The Name Is Free: Five Red Flags Before You Swap on Base

The Scheme

On Base, a token's name, symbol and logo are just text its deployer types in. Impostor contracts reuse the names and tickers of trusted assets, borrow the authority of words like Fund or Reserve, and rely on buyers who search a ticker, see a familiar label and approve the first result. The only identity that cannot be copied is the contract address.

1. Ten Minutes, 978 Brands

On 20 October 2026, between 17:08:59 and 17:18:57 UTC, the desk read every ERC-20 Transfer event on Base across 300 consecutive blocks, numbers 52,863,396 to 52,863,695. That is roughly ten minutes. It held 92,746 token transfers from 978 different token contracts.

Then we asked each contract one question: what do you call yourself? The ERC-20 standard lets a contract answer with any symbol and any name its deployer chose. Nobody checks. There is no registry, no trademark office and no bouncer at the door.

Method note: we queried public Base nodes for Transfer and Approval events, read each contract's symbol, name, decimals and owner directly from the chain, and cross-checked suspicious contracts with GoPlus Security's public token API. Anyone with an RPC endpoint can rerun the same block range. Every contract below is identified with a shortened address linked to BaseScan, so you can verify it yourself. Nothing here is a confirmed theft; these are the conditions a theft needs.

3. Red Flag Two: The Ticker Is a Costume

Across those ten minutes, 27 contracts besides native USDC and bridged USDT had a ticker starting with USD. Some are legitimate, well-known products. Others are not. The ticker cannot tell you which, and that is the whole trick.

It gets better. Seven different contracts called themselves USDF. Another seven were USDP. Six more were AODF. Same ticker, different contract, different owner of the risk. A chart site, a Telegram shill and a swap search can each be showing you a different one while everyone says the same three letters with a straight face.

This is the token version of the lookalike address we measured in the four-minute twin: the label is copied because labels are what people read. We saw the same costume trade in the USDT-Z honeypot case, only there the disguise came with a lock on the exit.

The check:* if a ticker returns more than one result, stop. A collision is not a coincidence to be resolved by picking the one with the nicer logo.

5. Red Flag Four: The Signature Is the Purchase

Buying a token on Base usually starts with an approval: permission for a router or contract to move your tokens. In a 600-block window ending at the same block, we counted 20,307 ERC-20 Approval events. 1,319 granted an effectively unlimited allowance, 1,152 of them the exact maximum number the standard allows, from 618 addresses to 205 different spenders. Uniswap's Permit2 contract was among the most frequent recipients.

Caveat, so nobody quotes us wrong: some token contracts emit Approval events during ordinary transfers, and many approvals come from bots. These are events, not a count of people. The point is the shape. Unlimited approvals are routine, which is exactly why a malicious spender hides comfortably in the crowd.

An unlimited approval to an impostor contract, or to a fake front end posing as a familiar DEX, does not expire when you close the tab. That pattern ran through the approval phishing case we covered earlier.

The check: approve only the amount you are swapping, read which contract is the spender, and review old allowances with a tool such as Revoke.cash.

7. The Sixty-Second Pre-Swap Routine

Address first, name never. Copy the contract from the issuer's official documentation or Base's own docs, not from a search result, a reply or a chart site.

Resolve every collision. If the same ticker returns several contracts, assume at least one is wearing a costume and verify the address before choosing.

Distrust borrowed authority. Words like Fund, Reserve, Dividend or Official are free to type. Look for the regulated entity behind them, not the emoji next to them.

Cap the approval. Approve the swap amount only, confirm the spender, and clean up old allowances regularly.

Read four numbers. Decimals, holders, creation date and creator on BaseScan, then a token scanner for fake, mint and pause flags. Note that CryptoStrapon's wallet check does not currently cover Base, so the explorer and a token scanner are your tools here, whether you arrived via Aerodrome, a Clanker launch or a link from a stranger.