Before you sign: verify any DeFi contract on Etherscan

Everything on a public blockchain is permanently recorded and publicly readable — including the contract you're about to trust with your tokens. Block explorers give you a readable window into that data. Learning to use one is the difference between hoping a protocol is what it claims and checking.

Know your explorer

Each chain has its own explorer; they all work the same way:

Read a transaction like a statement

Paste any transaction hash into the explorer and every field tells you something:

# Example transaction fields on Etherscan:
Transaction Hash:   0xabc123...     (unique ID for this transaction)
Status:             Success         (or Failed)
Block:              19,234,567      (which block it was included in)
From:               0x742d...       (the wallet that sent it)
To:                 0xE592...       (the contract or wallet that received it)
Value:              0.05 ETH        (ETH sent directly)
Transaction Fee:    0.000023 ETH    (gas paid to the network)

# For token swaps, look at the "ERC-20 Tokens Transferred" section
# This shows exactly which tokens moved and in what amounts

The habit that pays off: after any meaningful transaction, open it in the explorer and confirm the token flows match what you intended. When something goes wrong, this is also how you find out exactly what happened.

The five-step contract check

Before interacting with a new protocol, verify its contract:

1. Find the contract address from the protocol's official site — never from a DM, ad, or reply.
2. Paste it into Etherscan (or the chain's explorer).
3. Open the Contract tab.
4. Look for the green checkmark: "Contract Source Code Verified" — the published source matches the deployed bytecode. An unverified contract is a significant red flag.
5. Read the contract name — does it match what you expect to be interacting with?

Two bonus checks while you're there: the Read Contract tab shows the protocol's live state, and the Security tab lists audit reports when available.

Trust is earned in years, not APY

Major protocols — Uniswap, Aave, Compound, Curve — have been audited by multiple independent security firms and carry years of battle-tested history. New protocols and forks carry substantially higher risk regardless of their claimed APY. Verification tells you a contract is what it says it is; it can't tell you the economics are sound. For that, the track record is the data.

Related: The five attacks that actually drain DeFi wallets — what to do before an attacker ever gets the chance.