Checking whether a contract's source is verified
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 6 min
In short
A block explorer will tell you whether a contract's source code has been published and confirmed to match the bytecode actually running on-chain. If it is unverified, nobody outside can read what it does. But a verified badge only means the code is readable — it says nothing about whether that code treats you fairly.
Key points
- Verified means only that the published source matches the deployed bytecode
- Treat an unverified contract as one whose behaviour cannot be inspected from outside
- Even when verified, privileged roles, upgradeability and pause functions are separate things to read
- If something is unreadable to you, let 'I could not confirm this' be the conclusion
Definition
The state in which an explorer has confirmed that compiling a contract's published source reproduces the bytecode deployed on-chain.
Start by pinning down the chain and the address. Contracts are chain-specific, and the same string can exist as a different contract elsewhere. Take the address from the project's own documentation and search it on that chain's explorer. If the only place you found the address was a third party's social post, the check has not really begun.
Then look at the source-code section of the contract page. If it is verified, you will find the compiler version, the optimisation settings and the source itself in readable form. If it is not, you will find a wall of bytes. What this tells you is whether the contract is readable, not whether it is safe. Unverified is not proof of danger, but it does mean the usual route to checking is closed.
When the source is there, the next thing to read is anything to do with privilege. Are there functions only an owner can call? Can supply be minted later? Can transfers be frozen? Can a fee rate be changed? You read these from modifiers and function names, which takes some technical grounding. Many explorers also let you call read-only functions to see the current values of those settings.
Check too whether the address is a proxy — a structure whose implementation can be swapped later. With a proxy, the code you are reading may not be the code that runs. When an explorer recognises a proxy it usually points to the implementation address. Swappable means today's reading carries no guarantee about tomorrow.
Finally, be clear about what this does not tell you. Readable code does not reveal vulnerabilities that only appear in unusual combinations. It says nothing about the safety of the external oracles and contracts it depends on. And how the operators manage their keys is not written on-chain at all. Checking verification adds one input to your judgement; it does not settle it.
Watch out for
- · Do not read a verified badge as 'audited' or 'safe' — they are different claims
- · With a proxy, the implementation can be replaced later; one check does not stay true
- · You never need to connect a wallet to read a contract. A site that demands one just to look is suspect
Frequently asked questions
Is an unverified contract always a scam?
No — sometimes the team simply never went through the publishing step. From your side, though, the result is the same: there is no way to inspect it. If you put funds into something you cannot read, do so knowing that.