How to read a swap contract on a block explorer before approving

05 September 2026

You inspect the swap contract's code on a block explorer to verify it actually performs a token exchange and does not contain hidden functions that can drain your wallet. The contract is the rulebook for the transaction; reading it is the only way to be sure the rulebook says what the frontend claims.

Before you approve any token transfer, the site will ask your wallet to sign a contract interaction. That interaction calls a specific contract address. That address is what you examine on the block explorer. Do not rely on the site's own description of what the contract does. The chain stores the truth.

Step 1: Find the contract address

The approval prompt in your wallet shows the contract address the transaction will call. Copy it. Open a block explorer for the chain you are using - Solscan for Solana, Etherscan for Ethereum, BscScan for BSC. Paste the address into the search bar.

Step 2: Check the contract's source code

Not all contracts are verified. Verified means the deployer uploaded the human-readable source code and the explorer matched it to the bytecode on chain. If the contract is unverified, you cannot read it. That is a red flag. Legitimate swap contracts are almost always verified. If the contract is unverified, do not approve. Find another route.

For verified contracts, look for the "Contract" or "Code" tab. There you will see the source code in Solidity (EVM chains) or Rust/C (Solana). You do not need to be a developer to spot the obvious problems.

Step 3: Look for the swap function

The core logic of a swap contract is a function that takes your tokens, sends them to a liquidity pool or another user, and returns the output tokens to you. On EVM chains, the function is often called swapExactTokensForTokens, swapExactInput, or similar. On Solana, look for an instruction named swap or exchange.

If the contract does not contain any function that clearly describes a token exchange, the contract is not a swap contract. It might be a token locker, a staking contract, or something else. Approving it is unsafe.

Step 4: Scan for dangerous functions

Look for functions with names like withdraw, drain, transferOwnership, mint, burn. These are not part of a swap. A swap contract should not be able to take your tokens arbitrarily. It should only transfer tokens when you call a specific swap function.

Check for approve calls inside the contract. The swap contract itself should not be calling approve on your behalf. That pattern is used by malicious contracts to gain unlimited allowance after you interact once.

Step 5: Check the owner or admin address

Many contracts have an owner variable. That owner can often change the contract's behavior. If the owner is a single wallet address, that wallet controls the contract. If the owner is a multisig or a timelock, the risk is lower. If the owner is a random address with no transaction history, do not proceed.

Step 6: Read the actual transaction you are about to sign

Your wallet shows the raw data of the transaction. On the block explorer, after you paste the contract address, you can often decode the transaction data. It will show which function is being called and the parameters. Confirm that the function name matches a swap function and that the parameters are reasonable amounts.

What to do when the contract looks wrong

Close the site. Do not approve. The hub page "Swapping crypto safely" covers the broader checks you should run before sending funds to any address. The contract inspection you just did is one of those checks. If the contract fails any of the above, treat the site as hostile.

If you already approved a suspicious contract, revoke the approval immediately. Use a token approval revoker tool. Then move your funds to a new wallet. That wallet's approvals are gone, but the attacker may still have allowance on the old contract. Do not use the old wallet again until you are certain the approval is revoked.

A practical limit

You cannot read every line of code. You are looking for the structural red flags above. If the contract is verified, has a clear swap function, no owner-drain functions, and the transaction data decodes to a genuine swap call, you have done the essential due diligence. That is enough to approve.

Back to card purchases