Reading a contract without trusting its README

The X-ray reads the bytecode of a mainnet address directly from public nodes and extracts the function selectors, the proxy slots defined by ERC-1967 and older Zeppelin layouts, the owner and paused state, and the dangerous opcodes: SELFDESTRUCT, DELEGATECALL and CREATE2. Sourcify tells whether the published source matches what is deployed.

The risk signals are exactly that: signals. An upgradeable proxy means the logic can change under your feet, an owner key means one private key controls privileged functions, a mint function means the supply can grow. Each is normal for some protocols and fatal for others; the question is who holds the key and how it is governed.

Unverified source is the one signal that should stop a transaction outright. If the deployed code cannot be matched to readable source, nobody outside the deployer knows what it does.