Token Scanner
A smart-contract safety check that reads the bytecode, not the marketing.
Free to start: scanning is included in a free tier with a monthly usage allowance. Higher volumes and API access are on paid plans.
This token scanner analyses what an ERC-20 contract actually does on-chain. Tok{In} decompiles the contract's deployed bytecode with Gigahorse (Dedaub's own decompiler) and simulates a real buy and sell against live DEX liquidity. Because the analysis works on deployed bytecode rather than published Solidity, it still produces a full result when a contract has no verified source, which is the normal case for the tokens most worth checking. It covers Ethereum, BNB Smart Chain, Base, Arbitrum, Avalanche and Robinhood Chain.
Bytecode analysis, not source-code trust
Most token scanners parse verified Solidity from a block explorer. That inherits the deployer's choices: what to publish, whether it matches what was deployed, and whether the real logic sits behind a proxy. Gigahorse is a decompiler built for exactly this problem: it lifts EVM bytecode back into analysable form, so the scan describes the contract that is running rather than the contract that was advertised.
Static analysis plus a live trade
Static analysis alone can tell you a blacklist function exists; it cannot tell you whether you are on the list. A trade simulation alone can tell you a sell failed; it cannot tell you why, or whether it will fail tomorrow. Running both is what turns a flag into an explanation: the simulation supplies the evidence and the decompilation supplies the mechanism.
What the scan covers
Honeypot behaviour, buy and sell taxes and whether they can be modified, hidden or unlimited mint functions, blacklist and whitelist gates, trading pauses and cooldowns, self-destruct paths, proxy upgradeability, external calls made during transfer, privileged owner functions, DEX pools with their liquidity, and the token's largest holders.
Three states, not two
Every check reports one of three answers: fired, clean, or no answer. A check that could not run is never rendered as a pass. That distinction matters more than it sounds: a scanner that quietly turns "we could not determine this" into a green tick is worse than one that says nothing, because it converts missing evidence into false confidence.
Frequently asked questions
- What does a token scanner check?
- It analyses an ERC-20 contract for patterns that can cost you money: whether the token can be sold, whether taxes can be changed after you buy, whether new supply can be minted, whether specific wallets can be blocked, and whether the contract can be upgraded. Tok{In} adds a live buy and sell simulation against real DEX liquidity so the sellability answer is measured rather than inferred.
- Can you scan a token with no verified source code?
- Yes. The analysis runs on the deployed bytecode using Gigahorse decompilation, so a contract with no published Solidity still produces a full result. This is the common case for newly deployed and deliberately obfuscated tokens.
- How much does the token scanner cost?
- There is a free tier with a monthly usage allowance, which covers ordinary checks before a trade. Sustained or high-volume scanning and programmatic access through the Tok{In} API are on paid plans. Current allowances and pricing are shown on the plans page.
- Is this the same as a smart contract audit?
- No. An audit is a manual engagement in which engineers review a specific codebase in depth against its intended behaviour. This scanner is automated and runs in seconds against a fixed set of checks. It is built to catch the common malicious patterns in tradeable tokens, not to replace a review. Dedaub does both.