can the owner of a contract actually take tokens from you if it's written like that in a contract? How come such contracts are actually allowed to be lsited on exchange sites.

How could you actually prevent being scammed?

An example in a code i've seen:

/* administrative functions */

 * @dev Change owner.
 * @param _who The address of new owner.
function changeOwner(address _who) external onlyOwner {
    assert(_who != address(0));
    owner = _who;


And other similiar functions. As said in the comments, how could i actually check that the source code matches on the actual contract?

  • could you provide an example? contracts can have any functionality written into them, i'm not sure exactly what you're referring to. the easy way to prevent being scammed is to read the contracts code and know if it's possible for someone to steal your tokens. – flygoing Nov 20 '17 at 17:06
  • Alright, let me paste an example – LemonCold Nov 20 '17 at 17:09
  • Changeowner functions swaps admin user, Assume A is admin user and he wants to quit his admin duty,so he assigns B as admin and now A is no more admin. I am not sure what you mean by owner taking token from you ?,It is indeed the owner who transfer tokens to you upon paying x ethers. – Rangesh Nov 20 '17 at 17:18
  • Yes, but the question still stands though. Could there actually be code that transfers balance from person A to person B, using code? – LemonCold Nov 20 '17 at 17:23

The example you pasted above does not change the ownership of the tokens themselves, but of the contract that holds said tokens.

The purpose of the function in this particular case seems to be to allow the owner of this contract to pass ownership to someone else so that person manages the contract or even receives the funds people contribute, probably.

So, no, in this case, by calling this function the owner of the contract won't be able to take your tokens.

Checking that the code of the contract actually matches what its developers say it does can be accomplished by searching the contract address on Etherscan. If they uploaded the code, a Contract Source (yes) tab will show with the actual code.

| improve this answer | |

Thanks for adding an example.

Your example is normal. That's not changing the owner of tokens, it's changing ownership of the contract. The contract has the modifier "onlyOwner", which is usually a modifier function declared in the contract that only allows the contract owner to call the function.

Most ICOs or other large projects will verify their code on Etherscan. For example, here is the code to the Raiden token. You can also verify yourself that etherscan isn't lying by taking the source code provided, compiling it yourself, and making sure it matches the bytecode at that contract address.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.