Detect Permissioned Token Scams: Step-by-Step

DeFi Intel Research · Updated 2026-07-02 · intermediate

You’ve seen the hype: a new token with a slick website, celebrity endorsements, and promises of 100x returns. But behind the glossy front lurks a growing class of scams—permissioned tokens where the deployer retains hidden powers to mint unlimited supply, freeze your funds, or even drain your wallet. Unlike true decentralized tokens (like UNI or AAVE) where no single entity can control the contract, permissioned tokens embed backdoors that allow the owner to alter the token’s rules at will. These rug pulls have cost investors billions, yet most victims never checked the contract’s built-in controls.

This guide teaches you how to detect permissioned token scams step by step. You’ll learn to navigate Etherscan like a security auditor: finding the owner address, reading mint and blacklist functions, inspecting ownership renouncement, and spotting upgradeable proxy patterns. By the end, you’ll have a repeatable checklist to evaluate any token before you swap a single cent. No guesswork, no hype—just hard evidence from the blockchain.

What Are Permissioned Tokens and Why Are They Dangerous?

Permissioned tokens are ERC-20 (or BEP-20) contracts that grant special powers to a single address—typically the deployer. These powers may include minting new tokens, pausing transfers, or blacklisting addresses. Standard tokens like DAI or LINK do not have such functions because they aim for censorship resistance and transparency. A permissioned token, by contrast, has an owner variable that grants exclusive access to critical contract methods. If the owner is malicious, they can:

• Mint infinite tokens, diluting your holdings to zero.
• Freeze your address so you cannot sell or transfer.
• Steal tokens from your wallet via a blacklist and sweep function.
• Upgrade the contract logic (via a proxy) to introduce new backdoors later.

Warning: A token with an active owner who can mint or pause is not decentralized. Treat it like a pre-funded bank account where the owner holds the keys.

By learning to spot these functions on Etherscan, you protect yourself from the most common rug-pull patterns.

Step 1: Locate the Contract Owner on Etherscan

Every permissioned token has a variable (often named owner) that stores the address with admin control. To find it:

• Open the token’s Etherscan page. Example: 0xabc...123.
• Click the Contract tab, then Read Contract.
• Scroll down—look for “owner” or “contractOwner”. If present, the address is displayed. Copy it.

Now verify if that address is a regular wallet (personal account, often starts with 0x...) or a smart contract (multi-sig like Gnosis Safe). A multi-sig adds some safety because multiple parties must approve actions. But even a multi-sig can be controlled by the same group—don’t assume it’s trustworthy. Next, check the owner’s transaction history using the Etherscan Address page. If the owner has called functions like mint() or transferOwnership() in the past, that’s a red flag. Use the Internal Transactions tab to see if the owner has transferred tokens to exchanges—possible exit preparation.

Step 2: Scan for Mint Functions and Supply Manipulation

A mint function allows the owner to create new tokens out of thin air. On Etherscan, go to Contract -> Read Contract and look for functions like:

• mint(address to, uint256 amount)
• mint(uint256 amount)
• mintTo(address to, uint256 amount)

If you see “mint” anywhere, the owner can inflate the supply at will. Some tokens also have a hidden max supply—check the _maxSupply variable. Even if a max supply exists, the owner can often change it via another function like setMaxSupply(). To be safe, use the Write Contract tab to see if the current owner can call mint. But don’t rely on the write tab alone—many scammers hide mint functionality behind a modifier like onlyOwner that appears as a public function. Also check for burnFrom—some permissioned tokens let the owner burn tokens from any address, draining your balance.

If any of these exist and the owner wallet hasn’t been renounced, consider the token extremely risky.

Step 3: Detect Blacklisting and Address Freezing

Blacklist functions give the owner power to block specific addresses from sending or receiving the token. On Etherscan, under Read Contract check for:

• blacklist(address) or addBlacklist(address)
• removeBlacklist(address)
• isBlacklisted(address) — a boolean view function

If any blacklist function exists, the owner can freeze your wallet. Some tokens go further: they invoke _beforeTokenTransfer hooks that prevent blacklisted addresses from trading. To see if a blacklist is actively used, click Contract -> Transactions and filter by function name. If you see calls to blacklist against real user addresses, avoid the token. Also check the Logs tab for events like BlacklistUpdated. Scammers often blacklist early investors who try to sell, then dump on remaining holders. A truly decentralized token has no blacklist mechanism—any token that does is suspicious.

Tip: Use a block explorer with decompiled source code for tokens not verified. Unverified contracts are a major red flag; skip them entirely if you cannot audit the source.

Step 4: Look for Pause and Unpause Functions

A pause function allows the owner to halt all transfers globally. This is common in staking or upgrade contracts for maintenance, but in a simple transfer token it’s a trap. On Etherscan under Read Contract, check for:

• paused() — returns true/false
• pause() — only owner can call
• unpause() — only owner can call

If the contract inherits OpenZeppelin’s Pausable, you’ll see these functions. An active pause can lock your tokens indefinitely. Use Contract -> Read Contract to check the paused() state. If it returns true right now, run—the owner has already frozen trading. Even if it’s false, the ability to pause remains a weapon. Some tokens also have a limited number of pauses, but that’s rare. A rug pull often works like: attract liquidity, let people buy, then pause transfers, and drain the LP using the owner’s mint ability. Always check for pause functionality and treat it as critical risk.

Step 5: Verify Ownership Renouncement and Multi-Sig

An owner address that cannot be changed (renounced) is safer. On Etherscan, under Read Contract look for:

• renounceOwnership() — if called, the owner becomes address(0) and no one can ever administer the contract again.
• owner() — if it returns a non-zero address, ownership is active.

Check Contract -> Transactions for previous calls to renounceOwnership. If it was called, the token is permanently ownerless. However, scammers sometimes use proxy contracts where the admin can change the logic even after renouncing the proxy admin. That’s why you must also check for proxy patterns (next section). If the owner is a multi-sig wallet (e.g., Gnosis Safe), evaluate how many signers and their addresses. A 2-of-3 multi-sig is better than a single key, but still centralized if all signers are the team. Use tools like Etherscan’s Token Analysis or third-party dashboards to see if the owner address appears in known scam databases.

Step 6: Spot Upgradeable Proxy Contracts

Many rug pulls use proxy patterns (e.g., OpenZeppelin's TransparentUpgradeableProxy) to change the contract’s logic after launch. On Etherscan, if the contract shows Implementation address under Contract tab, it’s a proxy. The actual logic lives in an external implementation contract, and the proxy can be upgraded to a new implementation by the admin. This means even if the token appears benign now, the owner can swap in a malicious implementation tomorrow. To check:

• Go to Contract -> Read as Proxy (or Read Contract if no proxy notation). Look for implementation() or admin().
• If you see an admin address, that admin can upgrade the contract. Often it’s the same as the owner.

Click on the implementation address and repeat the mint/blacklist checks. Some projects hide backdoors in the implementation but not the proxy—check both. If the proxy admin is not renounced, the token is not decentralized. Avoid any token with an active upgrade capability unless you fully trust the admin and understand the upgrade timelock.

Step 7: Cross-Check with Write Contract Tab and Real-Time Simulation

The Write Contract tab on Etherscan shows functions that can be called directly from your wallet. But you don’t need to execute them—just reading the function names and parameters is telling. For example, transferOwnership(address newOwner) means ownership change possible. addMinter(address) means new minters can be added. Use the Contract Creator field—the original deployer often retains special roles. Hover over the deployer address to see if it belongs to a known scam cluster via tools like Revoke.cash or honeypot.is. For a more thorough check, simulate a transaction using a service like Tenderly to see if a blacklist or pause function would block your transfer. This simulation is the final confirmation: if the token passes all static checks but still blocks you in simulation, the contract has hidden logic (see Additional Hidden Functions).

Step 8: Investigate Hidden Variables and Honeypot Patterns

Not all permissioned functions are visible in the ABI. Some scammers hide variables using assembly code or rely on modifiers that check ownership without explicit functions. On Etherscan, use Contract -> Decompiled Code if the source is not verified. Look for SSTORE operations that modify storage slots related to a whitelist or allowance. You can also compare the token’s total supply over time using the Holders tab — if total supply spikes while no public mint event occurs, the owner likely used a hidden mint. Another tell: honeypot tokens typically let you buy but block or apply a confiscatory tax on sells — via a blacklist, a whitelist that only allows the deployer to sell, an extreme sell fee, or an impossible minimum-sell threshold in the transfer logic. Confirm by simulating a sell (see below) rather than trusting the token page alone. Use the Analytics tab to see if any address (usually the deployer) holds >50% of supply. That alone is a red flag. Combine all checks into a risk score: 1) owner non-zero, 2) mint/blacklist/pause exists, 3) proxy upgradeable, 4) supply concentration >10%. Any token with two or more of these should be avoided.

Frequently asked questions

Related reading

• Smart Contract
• Smart Contract Security Audits 2026 Guide
• Rug Pull
• Ethena Usde Synthetic Dollar Risk Audit 2026