To check a BSC token, start from its contract address, not its name. Confirm the contract is verified on BscScan, read what the owner can change, look at holder concentration and whether liquidity is locked, then run a honeypot checker such as GoPlus to test buy and sell taxes. A small test buy and sell settles the rest.
None of this needs coding skills. You need an explorer, a security scanner and the discipline to go through the list before the price chart convinces you to skip it. We will use BscScan, GoPlus Security, honeypot.is, DEX Screener and our own BNB explorer, which runs a quick security scan whenever you paste a token address. Every check below works the same on any tool in our explorer ranking.
Why a BSC token checker is worth ten minutes
Creating a BEP-20 token on BNB Smart Chain takes a template contract, a few minutes and a gas bill measured in cents. Adding it to a PancakeSwap pool is just as easy. That openness is why BSC hosts thousands of genuine projects — and why it hosts an endless stream of copies, meme coins with booby-trapped code and outright rug pulls. The chain does not vet anything. A token that cannot be sold is technically working exactly as its code says.
The good news: that same code is public, and scammers rarely bother to hide their tricks well. A blacklist function, a 99% sell tax that the owner can switch on, or a pool whose liquidity is not locked are all visible to anyone who looks. Most people who lose money on BSC tokens did not lack information; they did not check.
How to check a BSC token: the 8-step checklist
Here is the whole routine at a glance. The sections below explain each step, what the tools show and where the traps are.
- 01
Find the real contract address
Get it from the project’s official site or docs and cross-check it on CoinGecko or CoinMarketCap. Never trust a symbol or a name — anyone can call a token “USDT”.
- 02
Confirm the source code is verified
On BscScan the Contract tab should show a green check and “Contract Source Code Verified”. Unverified code means you cannot see what the token is allowed to do.
- 03
Read the owner’s powers
Look for functions that mint, blacklist, pause trading, change fees or upgrade a proxy. Check who the owner is and whether ownership is renounced, a multisig or a single wallet.
- 04
Check holder concentration
Open the Holders tab. Set aside pools, burn addresses and lockers, then see how much the top ten real wallets control. A few wallets holding most of the supply can dump at any time.
- 05
Inspect liquidity and LP locks
How deep is the pool, how old is it, and are the LP tokens burned or locked — until when, and in which locker? Unlocked liquidity can be pulled in one transaction.
- 06
Measure buy and sell tax
Fee-on-transfer tokens take a cut on every trade. Note the current tax and, more important, whether the owner can raise it later.
- 07
Run a honeypot test
Scan the address with GoPlus or honeypot.is, or paste it into our explorer for a quick security scan. These tools simulate a buy and a sell to see if selling is blocked.
- 08
Buy small and test a sell
If everything passes, buy a small amount and sell part of it straight away. Gas on BNB Smart Chain costs fractions of a cent, which makes this the cheapest insurance you will ever buy.
Step 1: find the real contract address
Token names and symbols are not unique. Anybody can deploy a contract called “PancakeSwap Token” with the symbol CAKE, and search results on DEX interfaces and explorers will happily show it. The only identifier that counts is the contract address. Get it from the project’s official website or documentation, then confirm it on CoinGecko or CoinMarketCap, which list contract addresses per chain. If the address you were given in a Telegram group does not match, you have your answer.
On BscScan, genuine large tokens usually carry a reputation badge, an official site link and a large holder count on the token page. Be suspicious of a token with a big name but a contract that is days old. For the major stablecoins and wrapped assets we keep the verified addresses on our BEP-20 token explorer page, so you can compare character by character.
Step 2: verify the BEP-20 contract source code
Open the token’s Contract tab on BscScan. A verified contract shows a green check and “Contract Source Code Verified”, followed by the Solidity code, the compiler version and the ABI. Verification means the published source compiles to exactly the bytecode on the chain, so what you read is what runs. An unverified token is a black box: explorers can still show transfers, but nobody outside the team knows what the code allows. There is almost no legitimate reason for a traded token to stay unverified, and it is one of the few single flags that should end your research on its own.
You do not need to read Solidity line by line. Use your browser’s search on the code for words like mint, blacklist, pause, setFee, setTax, excludeFrom, maxTx and onlyOwner. Each hit tells you something the owner can do. The Read Contract tab then shows the current values — the owner address, fee settings, whether trading is enabled.
Step 3: owner privileges — mint, blacklist, pause, fees and proxies
Most BEP-20 tokens have an owner or admin role. What matters is what that role can do and who holds it. The dangerous powers are easy to list. Mint: the owner can create new tokens and dump them on the pool, diluting everyone. Blacklist: specific addresses — yours, for example — can be blocked from transferring. Pause or a trading switch: all transfers, or all sells, can be stopped at will. Fee change: buy and sell taxes can be raised, sometimes to 100%. Balance modification: rarer but real, some contracts let the owner edit balances directly.
Then there are upgradeable proxies. A proxy contract forwards calls to a separate implementation contract, and an admin can swap that implementation for a new one. On BscScan you see “Read as Proxy” and “Write as Proxy” tabs; the pattern is standardised in EIP-1967. Proxies are common in serious projects that need to fix bugs, but they also mean the code you audited today can be replaced tomorrow. With a proxy, who controls the admin key matters more than anything in the current code.
Context counts. The genuine BEP-20 USDT is a Binance-Peg token whose issuer can mint to back the peg, so security scanners flag it as mintable — expected for a bridged stablecoin, alarming for a fresh meme coin. Ownership held by a multisig or a timelock, which delays changes so users can react, is far better than a single wallet. And renounced ownership, where the owner is set to the zero address, removes only what that exact owner role guarded. Contracts built with role-based access control, like the patterns in the OpenZeppelin access control docs, can keep other admin roles after “renouncing”, and some scam contracts hide a second owner variable.
Step 4: holder concentration
The Holders tab on BscScan ranks addresses by balance and shows the percentage of supply each one owns. Before reading it, identify the addresses that are not people: the PancakeSwap pair contract (labelled as a Pancake LP), burn addresses such as 0x…dEaD and the zero address, lock contracts, and exchange wallets. What remains is the real distribution.
There is no magic threshold, but if a handful of unlabelled wallets hold a large share of the circulating supply, those wallets decide the price. Click a few of them. Were they funded from the deployer? Did they all receive tokens in the same block? Clusters of fresh wallets fed by one source are a classic way to disguise a team allocation. For a practical walkthrough of reading an address’s history, see our guide on tracking a BNB wallet.
Step 5: liquidity and LP locks — the rug pull check
A token is only as sellable as its pool. When someone adds liquidity on PancakeSwap V2, they receive LP tokens that represent their share of the pool. Whoever holds those LP tokens can withdraw the liquidity — all the BNB or USDT buyers paid in — in a single transaction. That is the textbook rug pull, and the check is simple: find the pair on DEX Screener or the PancakeSwap info page, note the liquidity size and pool age, then open the LP token’s holders on BscScan. You want to see most LP tokens either burned (sent to a dead address) or held by a known locker contract.
A lock is only as good as its terms. Lockers such as PinkLock, UNCX or Team Finance show the unlock date and the amount; a lock that expires next week protects you until next week. On PancakeSwap V3, liquidity positions are NFTs rather than fungible LP tokens, so check who holds the position NFT and whether it sits in a locker that supports V3. And remember that even locked liquidity does not stop the owner from minting new tokens and selling them into the pool — which is why steps 3 and 5 belong together.
Steps 6 and 7: buy/sell tax and a honeypot checker for BSC
Many BSC tokens are fee-on-transfer: every buy or sell sends a percentage to a marketing wallet, to holders or back into liquidity. That is legal and disclosed in the code, but it changes your maths. A 5% tax on buy and 5% on sell means you start 10% down, and PancakeSwap’s troubleshooting docs explain that you must raise slippage above the fee or the swap fails. The real question is not today’s tax but whether the owner can change it. A token with 0% tax and a setSellFee function with no upper limit is more dangerous than one with a fixed 3%.
A honeypot is a token you can buy but not sell, or sell only at a 90–100% loss. It can come from a blacklist that catches every buyer, a trading switch that is on for buys and off for sells, a maximum sell amount of almost nothing, or a sell tax that jumps after launch. Honeypot checkers catch these by simulating a buy and a sell against the live pool. GoPlus token security reports honeypot status, buy and sell tax, mintable, proxy, blacklist, hidden owner, whether the owner can change balances or slippage, and top holders; honeypot.is focuses on the buy-and-sell simulation. For a quick pass without leaving this site, paste the token address into our explorer — for example, here is the security scan for the CAKE token. The result shows the contract details together with honeypot, taxes, mintable, verified source, upgradeable proxy, blacklist and owner-can-change-balances flags.
Scanners have limits. They test the contract as it is right now, from a generic address. A token can pass at noon and fail at five past, after the owner flips a switch, and some contracts detect simulations or only trap wallets after a certain block. That is why the last step is a real one: buy a small amount, then sell part of it immediately. If the sell goes through at the expected tax, you have proven what no scanner can.
Fake USDT BEP-20 and “airdrop” tokens
Fake stablecoins deserve their own section because they fool experienced users. A scammer deploys a token called “Tether USD” with the symbol USDT, mints millions and sends some to you — or to the person you are trading with. The wallet shows “10,000 USDT”. Some fakes even seed a tiny pool so wallets and trackers display a dollar value. The only reliable test is the contract address: real BEP-20 USDT is 0x55d398326f99059fF775485246999027B3197955, listed on BscScan as Binance-Peg BSC-USD, with 18 decimals and holders in the millions. OTC scammers use exactly this trick to “pay” for real goods, so always check the token contract in the transaction before you release anything. Our guide to reading a BSC transaction shows where that contract appears.
Unsolicited “airdrop” tokens are the other half. Tokens with names like a website, a reward claim or “visit to redeem” are advertisements for phishing sites. The site asks you to connect your wallet and sign a transaction or permit that grants a drainer contract access to your real tokens. You do not need to do anything with such tokens: they cannot hurt you while you ignore them. Hide them in your wallet, never try to sell or swap them, and if you already signed something, check and revoke approvals right away.
Is a BEP-20 token a scam? Red flags in one place
Put the steps together and a clear picture emerges. Any single flag deserves a closer look; several at once is your signal to leave. The heavy ones: unverified source code; an owner or hidden owner who can mint, blacklist, pause or raise fees without limits; an upgradeable proxy controlled by one wallet; a few fresh wallets holding most of the supply; liquidity that is small, brand new, or not locked beyond the next few days; a sell tax much higher than the buy tax; honeypot scanners that disagree with each other; and a contract address that does not match the project’s official channels.
The softer ones are social: countdown timers, guaranteed returns, paid influencer pushes, a Telegram group where questions about the contract get you banned, and a website that launched the same week as the token. None of them proves a scam, but legitimate teams rarely need them.
And if the goal was simply to own BNB or a stablecoin, the safest check is the one you do not have to run: buy BNB or USDT on a regulated exchange and withdraw it to your own wallet. Keep the random DEX pairs for money you can afford to lose, gas in your wallet for the tests — our BSC gas tracker shows what a test trade costs today — and this checklist open in a tab.