Anyone can create a token on Base in a few minutes and give it any name, symbol and logo they want. That openness is part of what makes the network useful, but it also means a token's name tells you almost nothing about whether it is worth touching. Before you swap into something you have not used before, a short research pass can save you from an expensive mistake. None of the checks below require special tools or paid subscriptions, and most take a few minutes.
Confirm the contract address, not the name
Token names and symbols are not unique. It is common for scammers to launch a token called "USDC" or copy the branding of a real project, hoping people search by name instead of by address. The only thing that actually identifies a token is its contract address.
Get the address from a source you trust, ideally the project's own website or its official social account, not from a link someone sent you in a chat or comment section. Once you have it, paste that exact address into a block explorer like Basescan rather than searching by name, and confirm it matches what you swap in your wallet before you approve anything.
Check whether the contract is verified
On Basescan, a token's contract page will show whether the source code is verified. Verification means the deployer uploaded the actual code and Basescan confirmed it compiles to the exact bytecode running on-chain, so anyone can read what the contract actually does instead of trusting a name and a logo. You can read more about what a verified contract means and how to use the Read and Write tabs to look at it directly.
An unverified contract is not automatic proof of a scam. Plenty of legitimate small projects have not bothered verifying yet. But it does mean nobody outside the deployer can independently confirm what the code does, which raises the bar for how much else needs to check out before you trust it.
Look at how old the contract is and who deployed it
The contract's creation date and transaction history are public. A token deployed minutes ago with a handful of transactions from one wallet carries more risk than one that has been trading for months with a broad base of holders. Age alone does not make a token safe, but a token with no history at all is a token you are trusting on faith.
Check where the liquidity actually is
A token is only as tradable as the liquidity behind it. Tools like DEX aggregators route your swap through the pools that exist for a given pair, but if a token only has a shallow pool on one exchange, even a modest trade can move the price sharply against you. It is worth understanding liquidity pools and impermanent loss and price impact versus slippage so you can read a quote for what it is actually telling you, not just the headline number.
If a token's liquidity is thin or concentrated in a single wallet that could pull it out at any time, that is a meaningful risk on its own, separate from whatever the project claims about its long-term plans.
Check holder distribution
Basescan's token page shows a list of top holders as a percentage of total supply. If a handful of wallets hold the overwhelming majority of a token, a small number of people can move the price however they like, and there is nothing stopping them from selling into anyone who buys in. There is no universal safe threshold, but heavy concentration in a few non-exchange, non-contract wallets is a fact worth knowing before you buy, not after.
Watch for behavior that does not match a normal token
Some tokens are built to behave differently than they appear. Fee-on-transfer tokens take a cut on every transfer, sometimes only on sells, which can make a token easy to buy and difficult or impossible to sell back. A transaction simulation before you confirm a swap, when your wallet offers one, is one of the few ways to catch this kind of behavior before it costs you anything.
An audit helps, but it is not a guarantee
Some projects publish a smart contract audit from an outside security firm. An audit is a genuinely useful signal, since it means someone independent reviewed the code for known classes of bugs. It is not proof that a token is a good investment, and it does not cover changes made after the audit was published, or risks like a team quietly holding most of the supply. Treat an audit as one input among several, not a substitute for the rest of this checklist.
Put it together before you swap
No single check here is decisive on its own. A new contract is not automatically a scam, and a verified contract is not automatically safe. What matters is the overall picture: does the address match what the project itself publishes, is the contract verified, does the liquidity and holder distribution look reasonable, and does anything about how the token moves seem designed to trap you rather than let you trade freely.
Simple Base Swap shows you the token contract address on the review screen before you confirm a swap, so you can cross-check it against a block explorer or the project's own site in the moment, rather than relying on a name and a logo alone. That few minutes of checking is the cheapest insurance you have against putting real money into a contract that was never built to give it back.