Check a token
How a verdict is reached
Six layers, every one of them a call to the chain
Anyone can deploy a contract whose symbol() returns
“AAPL”. Names prove nothing, and the block explorer’s labels are
metadata, not evidence. What cannot be faked is structure: the canonical tokens are
beacon proxies issued by one factory, and every one of them is byte-identical to the
same 283-byte runtime. These are the six questions asked of every address.
- Contract code exists
eth_getCodeis read at the address. No runtime means there is nothing to verify - an ordinary wallet, or a contract that has been destroyed. - Beacon delegation
The runtime must delegate through the shared beacon
0xe10b6f6b…51b00, compiled in as an immutable, with the EIP-1967 slot agreeing. - Runtime is canonical, byte for byte
283 bytes, hashed and compared with the canonical proxy runtime
(keccak
0x6c1fdd4000…). One byte out is out. - Implementation and issuance The beacon must resolve to the implementation the registry serves, and the address must appear in the StockFactory’s own deployment list. Anyone may copy public bytecode; only the factory can issue a token.
- Metadata reads
symbol(),name()anddecimals()are read on chain. This is the weakest layer - it is reported, never trusted. - Supply arithmetic
totalSupply × uiMultiplier / 1e18must equaltotalSupplyUI()exactly. A contract that fakes the surface rarely gets the arithmetic right.
A check that could not be completed is reported as unverified - never as a forgery. A slow RPC is not evidence, and accusing a genuine token because a request timed out would be worse than saying nothing at all.