Skip to content
Onchain Daily

Protocol-level crypto news, daily

Token labels come from contract calls, not source verification

A token’s name and symbol are claims returned by a contract; check the verified source, read on-chain metadata, and confirm which implementation the explorer shows.

Onchain Daily Newsroom2 min read

Cover artwork for Token labels come from contract calls, not source verification

A token’s name, symbol, and decimals are values a contract returns, while source verification checks whether published code matches the code deployed at an address. Those checks answer different questions: a verified source can explain a contract’s behavior, but it does not certify the token’s identity or trustworthiness. Start with the contract address, then compare what the explorer shows with what the contract returns. A label check also does not estimate a swap’s transaction cost; Poocoin covers checks for that separate question.

What does a verified contract source prove?

A verified source means the explorer has matched submitted source code and compilation settings to the deployed contract’s bytecode. Bytecode is the machine code the virtual machine executes. When the match is valid, the source lets a reader inspect the logic behind calls and transactions instead of seeing only bytecode.

Verification does not prove that the code is safe, that the token is genuine, or that its displayed name belongs to a known project. Anyone can deploy a contract that returns a familiar name or symbol. Source verification also does not make the contract immutable: its behavior may depend on an administrator, an upgrade mechanism, or external contracts. Treat the verification badge as evidence about code correspondence, not as an endorsement.

How do you check a token’s name and symbol?

Read the contract’s metadata at the exact address and network where the token is held. In the common ERC-20 interface, name and symbol return text, while decimals returns the number of decimal places used to display balances. These are contract calls, not proof of ownership or authenticity.

Compare the returned values with the project’s independently established contract address. Do not identify a token by ticker alone: symbols are not unique, and a malicious or unrelated contract can return the same one. A token list or explorer page can help locate information, but the address is the key identifier. Check that the network selector matches the chain on which the contract is deployed.

What should you inspect on the explorer?

Open the contract page for the address and check its verification status, source, and any proxy or implementation details. If the address is a proxy, calls may be forwarded to a separate implementation contract. In that case, reviewing only the proxy’s small forwarding code can hide the logic that handles token operations. Inspect the implementation shown by the explorer and determine whether an administrator can change it.

Then compare the explorer’s token panel with values returned by the contract. Explorer labels can be useful summaries, but they may be indexed or cached separately from live contract calls. When the panel and call results differ, rely on the address and current on-chain response for what the contract reports, and investigate the discrepancy before acting.

  • Confirm the full contract address and network.
  • Check whether source code is verified and review the relevant functions.
  • Read the contract’s name, symbol, and decimals values.
  • For a proxy, inspect the implementation and who can update it.

The practical distinction is simple: source verification helps explain code; metadata calls show what the contract reports. Use both, then verify the address through a source you already trust before sending funds or approving a token.