A user encounters a new token on Solana or Ethereum with an appealing name, a plausible website, and a chart that looks profitable. The token is listed on a decentralized exchange and appears in their Phantom Wallet interface ready to trade. Before committing capital, they face a concrete problem: distinguishing between a legitimate project and a honeypot—a contract designed to accept deposits but block withdrawals—or a rug pull where developers abandon the token after extracting liquidity. The wallet itself cannot prevent these losses because it is non-custodial and cannot reverse transactions.

Phantom Wallet’s role is to manage addresses, display balances, sign transactions, and provide previews of what each swap will cost and receive. That transparency is valuable, but it places responsibility on the user to verify the token contract itself before approval. A dApp wallet that connects to decentralized exchanges, yield protocols, and NFT marketplaces operates at the edge of what any single application can validate. The interface can show red flags; the user must recognize them and act on the information presented.

Understanding honeypots versus legitimate tokens

A honeypot token contract is technically functional on the surface but includes hidden conditions that allow the developer to withdraw liquidity while ordinary users cannot. The contract may mint new tokens and deposit them into a liquidity pool, making the early price attractive. Users buy and the chart appears healthy. But when a holder tries to sell, the contract silently fails the transaction or charges a fee that consumes the entire output. The holder’s funds are locked, and no error message explicitly states what happened. Phantom Wallet will show the transaction attempt and may display a preview warning, but the wallet cannot know whether the underlying contract contains this trap without analyzing its bytecode.

A rug pull takes a different approach. Developers create a real, functional token and accumulate liquidity by attracting buyers. Once sufficient capital is locked in a liquidity pool, the developers call a function to withdraw all paired assets—typically ETH, SOL, or a stablecoin—and abandon the project. The token becomes worthless because the liquidity that allowed buying and selling has been removed. Rug pulls are easier to execute than honeypots because no hidden code is needed; they rely on social engineering and the expectation that retail users will not monitor contract permissions.

Both attacks exploit the immutability of blockchain transactions. Once a token purchase is confirmed on-chain, Phantom Wallet cannot reverse it or recover the funds. The wallet’s transaction preview can show you are about to spend 1 SOL to receive a certain quantity of tokens, but it cannot guarantee that selling those tokens later will work or be profitable. That verification must happen before the transaction is signed.

The distinction is important for recognition. A honeypot may show modest trading volume and appear active because early insiders or bot accounts can exit, while the contract blocks later buyers. A rug pull typically shows high volume immediately after launch and then sudden, total collapse. Neither pattern means the token is visibly broken in Phantom Wallet’s interface; both rely on contract-level mechanics that are hidden from the casual user.

Contract verification and source code transparency

Blockchain explorers such as Etherscan (for Ethereum), Solscan (for Solana), and other chain-specific tools allow anyone to view the contract bytecode and, if the developer has chosen to do so, the source code. A verified contract displays human-readable Solidity or Rust, depending on the blockchain. An unverified contract shows only the compiled bytecode, which is nearly impossible for a non-specialist to understand. When you are considering a token, the first step is to visit the explorer, find the contract address, and check whether the code is publicly available.

Contract verification is not a guarantee of safety. A developer can publish honest source code and still include a rug-pull mechanism. Verification primarily allows security auditors and experienced users to review the token’s logic. However, unverified contracts are a strong red flag. They suggest the developer wants to hide the mechanism, whether the goal is a honeypot, a rug pull, or simply low effort.

If code is available, look for specific dangerous patterns. A `mint` function that the deployer can call without limits allows the creation of infinite tokens, devaluing existing holders’ shares. A `setFees` function controlled by the developer can change trading fees to 99% after the community has accumulated holdings. A `removeLiquidity` function with no timelock allows the developer to withdraw the liquidity pool immediately. A `pauseTrading` function lets the developer freeze all transfers. None of these patterns are necessarily honeypots—legitimate projects sometimes use them—but they concentrate power in the developer’s hands and should be cause for skepticism.

A reputable project typically has these characteristics in code: a fixed total supply, no mint function available after launch, no admin functions that affect trading, a liquidity lock or LP burn (proving the pool cannot be rug-pulled), and a timelock on any significant changes. If the code has none of these protections, assume the token is high-risk unless you have substantial reasons to trust the team directly.

Reading token contract addresses and avoiding fake implementations

Token scammers often create contracts with names nearly identical to popular tokens. A fake “USDC” might be called “USDC_V2” or “USDCoin” and deployed as a new contract. When a user searches Phantom Wallet’s swap interface for the token name, both the real and fake versions appear, but the fake contract resides at a different address. This is a critical vulnerability in human attention, not in Phantom Wallet’s security. The wallet correctly displays the contract address, but most users do not verify it.

The defensive procedure is to never search by name alone. Instead, locate the legitimate token’s official contract address from the project’s website or a trusted explorer page. Then copy the full address—a 42-character string for Ethereum starting with “0x”, or a longer format for Solana—and paste it into Phantom Wallet’s swap field. If the token does not appear, do not accept a similarly named alternative. If the swap interface shows the token but the address does not match what you copied, stop immediately.

This habit applies to every blockchain network that Phantom Wallet supports, including Solana, Ethereum, Base, Polygon, Bitcoin, Sui, HyperEVM, and Robinhood Chain. Tokens on different networks have different contract addresses even if they share a name. A bridge token or wrapped version will have a distinct address and potentially different properties. Confusing them is easy and profitable for scammers.

Tools like DexTools, DexScreener, and blockchain explorers allow you to search by contract address and view the transaction history. If a contract was deployed yesterday, has no significant trading history, and trades only on one small exchange, the token is newly launched and speculative. If a contract has been active for months, shows volume across multiple platforms, and the developers use their real names publicly, the risk profile is different. Use Phantom Wallet to connect to these exploratory tools before committing capital, not afterward.

Recognizing rug-pull mechanics and liquidity concerns

A liquidity pool is a smart contract that holds pairs of assets and executes trades at a price set by a formula. For a token to be tradeable, it must have a liquidity pool. The pool for a token paired with ETH or SOL contains both the token and the stablecoin or native asset. If the developer has permission to withdraw the entire pool, they can drain it and the token becomes untradeable and worthless. This is the rug-pull mechanism.

Legitimate projects address this risk through a liquidity lock or LP burn. A liquidity lock transfers the LP tokens (which represent ownership of the pool) to a time-locked contract that does not allow withdrawal for months or years. An LP burn permanently removes the tokens by sending them to a dead address, making it mathematically impossible to recover the liquidity. Both approaches provide credible assurance that the developer cannot rug-pull. Checking whether these protections exist is straightforward: visit the explorer, find the liquidity pool address, and look at the holder of the LP tokens. If the holder is a dead address or a time-locked contract, the pool is protected. If the developer’s wallet holds the LP tokens with no lock, the risk is severe.

Another warning sign is a liquidity pool that appears disproportionately small relative to the token price. If a token is trading at $1 per unit but the liquidity pool contains only $5,000 in paired assets, the pool is vulnerable to rapid price swings and the developer could rug-pull a relatively modest amount. High-volume trading on such a pool is unsustainable. Phantom Wallet’s transaction preview will show the amount you receive based on the current pool composition, but as more people buy, the price will rise quickly and slippage will increase.

Wallet security practices when using dApp connections and swaps

Phantom Wallet functions as a dApp wallet, meaning it connects to decentralized exchanges, lending protocols, NFT marketplaces, and other on-chain applications. This connection is powerful because you can trade, stake, and transact without moving funds to a centralized exchange. It is also a security surface because a malicious dApp can request permission to spend your tokens. When a dApp requests approval, Phantom displays a preview of what it is asking. Reading that preview is non-negotiable.

An approval transaction allows a smart contract to transfer your tokens on your behalf up to a specified limit. If a dApp asks you to approve an unlimited amount, or an amount vastly larger than the transaction requires, that is a red flag. Legitimate applications ask for the precise amount needed or a reasonable multiple of it. Before signing an approval, verify the dApp’s URL in your browser address bar, confirm you are on the official site and not a phishing copy, and review the contract address being granted permission in Phantom’s transaction preview.

A separate practice is to use revoke tools periodically. Websites like revoke.cash or approval management features in some wallet explorers allow you to see every contract you have approved and revoke permissions you no longer need. If you approved a dApp months ago and no longer use it, revoking the permission removes a potential attack surface. This is not something Phantom Wallet can do automatically because you granted the permission yourself; it is a manual maintenance task that reduces risk over time.

The wallet’s transaction preview and suspicious activity detection features are useful but not exhaustive. Phantom shows you the inputs and outputs of a transaction—how much you are sending and what you expect to receive. If a swap is quoting an output far below what the market price suggests, the preview will be visibly odd. But the preview cannot always distinguish between a legitimate transaction with high slippage and a honeypot that will fail silently. Use Phantom’s display as one information source, not as a final safety guarantee.

Red flags to halt trading immediately

Certain warning signs should trigger an immediate decision to stop and research further. A swap quote that suddenly changes dramatically or shows an error that resolves when you retry is suspicious. If you are trying to sell a token you hold and Phantom Wallet shows the transaction is being processed but then fails, attempt a small test transaction before retrying the full amount. Honeypots often reject transactions of a certain size or frequency to make the block appear less coordinated.

If the token’s official website or social media channels have recently changed, if the developers have gone silent, or if the project’s announcements suddenly shift tone, the team may be preparing for a rug pull. Legitimate projects maintain consistent communication. If you see a token that is heavily promoted on newly created social media accounts or through paid advertising alone, with no genuine community discussion or long-term presence, the project may not be real.

A contract with obvious code issues—for example, a function that calls itself recursively without bounds, or a transfer mechanism that appears to have no effect—suggests either a scam or incompetent development. Neither situation is safe. If you cannot understand what a contract does because the code is unverified or written poorly, do not participate. The phrase “I will figure this out later” has cost people substantial sums in the crypto space.

Finally, if a token or dApp requires you to send funds to an external address, bridge them through an unusual method, or prove ownership by transferring assets, stop. Legitimate blockchain applications never ask for this. These are classic phishing and theft vectors. The Phantom Wallet you install from phantom wallet‘s official distribution site will never ask you to export your recovery phrase or send assets elsewhere. If an app or prompt requests these things, it is a scam.

Using blockchain explorers and community resources before committing capital

Before trading a new token through Phantom Wallet, spend 10 minutes on public research. Visit the contract on Etherscan, Solscan, or the appropriate chain explorer. Check the deployment date, the number of holders, the transaction history, and whether the code is verified. Look for holders with disproportionately large balances—this suggests the token was created by deployers who retained most of the supply. Check whether the developer or founding team is named publicly and whether they have a history in the space.

Read the token’s whitepaper or documentation if available. Legitimate projects provide clear documentation of tokenomics, use cases, and development roadmaps. Vague mission statements or promises of unrealistic returns are common in scams. If the project exists only as a contract address and a chart, it is not a project; it is a gambling contract.

Community resources like CoinGecko, CoinMarketCap, and community governance forums sometimes flag tokens with known issues. Reviews on platforms like Twitter or Discord from experienced traders can reveal problems others have encountered. This is not a substitute for your own analysis, but community signal can point you toward specific research questions.

The most important resource, however, is skepticism. A token that appears to have found the perfect price point right before you discover it is rarely a genuine opportunity. If something sounds too good to be true—astronomical returns with low risk, insider allocations, exclusive access—it is almost certainly a scam or an extremely high-risk speculation being marketed dishonestly. Phantom Wallet’s job is to execute transactions you authorize. Your job is to ensure you are authorizing transactions that are actually in your interest.