How to Review a New Token List Entry
A cautious process for checking token lists, contract addresses, symbols and network context.
This article may contain affiliate links. Commercial relationships are disclosed in the affiliate policy.
A token list is a claim. Someone has asserted that a contract address at a particular network is a token with a particular symbol, and that claim is what your wallet, your block explorer, and many front ends will display instead of the raw address. Reviewing a new entry means checking that claim against the chain itself before you let it influence anything you do.
The reason this matters is that a list entry is cheap to make and sticky once adopted. Anyone can publish a list containing any address, name it whatever they like, and distribute it. If your wallet reads that list, a scam token wearing a familiar ticker can inherit the visual authority of the real one. The address is the fact; the symbol and the logo are decoration.
What a token list entry actually contains
Most lists carry the same small set of fields, and each one is a separate claim worth checking independently.
chainId says which network the address belongs on. This is the field people skip and the one that causes the most confusion, because an identical-looking address can exist on Ethereum, on an L2, and on a test network as three entirely separate contracts. A list entry that omits or guesses chainId will be matched to the wrong network by well-meaning software.
address is the only field that is verifiable against chain state. Everything else in the entry is a label attached to it.
symbol and name are human-facing strings with no on-chain meaning. They can be duplicated, misspelled, or chosen to resemble a well-known token. Two tokens can legitimately share a ticker; a list that resolves symbols without regard to address is therefore displaying an ambiguous name.
decimals is the field that causes real financial errors. Decimals govern how raw token units are rendered into human units. A list entry that reports 6 when the contract reports 18 will show a balance off by twelve orders of magnitude in one direction or the other. Explorer interfaces apply their own decimals, and the mismatch is what gets noticed — sometimes after a transfer.
logo is an image URL with no verification attached. It is the cheapest place to impersonate a brand and it has no bearing on contract behaviour.
The review sequence
Work through these in order. Each step depends on the previous one being right.
Start with the chain. Confirm the entry’s chainId against the network you are actually connected to. If the list does not state a chain, treat the entry as unverified regardless of how official it looks.
Then read the address, in full, from two independent places: the protocol’s own official documentation on its own domain, and a block explorer for the correct network. Not from the list itself. The whole point of the comparison is that at least one of the two sources is outside the thing you are checking.
Next check the contract itself. Open the address on the explorer for that chain and confirm that what is deployed matches the description: the token name and symbol in the contract metadata should correspond to the entry, and the read of decimals() should equal the decimals the list claims. If the list says 18 and the contract returns 6, you have found a defect that would corrupt any interface relying on the entry.
Then check the contract source. An explorer marks a contract as verified when the published bytecode matches the deployed bytecode. Verified source lets you read what the token actually does, including whether transfers can be paused, whether fees are taken on transfer, and whether the owner retains mint rights. A token that can mint without limit is a materially different thing from a fixed-supply token, and no list entry will tell you that.
Finally, check who maintains the list and how entries get removed. A list with no visible process for removal accumulates entries forever, including entries added maliciously. A list maintained by a known organisation with a public change process is a different object from an anonymous JSON file on someone’s site.
Two signals that should stop you immediately
If the entry’s address is not verifiable on the correct chain, stop. Everything downstream depends on that one field.
If the token’s transfer behaviour differs from what the entry implies — a fee deducted on every transfer, transfers that can be frozen, a balance you cannot see — then the entry is misleading even if every field in it is technically accurate. This is not a reason to call the list fraudulent; it is a reason to understand the token before interacting with it rather than after.
What this review cannot tell you
Confirming that an address holds the token its entry names does not tell you the token is safe, solvent, or worth anything. It tells you the entry is not lying about identity. Price, liquidity, ownership concentration and upgradeability are separate questions with separate methods.
It also cannot tell you whether the list maintainer will keep the entry. Entries get removed after exploits, delistings, and migrations, and a wallet that trusted the symbol may show a stale name for an address you still hold.
Related reading
- How to verify a token contract before a DeFi action
- What a token approval screen usually means
- How to use a block explorer as a transaction receipt