Direct answer

To use a DEX safely: trade from a wallet that holds only what you are trading, reach the site by typing the domain yourself, verify the token's contract address from a source the project controls, size your trade against pool depth rather than intent, read every signature — especially approvals — and revoke approvals afterwards. The first step matters most, because it works without requiring you to correctly identify a threat.

Step 1 — Use the right wallet

Before anything else. Trade from a wallet holding roughly what you are trading, not from the one holding everything.

A malicious approval signed from a small wallet costs you that wallet. The identical signature from your main wallet costs you everything. This is the only measure here that works without you having to correctly judge whether a contract is malicious — which is exactly the judgement attackers work to defeat.

See how to protect your wallet.

Step 2 — Reach the real site

Type the domain, or use a bookmark you created by typing it. Never from a search advertisement, a message, or a reply.

Paid impersonation ads on DEX brand searches are routine, and a cloned interface is indistinguishable from the real one — it can even execute real swaps while slipping one malicious approval into the flow.

A password manager helps here in a way your eyes do not: it will not autofill on the wrong domain.

Step 3 — Verify the token

Nobody vetted this token. Anyone can deploy a contract using an existing project's name and ticker, and create a pool for it.

Get the contract address from the project's own domain or verified account.
Confirm the chain.
Check source is verified on a block explorer.
Look for asymmetric or owner-mutable sell fees — the honeypot pattern.

Full routine: how to verify a smart contract.

Step 4 — Check the pool before sizing

Price impact is arithmetic you can compute in advance: your execution impact is simply your trade size divided by the pool's reserve of the asset you are spending.

Look at pool reserves, not just the quoted price.
Check the displayed price impact before confirming.
If impact is high, the trade is too large for this pool right now — split it or reduce it.

A pool with little liquidity will still fill your order. That is the trap: an order book runs out, a constant-product curve never does. See how decentralized exchanges work.

Step 5 — Set slippage tolerance deliberately

Set it to the smallest value that reliably executes.

Tolerance does not reduce price impact. It defines how much additional adverse movement you will accept from other transactions landing before yours — which on a public mempool is the budget available to anyone sandwiching your trade.

Raising tolerance until the transaction succeeds is paying an unknown amount to an unknown party to avoid diagnosing a sizing problem.

Step 6 — Read every signature

The step that prevents the largest losses.

Prompt	Ask
Approve	Which token, which contract, what amount? Can it be finite?
Permit (gasless)	Same authority as Approve, no gas. Read it just as carefully.
Swap	Do the amounts and the destination match what I intended?
Message	What am I attesting to? Not all messages are just sign-ins.

A gasless signature is not a harmless signature. See wallet-based trading.

Step 7 — Check you can exit

Before buying, ask what selling would look like: the same pool, the same curve, the same impact — plus whatever the contract does on a sell.

A token that can be bought and not sold is a honeypot, and it looks completely normal from the buy side.

Step 8 — Revoke afterwards

Approvals persist until revoked. When you are finished with a contract, remove its permission.

Make this periodic rather than heroic: a scheduled review of outstanding approvals catches the ones you forgot.

The short routine

Trading from a wallet sized to this trade
Reached the site by typing the domain
Contract address verified from a project-controlled source
Source code verified on an explorer; no asymmetric sell fee
Pool depth checked; impact acceptable at my size
Slippage tolerance minimal
Every signature read — token, contract, amount
Exit path considered
Approvals revoked when finished

What this does not protect against

Being honest about the limits: this routine does not protect against a contract bug in a legitimate protocol, a token that is real but fails, an upgradeable contract that changes after you check, or a chain-level failure.

It substantially reduces impersonation, honeypot, approval-drain and sizing losses — which are the majority of avoidable ones. Position size remains the control that actually bounds a loss.

How to Use a Decentralized Exchange Safely