Halloween in Web3: Spooky Crypto Tokens and dApps to Explore

Halloween themes fit crypto well, because the scariest things in the market are rarely monsters. They are mechanics: a token nobody can sell, a contract that behaves differently from what its front end says, a stablecoin that slips off its peg, a loan liquidated overnight. This guide uses Halloween imagery as a memory aid for real, well-documented risks, and points to dApps where those risks can be studied in the open.

Two ground rules apply throughout. First, this is education, not financial advice. Nothing here recommends buying any token, and seasonal themed tokens in particular tend to be short-lived, thinly traded and easy to manipulate. Second, anything involving prices, yields, total value locked or rankings changes constantly, so this guide quotes no figures. Check a data aggregator, the protocol's own dashboard and its documentation for current numbers.

The categories covered below:

• Ghost tokens: assets that remain on-chain with no real liquidity or activity.
• Vampires and zombies: liquidity migrations, forks and protocols that outlive their teams.
• Haunted contracts: exploits, honeypots and unreviewed code.
• Rug pulls: creators removing liquidity or dumping supply.
• Things that go bump: depegs and liquidations.
• Layered tokens: liquid staking and restaking wrappers.
• Trick-or-treat scams: approvals, poisoning and fake airdrops.

Each section ends with something practical to check, so the article works as a year-round reference rather than a seasonal curiosity.

A ghost token is one that still exists on-chain but has effectively died. The contract remains, wallets still show balances, and a price may even display, but there is little trading, no maintained liquidity and often no team. Holders discover the problem when they try to sell: the pool is so shallow that any meaningful order moves the price sharply, or there is no pool at all.

Ghost tokens also include tokens that were never alive in the first place, created to look like a real project and then abandoned after a short promotion.

Signs to look for:

• A single small liquidity pool, or liquidity held by one wallet.
• A handful of wallets holding most of the supply.
• An unverified contract, or one with owner functions that can change fees, pause transfers or mint more supply.
• No code repository activity, documentation or announcements for a long time.
• Trading volume that looks like the same few addresses swapping back and forth.

How to test before committing: use a swap interface such as Uniswap V4, Uniswap V3 or the aggregator Matcha to request a quote for a small amount, and read the price impact warning. A large impact on a tiny trade means the market is shallow. A quote is not proof you can sell, though. Some tokens allow buying but block selling, which is covered in the section on haunted contracts.

A price on a screen is only meaningful if you could exit at close to it. Depth matters more than headline market capitalisation, which is simply price multiplied by supply and says nothing about liquidity.

The most famous vampire attack happened in 2020. SushiSwap launched as a fork of Uniswap V2 code, offered its own token rewards to liquidity providers, and then migrated the liquidity that had been staked with it out of Uniswap and into its own contracts. The episode taught the industry that liquidity is mercenary: it goes where incentives are highest unless the underlying product is sticky.

Uniswap V2 is still a useful case study. Its constant-product design is simple, its code has been copied across many chains, and it sits alongside the newer Uniswap V3 and V4 designs, which add concentrated liquidity and, in V4, hooks. Reading how each version differs is a good way to understand what the original design left on the table.

A zombie protocol is the opposite situation: a fork or older deployment that keeps running with little or no maintenance. The contracts keep accepting deposits long after the team has moved on, and nobody is watching for oracle problems, parameter drift or dependency failures.

Convex Finance shows a third pattern. It does not fork Curve; it builds on top of it, aggregating rewards and letting CVX lockers vote on emissions. That layered position is part of why Curve incentives became a competitive contest among protocols.

What to check: whether the protocol is still publishing updates, whether governance is active, whether the incentive token is propping up the activity, and what happens to usage if the rewards stop.

A haunted contract looks fine on the surface and behaves badly underneath. There are two broad families.

Honest code with a flaw. Even well-regarded protocols have been exploited. Euler Finance suffered a large exploit in March 2023 through a flaw in how one of its functions handled donated collateral, and most of the funds were later returned after negotiation. The protocol was subsequently rebuilt as Euler V2, a modular design for lenders, borrowers and market curators. The lesson is not that any one protocol is cursed, but that audited code can still fail and that recovery is never guaranteed.

Malicious code by design. Honeypot tokens let anyone buy but block most sales. Others hide owner functions that can raise sell taxes to near 100 percent, blacklist addresses or mint unlimited supply.

Practical checks:

1. Confirm the contract is verified and that its address matches the one in the project's official documentation.
2. Look at which admin roles exist, who holds them and whether changes pass through a timelock.
3. Prefer code that has been live for a long time with large balances and has survived real scrutiny. Aave V3 and Compound V3 are examples of lending designs studied heavily by auditors and researchers.
4. Read how new designs such as Aave V4, with its hub-and-spoke structure, describe their risk model, and check the documentation for their current status.
5. Note that risk curators such as Gauntlet set parameters for vaults, which reduces some risks but adds a dependency on the curator.

Audits, bug bounties and time in production are signals, not guarantees.

A rug pull is when the people behind a token remove the value that makes it tradable. It takes a few common forms:

• Liquidity pull: the creator withdraws the pool's funds, leaving holders with a token that cannot be sold.
• Mint and dump: the creator creates new supply and sells it into the pool.
• Team dump: insiders sell large allocations soon after launch.
• Soft rug: the project slowly stops being maintained while insiders sell quietly.

Two mechanisms reduce these risks. A liquidity lock places the pool's liquidity tokens in a contract that releases them only after a set date, so the creator cannot withdraw immediately. Vesting releases team and investor tokens gradually rather than all at once. Team Finance is one non-custodial platform for this: projects use it to lock liquidity and team tokens, set vesting schedules, run staking pools and handle airdrops.

A lock is a signal of intent, not a guarantee. Before relying on one:

1. Check that the lock covers the main pool, not a minor one.
2. Check what percentage of the liquidity tokens is locked. Locking a small fraction proves little.
3. Note the unlock date and whether it can be extended or shortened.
4. Verify the token itself cannot be minted without limit or have transfers frozen.
5. Look at team vesting: cliffs and long schedules are better than short ones.

A locked pool on a token with an owner who can change sell taxes can still trap holders, so treat locks as one item on a longer list.

Some of the scariest moments in crypto are price events rather than hacks. A stablecoin is meant to hold a fixed value, and a depeg is when it does not. The best-known failure is Terra's UST in May 2022, an algorithmic stablecoin that lost its peg and collapsed together with its sister token.

Stablecoin designs differ in what stands behind them:

• Fiat-backed: reserves held off-chain by an issuer, which adds custody and counterparty risk.
• Crypto-overcollateralised: debt is backed by more crypto value than the amount minted. Liquity V2's BOLD, minted against ETH, wstETH or rETH with user-set interest rates, and Frankencoin's Swiss franc ZCHF are examples.
• Algorithmic: stability depends on incentives and market confidence, the weakest design in practice.

Liquidations are the other recurring fright. In lending markets such as Aave V3, Compound V3, Euler V2, SparkLend, Venus Core Pool and Dolomite, a loan is liquidated when its collateral value falls too close to the debt. Leveraged strategies, which loop borrowed funds back into collateral, tighten that margin.

What to check:

1. The asset's backing and who can change the rules.
2. Your health factor or liquidation threshold, and how fast a price fall could reach it.
3. The oracle that supplies prices, and what happens if it fails.
4. Whether interest rates are set by governance, by an algorithm or by you, as in Liquity V2, where a low self-set rate can expose a position to redemption.

Never borrow at the edge of your threshold.

Liquid staking turns a locked asset into a transferable receipt token. Stake ETH with Lido and you receive stETH; with Rocket Pool, rETH; with ether.fi Stake or Liquid Collective, their own tokens (LsETH in the latter case). On Solana, Jito Liquid Staking issues JitoSOL, Marinade issues mSOL and BlazeStake issues bSOL. Kinetiq offers kHYPE on Hyperliquid, and Lombard issues LBTC as a yield-bearing Bitcoin token. EigenCloud, from Eigen Labs, sits in the restaking family around the EIGEN token, and SSV Network provides distributed validator technology to spread validator keys across operators.

These tokens are useful, but each layer adds a way to go wrong:

• Smart contract risk in the staking protocol and in every dApp that accepts the token.
• Operator and slashing risk if validators misbehave or fail.
• Depeg risk: a receipt token can trade below the asset it represents when many holders want out at once. stETH did so during market stress in 2022.
• Governance risk where token holders can change parameters.
• Stacked risk when a receipt token is deposited into a lending market, borrowed against and restaked again.

What to check: how redemptions work, how decentralised the operator set is, whether the protocol publishes audits and incident history, and how deep the secondary market is for the receipt token. Current yields, fees and total staked amounts change often, so read them from the protocol's own dashboard rather than from a guide.

Holiday periods bring predictable scams, and most rely on getting a signature rather than breaking code.

• Fake airdrops and mints: a themed token appears in a wallet, or a site promises a free claim. Connecting and signing can grant a drainer permission to move assets.
• Unlimited approvals: approving a contract to spend a token without a cap leaves exposure long after the interaction ends.
• Address poisoning: an attacker sends tiny transfers from an address that resembles one you use, hoping you copy it from your history.
• Impersonation: fake support accounts, cloned websites and ads for lookalike dApps.
• Seasonal meme tokens: coordinated promotion followed by a sell-off.

Defensive habits:

1. Keep a separate wallet with a small balance for experiments, and a hardware wallet for long-term holdings.
2. Reach dApps through addresses from official documentation, and save them as bookmarks rather than searching each time.
3. Read wallet prompts. Be cautious with requests to sign messages you do not understand, and prefer wallets that simulate transactions.
4. Set spending approvals to the amount needed, and revoke old ones periodically with a reputable approval checker.
5. Never share a seed phrase or private key with anyone, including people claiming to be support.
6. Ignore unsolicited tokens. Do not try to sell or interact with them.
7. Verify the exact contract address of any token before swapping, since impostors reuse names and tickers.

If something goes wrong, move remaining assets to a fresh wallet immediately and revoke approvals.

The table below maps each Halloween theme to dApps where the underlying mechanism can be studied. It is a reading list, not a set of recommendations. Check current status, audits and risk disclosures in each protocol's own documentation before using it.

dApp	Spooky theme	What to study
Uniswap V2	Vampire attacks	Simple constant-product design and how forks copied it
Uniswap V4	Haunted flexibility	How hooks add features and why custom code needs scrutiny
Matcha	Ghost tokens	Price impact and routing when liquidity is thin
Team Finance	Rug pulls	Liquidity locks, vesting schedules and what they do not prove
Euler V2	Haunted contracts	Modular lending after a major exploit
Aave V3	Liquidations	Health factors, collateral and liquidation mechanics
Liquity V2	Depegs	Over-collateralised BOLD and user-set interest rates
Frankencoin	Oracle-free stablecoin	How a franc stablecoin manages collateral without a price oracle
Lido	Layered tokens	stETH, receipt token depeg risk and governance
Rocket Pool	Layered tokens	Decentralised node operation and rETH
Convex Finance	Zombie incentives	Vote-locking and emissions competition
Gauntlet	Risk curation	How parameters and vaults are managed

Centralised exchanges such as OKX, Bitget, Gate and Backpack also list many themed or newly launched tokens. A listing is not an endorsement, and holding assets there adds custody and counterparty risk. Check each exchange's listing policy and your local rules on who may use it.

Before touching any new token or dApp, run through this list. It takes a few minutes and filters out most of the avoidable losses.

1. Source: reach the project only through official channels, and confirm the contract address from its documentation.
2. Contract: is it verified, who holds admin roles, is there a timelock, can supply be minted or transfers be blocked?
3. Liquidity: how deep is the main pool, who supplied it, is it locked, and for how long?
4. Holders: is supply concentrated in a few wallets, or in addresses linked to the team?
5. Reviews: are there audits, a bug bounty and a track record of handling incidents? Read the scope of each audit.
6. Mechanism: can you explain in plain words where the yield or price stability comes from? If not, do not use it.
7. Exit: how would you leave in a bad market, and what would it cost? Test with a small amount first.
8. Size: only commit what you can afford to lose entirely, and avoid borrowing against volatile collateral at tight margins.
9. Legal: rules on crypto services, derivatives and token offers vary by country and region. Check what applies to you, and any age requirements, before using a service.

Keep numbers like prices, yields, total value locked and rankings out of your decisions until you have checked them at the source, on the day. Figures in articles go stale quickly, while the mechanics above change slowly. Understanding the mechanics is what keeps the scary stories in this guide from becoming your own.