Why Does a Token Show a Warning in a Wallet Swap Interface?

01 October 2026

When you see a warning in a wallet swap interface - such as a red banner, a caution icon, or a message like "This token may be risky" - it means the wallet or the decentralized exchange (DEX) aggregator has detected one or more signals that the token does not meet basic safety criteria. These warnings are not guarantees of a scam, but they are flags that the token’s behavior or origin is unusual compared to typical tokens. The warning is a prompt to investigate further before proceeding.

Common Reasons for a Warning

Warnings appear because the swap interface checks a token against known risk indicators. These checks are automated and rely on on-chain data, not subjective judgment. The main triggers include:

1. Low Liquidity or Unverified Liquidity Pool

If the token’s liquidity pool (LP) on a DEX like Uniswap or PancakeSwap is very small - say, under a few thousand dollars - the interface may flag it. Low liquidity means the token is harder to trade without causing large price swings, and it may be easier for the creator to manipulate. Some interfaces also check if the LP is locked or burned. If the LP is unlocked and controlled by a single address, the warning may be stronger.

2. High Sell Tax or Unusual Fee Structure

Swap interfaces often simulate a sell transaction to detect whether the token charges a high fee on sales (sometimes called a "sell tax"). If the fee exceeds a threshold - commonly 10% or more - the interface shows a warning. This is because tokens with very high sell taxes can be designed to trap sellers, making it impossible to exit without losing most of the value. The exact threshold varies by platform; check the specific DEX or wallet documentation for their current limit.

3. Proxy Contract or Upgradeable Design

A token that uses a proxy contract can be modified after deployment. This means the creator could change the token’s rules - for example, adding a high sell tax or blocking transfers. Many wallets detect proxy patterns and warn that the token is upgradeable. This does not mean the token is malicious, but it does mean you are trusting the contract owner not to change the rules later.

4. suspicious holder distribution

If a very small number of wallets hold a large percentage of the token’s total supply, the interface may flag concentration risk. A common threshold is if the top 10 holders control more than 90% of the supply. This suggests the token could be heavily manipulated - for example, one address could dump a large amount at once, crashing the price.

5. Honeypot Pattern

A honeypot is a token that allows buying but prevents selling. Swap interfaces may detect this by checking whether the token’s contract blocks transfers to certain addresses (like the DEX’s router) or reverts on sell attempts. If the simulation fails, a warning appears.

6. unverified contract source code

If the token’s contract on the block explorer (such as Etherscan or BscScan) is not verified - meaning the source code is not publicly available - the interface cannot analyze its logic. Unverified contracts are more risky because no one can confirm what the code actually does. Many interfaces warn about this by default.

7. Token Has a Mismatched Name or Symbol

A common trick is to create a token that uses the name and symbol of a well-known project (like "USD Coin" with symbol "USDC") but has a different contract address. Wallets often check for such name/symbol mismatches with known tokens and flag them as potential impersonations.

What you should do when you see a warning

A warning is not a definitive block; you can still swap. But you should stop and investigate before proceeding. Here is a step-by-step approach:

1. Check the token contract address on a block explorer. Verify it matches the address you intended. Scammers often change one or two characters in a legitimate address.

2. Review the token’s liquidity pool. Look at the DEX where it trades. Is the liquidity locked or burned? A locked LP (with a lock timestamp) or burned LP tokens are safer. If the LP is unlocked and owned by a single address, be cautious.

3. Simulate a buy and sell using a tool like a honeypot checker or a block explorer’s read function. This tells you what fees you would pay and whether selling is possible.

4. Check the holder distribution on the block explorer. If the top few addresses hold a very large share, the token is risky.

5. Look at the contract’s source code if it is verified. Search for functions like transfer, _transfer, or any onlyOwner modifiers that could let the creator pause trading or change fees.

6. Check if the token is a proxy. If the contract uses a proxy pattern, you are relying on the owner to not upgrade it to a malicious version. This is a red flag for many tokens.

Limitations of Warnings

Warnings are generated by automated checks and may be incorrect or incomplete. A token with a high sell tax might still be legitimate if the tax funds a project’s development or is burned. A new token with low liquidity may be a genuine launch. Conversely, a token with no warning could still be a scam if it uses a novel method that the interface does not detect.

The safest approach is to treat any unknown token as high risk until you have confirmed its contract, liquidity, tax structure, holder distribution, and upgradeability. Warnings are a starting point, not a final verdict. Use them as a signal to do your own research, not as a reason to blindly trust or distrust a token.

Back to token safety