on every transfer, a permanent delegate that can move or burn tokens from any account, new accounts frozen by default, a pause switch | Nothing you cannot explain, and an accountable holder for anything that exists |
| Metadata | Changing the token’s name, symbol and image after launch, if the metadata is mutable | Immutable, or a clear reason it is not |
Context changes the reading. USDC on Solana keeps both a mint authority and a freeze authority, as its mint account shows (checked September 2026), because a regulated issuer has to create supply and act on legal freezes. The same two powers on an anonymous memecoin mean one person can print tokens or stop you from selling. The explorer shows which token program owns a mint. If it is Token-2022, read the extension list carefully, because a permanent delegate is exactly the power to take tokens out of your account. The Token-2022 extension guide describes each one.
On EVM chains: owner, proxy and privileged functions
- Verified source. Unverified code means nobody can read what it does. That ends the research.
- Owner and roles. Read
owner()on the explorer’s read tab and look for role based access control. In the common OpenZeppelin pattern,renounceOwnership()sets the owner to the zero address, which disables the functions restricted to the owner, and only those. - Proxy. If the token is an upgradeable proxy, the code you read today can be replaced tomorrow. ERC-1967 standardized the storage slot that holds the implementation address so explorers can show it. Find out who can upgrade: one key, a multisig or a timelock (see admin keys and timelocks).
- Privileged functions. Search the verified source for
mint,pause,blacklist,setFeeorsetTax,setMaxTx,excludeFromFeeand any switch that enables trading. Each one is a lever somebody can pull. - Transfer taxes. Some tokens take a percentage of every buy or sell, and some let the owner raise it. A sell tax that can be set to 100% is a honeypot waiting to be switched on. Simulate a sell before you buy.
Reading the holder list
"The top ten wallets hold 62%" can describe a healthy token or a trap, because the raw figure mixes very different kinds of address. First set aside the addresses that are not free floating holders:
- Liquidity pools and bonding curves. Tokens in a pool are the market itself. On launchpad tokens the bonding curve contract usually tops the list until the token graduates.
- Exchange wallets. One hot wallet can represent thousands of customers. Explorers label the large ones.
- Vesting, lock and treasury contracts. Not circulating today, but they are the unlock schedule in address form.
- Burn and bridge addresses. Burned tokens are gone. A bridge contract holds tokens that back copies on another chain.
Then look hard at what is left. Here is an illustrative top ten for a token whose circulating supply is 60% of the total:
| Holder | Share of total supply | What it is |
|---|---|---|
| DEX pool | 18.0% | The market. Set aside |
| Vesting contract | 15.0% | Team tokens, not yet circulating. Note the dates |
| Exchange hot wallet | 7.5% | Many customers. Set aside |
| Wallets A, B, C and D | 14.8% combined | All four funded from one address within ten minutes of launch |
| Treasury multisig | 2.8% | Project controlled, and a known future seller |
| Wallets E and F | 4.1% combined | Unrelated individuals, as far as the chain shows |
The headline 62.2% overstates concentration: set aside the pool, the exchange and the vesting contract and 21.7% remains. The cluster understates it: wallets A to D look like four holders and behave like one, with 14.8% of the total supply, about a quarter of everything circulating. That single entity holds more than twice as much as the rest of that 21.7% combined, enough to move the price on its own. The check that finds it is simple: open each large wallet’s first incoming transaction and see who funded it. Cluster visualizers such as Bubblemaps draw these links for you, and the guide to following the money covers the heuristics in depth.
Liquidity depth against market cap
Market cap is the last price multiplied by the circulating supply, and the last price was set by a small trade against a pool. What anyone can actually sell for depends on how deep that pool is.
Take a token at $0.10 with 500 million circulating, a $50 million market cap. Its main pool holds $400,000, split between 2 million tokens and $200,000 of USDC, so liquidity is 0.8% of market cap. Using the constant product math from getting a good fill and ignoring fees:
| You sell | Worth at the quoted price | You receive | Average price vs quote | Pool price afterward |
|---|---|---|---|---|
| 200,000 tokens | $20,000 | About $18,182 | −9.1% | −17.4% |
| 5 million tokens (1% of circulating) | $500,000 | About $142,857 | −71% | −92% |
One percent of the supply cannot leave without wrecking the price, so the $50 million is a number almost nobody could realize. Record the liquidity to market cap ratio and, where a DEX viewer shows it, the depth within 2% of the price. In concentrated liquidity pools the headline pool value can sit far from the current price, so depth near the price is the figure that counts.
Then check who owns the liquidity. Pool tokens that are burned, or locked with a credible locker for a meaningful period, cannot simply be withdrawn. Pool tokens sitting in the deployer’s wallet can be pulled in one transaction, which is the classic rug pull.
Supply: what circulates now and what is coming
The beginner guide to tokenomics explains the four supply numbers. The research step is to turn them into a calendar and compare each date with what the market can absorb. With illustrative numbers:
| Item | Value |
|---|---|
| Price | $0.50 |
| Circulating supply | 200 million, so the market cap is $100 million |
| Total supply | 1 billion, so fully diluted value is $500 million, five times the market cap |
| Next unlock | 50 million tokens: $25 million at today’s price and 25% of circulating supply |
| Average daily volume | $4 million, so the unlock equals about 6.25 days of trading |
| Price if the market cap holds | $0.40, a 20% dilution |
Run your own figures through the unlock and dilution calculator, then ask who is unlocking. Seed investors who paid a cent behave differently from a treasury that pays developers over years. Take the schedule from the project’s docs, cross check it on an unlock tracker (DefiLlama has an unlocks dashboard, and Tokenomist, formerly Token Unlocks, specializes in it), and where you can, read the vesting contract itself, because the contract is what actually releases tokens.
Also test the circulating figure. Team and treasury wallets counted as circulating make the float look larger and the valuation look more complete than it is. The advanced guide to supply analysis models unlocks month by month.
Team, documentation and audits
Read the docs as a skeptic. Good documentation lists the contracts and their addresses, says who holds each admin power, and explains how the token captures value, or admits that it does not. Documentation heavy on roadmap and light on addresses is itself a finding.
For the team, look for a history that existed before this token: previous projects, a code repository with real commit history, public appearances. Pseudonymous teams have built serious protocols, and a pseudonym with years of public work carries a reputation. A brand new identity carries none.
What an audit tells you
Useful evidence
- Qualified reviewers examined a specific version of the code for known classes of bug
- Which findings were fixed, acknowledged or disputed, if you read the report rather than the badge
- That the team paid for scrutiny, which throwaway scam deployments rarely do
What an audit does not prove
Limits worth knowing
- That the deployed contract matches the audited commit. Compare the address or code in the report
- Anything about code changed afterward, including through a proxy upgrade
- That the economics or the key holders are sound. Most audits scope the code, not the people
- That no bugs remain. Audited protocols are exploited regularly
The expert guide to audits, fuzzing and formal verification explains how to read a report properly.
Social signals that mean something
Attention is cheap to manufacture, so weigh each signal by how much it would cost to fake.
| Signal | Means something when | Is noise when |
|---|---|---|
| Onchain usage | Many unrelated addresses pay fees month after month (see reading DeFi dashboards) | It spikes during an incentive campaign and vanishes after |
| Holder count | It grows steadily through quiet markets | It jumps after an airdrop or dust sent to thousands of wallets |
| Developer activity | Commits, releases and outside contributors over a long period | A burst around launch, or a lightly edited fork |
| Influencer posts | A known builder explains the design in detail | Paid posts with the same wording at the same hour |
| Community | Hard questions get real answers | Large member counts, no engagement, critics removed |
| Partnerships and listings | The partner confirms it on its own channels | Only the token’s own account announces it |
Finally, ask how the token reached you. An unrequested message, a token that appeared in your wallet, a reply under a large account: the route is evidence, and the page on malicious airdrops explains why.
A one page research template
Write the answers down. A template forces you to finish the checks you would skip when excited, and it gives you a record to compare against the next time.
| Field | What to record |
|---|---|
| Identity | Chain, contract or mint address, and the two sources that confirmed it |
| Powers | Mint, freeze, extensions, owner, proxy admin, taxes, and who holds each one |
| Holders | Top ten after setting aside pools, exchanges and vesting, plus any clusters |
| Liquidity | Main pool, depth within 2%, liquidity to market cap ratio, who owns the pool tokens |
| Supply | Circulating, total, FDV to market cap, the next three unlocks in days of volume |
| Value capture | What holding the token entitles you to, mechanically |
| Team and audits | Who, track record, auditor, date, commit, whether the deployed code matches |
| Open questions | Anything unexplained, and what evidence would change your view |
Common questions
How long should researching a token take?
The first pass takes about ten minutes: confirm the address, run the automated checks, read the top holders and the main pool. If it survives that, the full template takes under an hour for most tokens, most of it spent reading the contract powers, the unlock schedule and the audit report.
Is a revoked mint authority enough to call a Solana token safe?
No. It removes one lever. Check the freeze authority, whether the mint uses Token-2022 extensions such as a permanent delegate or a transfer hook, who owns the liquidity pool tokens, and how concentrated the real holders are. Plenty of tokens with revoked authorities have still collapsed when insiders sold.
What does it mean if an EVM token is a proxy?
The address you interact with forward every call to a separate implementation contract, and whoever holds the upgrade key can point it at new code. That is common and often legitimate, but it means every other check is only true until the next upgrade. Find out who holds that key and whether a timelock delays changes.
Why is an exchange or a pool the largest holder?
Because both hold tokens for many people at once. A DEX pool is the market, and an exchange hot wallet holds customer balances. Set them aside when you judge concentration, then look closely at what remains, especially wallets that were funded from the same source.
Does an audit mean a token is safe to buy?
No. An audit is evidence that a specific version of the code was reviewed. It says nothing about code changed later, about whether the deployed contract matches the audited one unless you check, or about the economics and the people holding admin keys. Read the findings and their status, not the logo.
Where to go next
Next: Reading DeFi dashboards: TVL, fees, revenue and volume
Guide 14 of 16 in the Intermediate level. Your place is kept on this device, so you can pick up exactly here next time.