Stocks On Chain
NASDAQ 09:30-16:00 New York

← Wiki

Standard 4 min read

What is a beacon proxy, and how does it prove a token is real?

Most stock tokens hold your balance but almost no code. A fixed storage slot points at a beacon, the beacon points at the code, and where a token points is a test that a copy cannot pass.

How a call reaches the code, and what that proves

1. One call, three contracts

A token call passing through a proxy and a beacon to an implementation A reader calls the token address. The token contract holds the balances but almost no code. It reads one fixed storage slot to find the beacon, asks the beacon which implementation to use, and runs that code against its own storage. You, or a block explorer calls Token the address you were given holds every balance holds almost no code reads one slot Beacon the issuer's pointer contract names Code transfer, balanceOf the code runs, but the balances it changes stay in the Token

The balances never move. Only the question "whose code runs" is answered somewhere else.

2. Why that is a test

Many real tokens pointing at one issuer beacon, and a copy pointing elsewhere Every token an issuer deploys on a chain points at the same beacon. A copied token can use the same symbol and the same name, but it points at a beacon the issuer does not control, so the two are told apart by where they point rather than by what they say. Token A issued by the issuer Token B issued by the issuer Token C issued by the issuer One beacon the issuer controls it Token A a copy, same symbol Somewhere else or nothing at all The symbol is a label. Anyone can set it. Where the token points is not.

This is a test about structure, not about names. It is also not a statement that a token is safe.

Most tokenized stocks on EVM chains do not contain the code that makes them work. The contract at the address holds the balances. The code lives somewhere else, and the token finds it by reading a pointer.

That arrangement is called a proxy. EIP-1967 is the standard that says where the pointer is kept.

The problem the standard solves

A proxy has to store the address of its code somewhere. If it stores it in a normal contract variable, that variable sits in the first storage slots, which is exactly where the code being pointed at also puts its own variables. The two then write over each other.

EIP-1967 fixes this by putting the pointer in one specific, distant slot. For a beacon proxy the slot is:

0xa3f0ad74e5423aebfd80d3ef4346578335a9a72aeaee59ff6cb3582b35133d50

That number is the hash of the text eip1967.proxy.beacon, minus one. The subtraction is deliberate: it leaves a slot with no known preimage. Nobody knows what to hash to arrive at it, so no mapping or array can be arranged to land there, by accident or on purpose.

Because the slot is fixed by the standard, anything can read it. A block explorer that shows contract storage will show the value at that slot without the contract having to offer a function for it.

What the beacon adds

There are two common shapes. In the simpler one, each proxy stores the address of its code directly. In the beacon shape, each proxy stores the address of a beacon, and the beacon holds the code address.

The extra step gives one advantage: many tokens can share one beacon. An issuer with several hundred stock tokens on a chain points all of them at a single beacon. To change the code for all of them, the issuer changes one value in one contract. Without a beacon, the same change is one transaction per token.

This is the same argument that produced ERC-8056: a corporate action or an upgrade that has to touch every holder or every token one at a time is not practical at this scale.

Why it is a verification test

Anyone can deploy a token, call it AAPL, and give it the right name and decimals. The chain treats a symbol as a label, not as an identity. This is the problem checking a tokenized stock is real starts from.

A beacon changes what is being compared. The question stops being "does this token say the right things" and becomes "does this token point at the contract the issuer controls". A copy can set every label. It cannot get itself served by a beacon that belongs to somebody else.

For the issuers on this site that publish a beacon, the addresses are on the contracts page for developers, read from our registry rather than typed into this entry. The same test runs in our own pipeline before a new token is proposed for the registry at all.

One detail decides how strong the test is. The beacon has to be known independently, from the issuer or from tokens that were checked earlier. A beacon taken from the same list that is being checked proves nothing, because then the list is checking itself.

What it does not tell you

The test has narrow scope, and it is worth being exact about the edges.

It shows that a token was deployed by whoever controls the beacon. It does not say the token is a good thing to hold, that the issuer is solvent, or that the shares behind it exist. We do not grade contracts, and this is not a grade.

The same design also works against the holder. The beacon owner can point every token at different code whenever they choose. Holders are not asked. An upgradeable token is a token whose behaviour can change after you receive it, and the beacon is what makes that one transaction instead of hundreds.

And the test does not exist everywhere. Solana mints are Token-2022 accounts with extensions, not proxies, so there is no slot to read. Where a beacon test is not available, matching the mint address against the issuer's published list is what is left. A chain with no test is not the same as a token that failed one, and we say which applies where.

The short version

The token contract holds the balances. The code is in a different contract. EIP-1967 fixes the storage slot that records where to look, a beacon lets many tokens share one of those records, and that slot can be read by anyone. A copy can match every label on a token. It cannot match where the token points.

Frequently asked questions

Does a beacon proxy mean a token is safe?

No. It shows that the token was deployed by the same party that controls the beacon. It says nothing about the value of the token, the quality of the issuer, or whether you should hold one. We publish the test because it is checkable, not because it is a grade.

Can a copy point at the issuer's beacon?

A copy can set the same symbol, the same name and the same number of decimals, because those are labels. It cannot make the issuer's beacon serve it, because only the beacon owner controls what the beacon says.

Do all tokenized stocks use a beacon?

No. Solana mints are Token-2022 accounts with no proxy, so there is no beacon to read. A chain where the test does not exist is a different situation from a token that fails the test.

Can the issuer change the code after I hold the token?

Yes. That is what an upgradeable proxy is for. The beacon owner can point every token at new code in one transaction, and no holder is asked first.