Crypto Token Security Checklist for Beginners

Security research does not require you to read Solidity. It requires you to ask the same questions in the same order, every time, and to be honest about what you could not answer. This checklist is written for beginners and is deliberately short enough to actually use.

Before starting, keep one principle in mind: a checklist tells you what you have verified. It does not certify that a token is safe. No process can do that.

The checklist

• [ ] Verify token identity — correct name, ticker, and the chain it lives on
• [ ] Verify contract address — from a project-controlled source, cross-checked independently
• [ ] Check liquidity — depth, paired asset, lock status, venue concentration
• [ ] Check holder concentration — top-holder share, with large holders labelled
• [ ] Review tokenomics — supply figures, allocation, vesting, next unlock
• [ ] Review contract indicators — verification, ownership, mint, restrictions, fees, upgradeability
• [ ] Review project information — product, code, documentation, team, confirmed partnerships
• [ ] Check trading activity — distribution across participants and venues, persistence over time
• [ ] Check available sources — primary versus secondary, and whether they agree
• [ ] Record timestamp — when each figure was observed
• [ ] Identify unavailable information — list every gap explicitly
• [ ] Avoid unsupported claims — no price targets, no guarantees, no "safe" verdicts

The rest of this guide explains each line.

Verify token identity

Tickers are not unique and names are not protected. Confirm which asset you are researching before recording a single number, and re-confirm when a token starts attracting attention, because copies appear at exactly that point.

Verify contract address

Get the address from a domain or account the project controls, then confirm the same address appears on an independent listing and on the chain explorer. Note the deployment date and deployer. If two sources disagree, stop and resolve the conflict — everything downstream depends on it.

Check liquidity

• How deep is the main pool or order book?
• What is the token paired against, and is that asset itself liquid?
• Is liquidity locked, for how long, and verifiable how?
• Does one venue or one provider account for most of the depth?

Depth, not volume, determines whether the quoted price is achievable. Details in How to Check Crypto Token Liquidity.

Check holder concentration

Read the largest holders and label them. Liquidity pools, staking contracts, bridges, treasuries and exchange wallets are expected to hold large balances. What matters is the unexplained remainder: how much supply sits in unlabelled wallets, and whether that matches the published allocation.

Review tokenomics

Record total, circulating and maximum supply; the allocation split; vesting terms; and the next unlock date and size. Note whether circulating supply is verified or estimated, because market cap inherits that uncertainty. Definitions are in What Is Crypto Tokenomics?.

Review contract indicators

Check whether source code is verified, who holds privileged roles, whether new tokens can be minted, whether transfers can be paused, blocked or limited, what fees apply, and whether the contract is upgradeable behind a proxy.

Two rules: a clean automated result does not prove safety, and a flagged indicator does not prove intent to defraud. Read each result as a question to investigate. The full explanation is in How to Check a Crypto Token Smart Contract.

Review project information

Sort what you find into confirmed, claimed and unknown. A public repository with real commit history is confirmed. A partnership announced only by the project is claimed. An anonymous team is a known unknown — record it as a fact rather than as an accusation.

Check trading activity

Is activity spread across many addresses, or concentrated? Are there repeated transfers between related wallets? Does activity survive the initial marketing period? These describe behaviour, not future prices.

Check available sources

Prefer primary sources — the chain itself, the exchange, the project's own contract — over aggregated or self-reported figures. Where two independent sources disagree, record both and note the discrepancy rather than picking the more convenient one.

Record timestamp

Every figure in crypto has a shelf life. Liquidity can be removed, supply can be minted, ownership can be transferred, and a contract can be upgraded. A metric without an observation time cannot be relied on later. This is why every number we display carries its source and timestamp; see the methodology page for how that works.

Identify unavailable information

Write down what you could not establish: no audit, no published allocation, unverified supply, unknown liquidity ownership, unidentifiable team. Unavailable is a legitimate finding. Assumptions dressed as findings are the most common failure in beginner research.

Avoid unsupported claims

Finish the checklist with observations, not verdicts. Write "ownership is held by a single externally owned account with mint capability" rather than "this token is a scam", and never write a price expectation. Research describes what is; it does not forecast what will be.

Use it consistently

The value of a checklist comes from applying it identically to tokens you find interesting and tokens you do not. Apply it against live indicators on Research & Risk and recently listed assets on New Coins, and continue with the rest of the library in Learn.

Educational content only. This is not investment advice and does not assess any specific token.