Someone sends you a token address and a source file and asks whether it is safe. The source file is not the contract. The contract is the bytecode sitting at that address. Everything below is about closing that gap with steps you can re-run yourself.

These are the three checks I run. A finding you cannot reproduce is an opinion.

Check 1: the bytecode against the source you were handed

Steps, in order.

Call eth_getCode on the address. Save the result. This is the truth, and every other step is a comparison against it.

Read the EIP-1967 implementation slot, 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc . If it is non-zero the address is a proxy, and the code you saved is a short forwarder. The source you were handed describes the implementation behind it, not the address you are holding.

Read the admin slot, 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103 . Then find out what the admin is.…