That's true. Even though you checked the whitepaper of the project and thoroughly examined the project, there still a chance that the project is scam. Though sometimes the project is not scam but the token it produce may be a scam coin.