Lookalike Tokens: How to Confirm You're Buying the Real Contract

Lookalike tokens copy a real project's name, ticker or logo but sit at a different contract address, and only that address tells them apart. Nothing in the ERC-20 token standard reserves a name or a ticker, and on decentralized exchanges such as Uniswap, no gatekeeper decides which tokens trade. To confirm you have the real one, get the address from the project's own site or docs, match it against CoinGecko and a block explorer, and check who created the contract and who holds it.

Key takeaways

• A token's name and ticker prove nothing. Its contract address is its identity, and the ERC-20 standard doesn't even require a name or symbol.
• Get the address from the project's own site or docs, then confirm it matches CoinGecko and the block explorer, every character.
• A verified contract means the published code matches what's deployed, not that the token is safe, Etherscan says.
• Before you trade, check who created the contract and who holds it.

Why do lookalike tickers exist?

Because nothing stops them. The ERC-20 standard, which most Ethereum-style tokens follow, marks a token's name and symbol as "OPTIONAL" and says other contracts "MUST NOT expect these values to be present." There is no registry and no rule that a ticker be unique. Anyone can deploy a contract and call it anything.

Decentralized exchanges don't filter at the door either. Uniswap Labs says it "does not control what tokens are available on Uniswap Protocol." Its apps now flag "potential impersonator tokens" identified by the security firm Blockaid, but a warning label is not a gate.

Some duplicates are legitimate. A project may have bridged versions on other chains, or an old contract left behind after an upgrade. Render is a clear case: its RNDR token on Ethereum upgrades one-for-one to RENDER on Solana, and a Polygon version has been deprecated, according to the Render Network's upgrade FAQ. Two addresses are not a red flag by themselves. An address the project doesn't list is.

Others are deliberate copies. Etherscan's guide to address poisoning describes attackers deploying token contracts whose names and symbols resemble "well-known or familiar tokens." Our guide to fake AI tokens covers why borrowed tickers are common in AI.

Where should you get the contract address?

1. Start from the project itself. Type the project's website address yourself, or use one you saved earlier, and find the contract address in its docs. Skip sponsored search results, links in replies or DMs, and addresses shown in promotional videos, which can be deepfakes. Render's FAQ, for example, publishes its Solana address and tells readers to "verify all links on official channel."
2. Match it on CoinGecko. CoinGecko lists contract addresses on a token's coin page. Its Render page lists the Ethereum contract and the Solana address rndrizKT3MK1iimdxRdWabcF7Zg7AR5T4nud4EkHBof, which matches Render's FAQ. Don't copy it from here: the point is that two sources you opened yourself agree.
3. Compare every character. The same CoinGecko page shows that address shortened to "rndri...EkHBof." Etherscan warns that attackers generate addresses that closely resemble a real address's "first and last few characters," so a shortened display can hide a fake.
4. Open it on the chain's block explorer, such as Etherscan for Ethereum or Solscan for Solana, and check that the name and symbol match what the project says.

If a token isn't on CoinGecko or any other tracker yet, you have one fewer independent check. In our view, that alone is a reason to slow down.

What should you check on the explorer?

• Verified source code. On Etherscan, a green checkmark "means the source code is public and matches the bytecode deployed onchain." Etherscan adds that "Verified" does not mean the contract is safe or audited. With unverified code, you can't see what a transaction will do before you sign it.
• The creator. Etherscan's Contract Creator field "shows the address that created this contract address," with the creation transaction beside it. Compare it with any deployer or treasury addresses the project publishes, and look at what else that address has launched. In our view, a creator that has launched a string of tokens borrowing famous names is a strong warning sign.
• The holders. Look at how many addresses hold the token and who sits at the top. Exchange wallets, liquidity pools and labeled project contracts are normal there; a few unlabeled wallets holding nearly everything are not. Our guide to verifying on-chain activity walks through holder distribution.
• Reputation and warnings. Etherscan rates tokens Unknown, Neutral, OK, Suspicious, Unsafe or Spam. Unknown is the default, and Etherscan says even OK is not an endorsement. Third-party cards on the explorer can add signals: GoPlus "may flag unverified source code, fake tokens, or buy taxes," and Token Sniffer "may identify a contract as a scam."

What if a lookalike token shows up in your wallet?

Sometimes the copy comes to you. In address poisoning, Etherscan explains, attackers plant lookalike entries in your transaction history, using addresses that resemble ones you use and tokens named like familiar ones, hoping you'll later copy the wrong address. Etherscan's defenses are simple: save trusted addresses in your wallet's contact list or whitelist, be wary of the most recent address in your transfer history, and compare unfamiliar tokens against other sources.

Don't try to sell, swap or "claim" a token you never bought. Without verified code, Etherscan notes, you can't see what a contract will do when you sign, so you may grant approvals without knowing it. A copy can also be a honeypot that lets you buy but not sell.

What the AI Score shows

The AI Score answers five questions about a token, from "Is anyone building it?" to "Is the market agreeing?" It cannot tell you whether the contract in front of you is the one it scored. Confirm the address first: a strong score for the real token says nothing about a copy with the same ticker.

Check any token's AI Score on AiTokens.app before you decide.

Frequently Asked Questions

What is a lookalike token? A token that copies a known project's name, ticker or logo but lives at a different contract address. Its name proves nothing; the contract address is what identifies the real token.

Can two real tokens have the same ticker? Yes. Nothing in the ERC-20 standard reserves a name or ticker, and one project can have more than one legitimate contract, as Render does on Ethereum and Solana. The project's own docs say which addresses are current.

Does a verified contract mean a token is safe? No. Etherscan says verification means the published source code matches the deployed bytecode. It does not mean the contract is safe to interact with or that it has been audited.

What should I do if I bought a lookalike token? Don't send more money trying to sell or "unlock" it, and don't sign approvals for it. In the U.S., report it at ic3.gov and reportfraud.ftc.gov, and ignore anyone who offers to recover your funds for a fee.

Sources

• Ethereum Improvement Proposals, Fabian Vogelsteller and Vitalik Buterin: ERC-20: Token Standard, November 19, 2015
• Etherscan Information Center: How to Safely Interact with Smart Contracts on the Explorer, January 23, 2026
• Etherscan Information Center: Explore a Contract Address on Etherscan, March 11, 2020
• Etherscan Information Center: Etherscan Token Reputation, December 6, 2019
• Etherscan Information Center, Teck Yuan Lee: Address Poisoning Attacks, January 15, 2024
• Uniswap Labs: New Token Warnings and Labels on Uniswap Web and Wallet, December 19, 2024
• Render Network: Render Network Upgrade Portal FAQ, accessed October 16, 2026
• CoinGecko: Render (RENDER), contract addresses as listed on October 16, 2026

This article is for educational purposes and is not financial advice.