Searching for a coin by the name on the screen is how most people start, because the search returns an icon you recognize and a price that sits near the chart you already watched. The name feels like enough. What you actually receive is the contract or listing sitting behind that label.
On a permissionless chain, anyone can deploy a token and copy a familiar name, so a spoofed website can look like the app you meant to open, and a signature prompt can spend after you already approved a helper contract once. Matching names is how the search starts, while finishing the check means matching the issuer's published contract, character by character.
Address matching is that check: you copy the contract from a page the issuer published, paste it beside what the wallet shows, and expand a truncated display before you swap or sign. A claim page or a login-shaped signature still sits on the same split, which is the tab in front of you versus the contract you meant to use.
Canonical Ethereum UNI is the contract Uniswap published at genesis, 0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984. A look-alike ticker, a clone Uniswap tab, and a Permit2 prompt dressed as a login all attach to that same token, and what Uniswap is is the protocol picture.
How to read the canonical Ethereum UNI address
The Ethereum hex Uniswap published at genesis is the string to match, so copy that string from Uniswap's own post or token page and then check every character. A wallet search that returns UNI by name still needs that check, because the ticker in the result is only a label.
The genesis post names UNI as the Uniswap Protocol token and prints the Ethereum contract 0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984 (source: Uniswap Blog, Introducing UNI). Copy from that post or from a bookmark of it, and skip search ads, chat screenshots, and a token that appeared in the wallet uninvited.
The live token page still lists the same Ethereum mainnet UNI Token as that hex, and UNI is available as a bridged token on several networks (source: Uniswap Docs, UNI Token). Bridged UNI on another chain uses a different contract by design, which is a later split, so on Ethereum the genesis string is the one to match.
Read the hex the way you would read a bank account number you were about to paste, because mixed-case characters in that string are a checksum Uniswap published. If your screen shows only the first six and last four characters, expand it, since truncation is how two contracts can look like one.
A practical copy check starts on a quiet day: open Introducing UNI, or the developers UNI token page, from a bookmark you already made, copy the Ethereum UNI Token string in full, and paste it into the wallet or explorer search. Type it from the page rather than from memory, then compare character by character, including the 0x prefix and the mixed-case characters. If even one character differs, you are looking at a different contract.
The UNI token is what that contract represents as a vote token, and the hex is how you know you are holding that token rather than a namesake. Save the official URL, and treat a PDF or a Telegram screenshot of the same hex as a copy you still have to re-check against the post.
If a friend sends "the UNI address" in a DM, still open the genesis post and compare, because helpful people forward look-alikes by accident. The post is short, and the cost of opening it is smaller than the cost of a swap into the wrong ERC-20. A block explorer search for the official hex is a second check, so if the explorer label and the genesis post disagree, trust the post and stop.
When a UNI ticker is a different ERC-20
Anyone can deploy an ERC-20 and set the ticker to UNI, and the chain will show that ticker in a search box next to an icon that looks familiar. The ticker leaves the name unreserved on Ethereum, because only the contract reserves it, and a look-alike can sit one result above the real one.
ethereum.org states that scam tokens impersonate legitimate tokens and can use the same name and symbol, while the contract address stays unique to the real token. For the real hex, use the issuer: the best source for the address of the legitimate token is the organization whose token it is (source: ethereum.org, How to identify scam tokens). Uniswap's issuer source for Ethereum UNI is the genesis post and the developers UNI token page, so a Dexscreener listing, a trending list, or a wallet auto-detect is a search result, while Uniswap publishes the address on those two pages.
Look-alikes often rhyme on purpose, with extra characters, a homoglyph, a UNI2 suffix, or an icon stolen from the real token page. Liquidity can look busy for a few blocks, and price can sit near the real UNI chart, yet none of that copies 0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984. If you swapped into the look-alike, you now hold that other contract, and selling it back can fail, tax you, or route through a pool the deployer controls.
Keep two different-address cases apart. Ethereum UNI beside a second UNI ticker on Ethereum is a look-alike ERC-20, so stop and match the genesis hex. Ethereum UNI beside UNI on another chain is bridged or mapped UNI, so confirm the chain, then the docs table for that chain. A pool token or LP position labeled UNI is a different contract on purpose, so read the pool rather than the ticker.
The case that fools careful people is the bridge, because bridged UNI is still the Uniswap vote token on that chain and it is also a different hex. How to send and receive UNI is the page for wrong-network sends. A look-alike on Ethereum is a fake ticker, which is a different problem from a bridge.
Fake Uniswap sites and claim pages
A clone site borrows Uniswap's layout so you will connect a wallet and approve a contract, which means the pool contracts can be fine while the tab in front of you is the attack. Type the host before you connect, and treat a sponsored Uniswap result as a stranger.
Labs names that pattern in plain language: these fake websites are created to trick victims into approving a malicious contract, so always confirm that the URL of the website you are on matches the official site (source: Uniswap Labs support, Impersonation website scams). Skip a Discord link or a "support" handle that DMs first.
Claim pages are the Uniswap-shaped version of that clone, because they say UNI has arrived, a migration is due, or a refund is waiting. Labs' claim article is dated and narrow: the UNI token airdrop was held on September 1, 2020, at 12:00 am UTC, and Labs treats that event as the only Uniswap airdrop affiliated with the Uniswap Protocol. Eligible wallets connect at app.uniswap.org on that same article (source: Uniswap Labs support, How do I claim the Uniswap UNI Token Airdrop?). A 2026 "claim UNI" microsite sits outside that event, and official airdrop news, Labs says, comes from Uniswap Labs or Uniswap Foundation on X, plus [email protected].
A generic phishing walkthrough sits on BloFin's phishing in crypto page. The Uniswap-specific tell is the combination of a Uniswap-looking host plus a claim, migrate, or refund story after September 1, 2020.
Hosts rot, bookmarks rot, and a PDF from a group chat can sit one character off app.uniswap.org, because homographs and extra hyphens are cheap. If the tab asks you to type a recovery phrase to "sync Uniswap", close it, since Labs support collects seed phrases through support channels. If a browser, wallet, or ISP warning fires, treat that as a stop. Labs states that the team will skip DMing you on Discord (source: Uniswap Labs support, Official Uniswap Labs links).
When you meant to use the Labs app, type app.uniswap.org yourself and watch the certificate and the host. Connecting lets the tab see an address, while signing is the later step, so a connect on a clone is already further than you wanted to go. Back out, revoke later if you approved, and start from a typed host. Paid search can sit above the host you meant to type, and clicking it is how clone tabs get a session.
What a Permit2 phishing prompt is asking you to grant
Permit2 is a Uniswap Labs approval contract that lets apps share token allowances, which makes it a spend permission. Read the prompt as a grant, even when the site labeled the button Sign in, because a UniswapX fill is a different product and a login is a different action.
Labs describes two steps. The first is a one-time onchain approval that sets Permit2 as a spender and costs gas, and then comes the free signature. That second step gives the protocol permission to swap the tokens from your wallet, and on the same page it has no network cost, so after that first approve a later signature can spend without a new fee. Labs' risk line is that any onchain token approval to the Permit2 contract is vulnerable to a malicious signature approval. Phishing copy on that page includes a site asking you to prove you own your wallet, or saying you need to sign in with your wallet (source: Uniswap Labs support, What is a Permit2 approval?). Labs' same page says the Uniswap app uses a limited-time signature of 30 days, which is Labs describing its app. A clone can ask for more, for longer, or for a spender you have never seen.
Before you tap Sign, read three fields together. Spender is the contract that will move tokens, so if you cannot match it to the app you typed, reject. Amount should match the swap you meant rather than your whole balance, and skip "unlimited" unless you meant that. Time should be a short window you can explain, because years of remaining time is a stop.
A connect prompt only shows your address to the site, while an ordinary onchain approve costs gas and sets a spender. A Permit2 signature can sit on top of an older approve and move coins with no extra fee, so only the last two move tokens. The phishing version dresses the last one as a login, and if the site needed you to prove ownership, it can wait while you read, because a rushed Sign is a send.
You can reject a bad Permit2 without understanding UniswapX reactors. If the tab is a clone, the signature is for that clone's spender, and if you already approved Permit2 on the real app last year, that old approve is what makes the new signature dangerous. Revoke tools cost gas, while an unread Sign is how the grant travels, so write down the spender you thought you were using before you tap. If the wallet shows a different one, the prompt is already the wrong grant.
How a look-alike fill actually lands
Suppose you meant to swap about 40 UNI for USDC on a Uniswap-looking tab, typed UNI into the token search, and tapped the first of two identical icons. The hex was truncated, and the next prompt asked you to sign with no network fee.
You skipped Introducing UNI, and the tab then offered a UNI-has-arrived banner and asked you to claim the rest of an airdrop, which felt like logging in. The first result was a different ERC-20 that reused the UNI ticker. The banner was a claim page of the kind Labs dates to a 2020 event, and the signature was a Permit2 grant to a spender you had never bookmarked. Because you had approved Permit2 on a real Uniswap swap months earlier, the new signature skipped a fresh gas approve, so the clone paid the later transfer. Your 40 UNI, and then more of the same wallet's tokens, moved while you waited for a claim confirmation that never belonged to Uniswap.
The stop that would have worked is boring, which is the point: expand the truncated hex and match 0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984, type app.uniswap.org instead of clicking the banner, and read spender, amount, and time on the Permit2 prompt before you reject a login-shaped grant. After a bad sign, the chain will skip rewinding it, and how to store UNI is the later custody page.
Sweep remaining tokens off a drained wallet only after you understand what you signed, because a drained signing wallet is still a keys problem, and what self-custody is is that picture. Speed is how 40 UNI became the clone's inventory.
The pools you thought you were using may have been fine. You selected a namesake ticker, on a namesake host, and granted a spend, which are three separate checks, and any one of them could have ended the story. A protocol audit reads the contracts, and whether Uniswap is safe names audits, hooks, governance, and venue risk in one place.
What a listed UNI/USDT pair actually certifies
A centralized book can list UNI while a wallet search still returns a look-alike, and those are different paths: the exchange line is the venue's UNI, and the search box is whatever ERC-20 you pick. A live listed pair certifies the venue's UNI, and it leaves the next contract you tap in a dapp as a separate check.
BloFin has listed UNI/USDT on spot since January 15, 2024.
BloFin lists two UNI perpetuals: UNIUSDT at up to 75x, listed January 12, 2023, and UNIUSD, an inverse contract settled in UNI, at up to 20x. A fill on those markets is still the exchange's UNI, and it leaves a token you later tap in a dapp search as a separate check. Uniswap is a competing DEX, and naming it that way keeps the paths apart.
DEX and CEX differences is the custody split, with the book as one path and the wallet search as another.
How to buy UNI covers buying the token safely. Generic email and seed-phrase patterns are a different security topic than a Uniswap-looking host, so the remaining checks are the fake ticker, the fake site, and the Permit2 prompt.
After a bad signature, Ethereum stays as written, and there is also no BloFin button that reaches into a self-custody wallet you already drained. Withdrawals you still control can move to a fresh wallet, while signed grants you already gave stay until you revoke them, if anything is left to revoke. If the wallet still holds other tokens, treat every old Permit2 allowance as live until you check a revoke tool, because gas to revoke is cheaper than another silent spend.
Frequently asked questions
If a wallet shows only the last four characters of a UNI address, can I treat a match as canonical UNI?
Treat a last-four match as unfinished, because canonical Ethereum UNI is the full genesis hex from Introducing UNI. Expand the listing, paste that official string beside it, and compare every character, including mixed-case characters. A last-four match is a coincidence you can get from many ERC-20s, so if the UI keeps the hex truncated, open a block explorer from a typed URL and search the official string instead of the ticker.
If a BloFin UNI/USDT withdrawal is still pending, and I already signed a clone Permit2, which timeline do I check first?
Check both timelines as separate events. The venue withdrawal is still a BloFin ledger event until it leaves the book, and support can talk about that pending transfer, while the Permit2 signature is an Ethereum grant the moment the chain accepts it. Signing leaves a pending withdrawal in place, and a pending withdrawal leaves a signed grant in place, so open the venue status for the withdrawal and an explorer for the Permit2 spender. Treat them as separate rails, rather than one reverse button.
A Discord invite opened a Uniswap-looking tab. Is that the same problem as an in-app popup card?
An invite is a URL someone sent you, while a popup or in-app card is a message inside a client you already had open, and both can land on a clone host. The Discord channel leaves the host uncertified, so type app.uniswap.org yourself and skip the invite's destination. A clone can sit behind a server name you recognize, and closing the invite tab leaves a signature you already gave as a separate revoke.
If the Uniswap app's 30-day Permit2 signature expires, is the old onchain approve gone too?
Labs' Permit2 page describes a limited-time signature of 30 days on the Uniswap app, and that window is the signature rather than the earlier onchain approve that named Permit2 as a spender. The approve stays until you revoke it, so expiry of a Labs-described signature leaves that allowance in place, and a later clone prompt can still ride the standing spender grant. Check a revoke tool for an open Permit2 allowance on that token.
Should I paste the Ethereum UNI address if the docs table omits my chain?
Ethereum's genesis hex is canonical UNI on Ethereum, so use it on Ethereum. The developers UNI page lists other-network addresses for chains where the protocol fee is active. A missing listing there leaves mapping unproven, and it also leaves the Ethereum hex as an Ethereum string, so treat a UNI ticker on that chain as undocumented until a named Uniswap listing exists for that chain. Stay on a chain the table names, or wait until a named Uniswap listing exists for that chain.
Does a green check in a wallet token search prove I selected canonical UNI?
A checkmark is the wallet's badge, while Uniswap publishes the contract on Introducing UNI and the developers table. Wallets score lists, user reports, or tokenlists, and those feeds can lag, so look-alikes can sit one result away with a similar icon. The proof is a character-exact match to Introducing UNI on Ethereum, or to the developers table on another chain. Use the badge as a hint to slow down, then still paste the official hex, and if the badge and the hex disagree, the hex wins.
If I signed a clone Permit2 but the wallet still shows UNI, did the grant fail?
An allowance can sit unused until the clone calls it, so remaining UNI on that line leaves the grant live until you check. Open a block explorer, find the Permit2 spender, and look for an open allowance and for later transfers. If the allowance is still open, revoke it, and if UNI already left, revoke still stops the next pull. A full balance is a snapshot.
Researched and written by the BloFin Academy editorial team with AI-assisted drafting. Updated September 2026. Primary sources include Uniswap's Introducing UNI post, the Uniswap Docs UNI token page, ethereum.org on identifying scam tokens, Uniswap Labs pages on impersonation sites, official Labs links, the UNI airdrop claim, Permit2 approvals, and BloFin's public instrument lists. All facts independently verified against cited documentation current as of September 2026.
This article is educational and general in nature, not financial or investment advice. Cryptocurrencies like UNI carry real risks, including fake tokens, clone sites, signature phishing, and irreversible onchain transfers. Nothing here is a recommendation to buy, sell, hold, or interact with any contract. Do your own research, and consider speaking with a licensed professional before making financial decisions. BloFin does not provide investment advice.