Rug Pull Check
Published · 11 min read
How to run a rug pull check that actually works: the seven on-chain conditions scanners test, which tool covers which chain, and the four failure modes no scanner can see.
TL;DR: A rug pull check tests mint authority, freeze authority, LP lock status, holder concentration, transfer taxes, upgradeable proxies, and honeypot behaviour. Scanners automate the first six and miss every social and governance risk entirely.
Table of contents
A rug pull check inspects a token's on-chain permissions before you buy, to find out whether the deployer can still mint new supply, freeze your wallet, drain the liquidity pool, or block you from selling. Free scanners automate most of this in a few seconds. They also miss entire categories of risk, and knowing which categories is the difference between a useful check and false confidence.
The seven conditions a rug pull check should test
Run these in order. The first three are hard blockers — if any fails, nothing else matters.
| # | Condition | What a failure means | Where to verify |
|---|---|---|---|
| 1 | Mint authority | Deployer can create unlimited new supply and dump it | Solana: mint authority field. EVM: a mint() function with an owner modifier |
| 2 | Liquidity locked or burned | Deployer can withdraw the pool and leave you holding nothing | LP token holder — burn address, a locker contract, or the deployer |
| 3 | Freeze / blacklist authority | Deployer can stop you selling while they exit | Solana: freeze authority. EVM: blacklist, setTrading, pause functions |
| 4 | Holder concentration | A handful of wallets can crater the price at will | Top 10 holder share, excluding the LP and locker contracts |
| 5 | Transfer tax / fee logic | A sell tax that can be raised to 100% after launch is a soft rug | _taxFee, setFees, or any owner-settable rate |
| 6 | Upgradeable proxy | Today's safe contract can be replaced with a malicious one tomorrow | Proxy pattern with an admin key, no timelock |
| 7 | Honeypot behaviour | You can buy but not sell | Simulated buy-then-sell against a forked state |
Chains fail differently
On Solana, the dangerous powers are explicit fields on the mint account: mintAuthority and freezeAuthority. Both should read null. Token-2022 adds extensions — a transfer hook or permanent delegate can move tokens out of your wallet by design, so a Token-2022 mint needs its extension list checked too.
On EVM chains, there are no standard fields. Every power lives in arbitrary Solidity, so the check is "read the source and find the owner-only functions." Unverified source code on the explorer is itself a failing result — you cannot check what you cannot read.
Which scanner to use
These are the tools that hold the top of the search results, and they do not all do the same job.
| Tool | Chains | Strongest at | Watch out for |
|---|---|---|---|
| RugCheck | Solana, Fogo | Mint/freeze authority, LP status, holder breakdown | Solana-first; not an EVM tool |
| GeckoTerminal | Many EVM + Solana | Pool-level liquidity and volume context | Security flags are lighter than a dedicated scanner |
| De.Fi Scanner | Broad EVM coverage | Contract permission analysis, exploit history | Depth varies by chain |
| Solana Tracker | Solana | Holder and deployer wallet history | Same single-chain limit |
Use two from different vendors. They disagree more often than you would expect, and a disagreement is a signal to go and read the contract yourself.
How to read a liquidity result properly
Liquidity is where the money physically sits, so it deserves more than a green tick. Four questions, in order:
Is the LP burned, locked, or neither?
Burned means the LP tokens went to a dead address and cannot be withdrawn by anyone, ever. Locked means they sit in a time-locked contract. Neither means the deployer can pull the pool right now.
If locked, until when?
A lock expiring in six days is not a lock, it is a countdown. Check the unlock timestamp on the locker contract directly rather than trusting a badge in a UI.
What proportion is locked?
Locking 5% of the LP and advertising "liquidity locked" is a standard move. You want the share of total LP tokens, not the existence of a lock.
How deep is the pool relative to your trade?
A $12,000 pool with a locked LP is still a pool where a $2,000 sell moves the price double digits. Lock status and depth are separate risks.
The four things no rug pull check can see
This is the section the ranking pages leave out, and it is where most losses actually happen.
- 01
Distributed team wallets
Supply split across 40 fresh wallets reads as healthy decentralisation. Concentration metrics measure addresses, not people.
- 02
Off-chain key control
A contract with no owner can still be governed by a multisig whose signers are one person with three laptops. The chain cannot see who holds the keys.
- 03
The slow exit
No malicious function is ever called. The team stops shipping, the docs go stale, liquidity thins as LPs leave. Terminal, and completely invisible to a scanner.
- 04
Social compromise
The contract is fine; the project's X account is hacked and the pinned link is a drainer. The token is safe, the user is not.
That last one stopped being theoretical this month. On 23 July 2026 a fake token was promoted through the compromised X account of Robinhood's CEO — the contract behind it kept collecting fees after the hack was public. Any scanner pointed at that token would have reported on the token. None of them could report on the account that promoted it.
Two things we have learned running these checks routinely.
Scanners disagree, and the disagreement is the useful output. When one tool flags a mutable fee function and another does not, the second tool has usually not parsed a non-standard implementation rather than confirmed safety. We treat any split verdict as a fail until we have read the function ourselves.
The scariest result is the boring one. Outright honeypots get caught. What survives a scan is the token with a legitimate contract, a real 12-month lock, and 38 wallets funded from the same exchange withdrawal address within an hour of each other. Nothing in that is a flagged condition. All of it is one person.
Deployer wallet history is the check with the best signal-to-noise ratio, and it is the one almost nobody runs. Look at what else the deployer address has launched. Serial deployers are a pattern you can see for free.
A rug pull check you can run in five minutes
- Scan with two tools from different vendors. Note every disagreement.
- Confirm mint and freeze authority are revoked. Solana: both fields null. EVM: read the verified source for owner-only supply or transfer functions.
- Open the LP position directly — burn address, locker contract with an unlock date, or deployer wallet. Record which, and the percentage.
- Sort holders by size, excluding LP and locker contracts. Ask whether the top 10 could exit into the available depth.
- Check the deployer's other deployments. One address, many launches, is the single strongest predictor available on-chain.
- Verify the social links from the contract outward, not inward. Start at the token address on the explorer and follow to the official site — never start from a link in a group chat.
- Simulate a sell before you buy, at the size you intend to exit with.
Steps 5 and 7 are the two that separate a real check from a badge-collecting exercise.
A rug pull check does not protect your wallet
These checks tell you whether a token is dangerous. They say nothing about whether the transaction you are about to sign is dangerous. Approving an unlimited allowance to a malicious router will empty your wallet regardless of how clean the token scanned — see token approval checker for how allowances persist after you close the tab.
Rug pull vs pump and dump
These get used interchangeably and they are not the same event.
Holds up
- Rug pull: the team removes the ability to exit — liquidity withdrawn, sells blocked, or supply inflated
- Rug pull: usually a single on-chain action with a clear timestamp
- Rug pull: often detectable in advance from contract permissions
- Rug pull: the market never had a fair price to sell into
Costs you
- Pump and dump: the market keeps working; insiders simply sell into demand they manufactured
- Pump and dump: plays out over hours or weeks with no single decisive transaction
- Pump and dump: no malicious contract function is required, so scanners see nothing
- Pump and dump: you could have sold — the problem was the price, not the exit
The practical consequence: a rug pull check is a defence against the first and almost useless against the second. Guarding against a pump and dump is a position-sizing and holder-concentration question, not a contract question.
Token contracts are one layer. If you are depositing into a yield program rather than buying a token, our health checker covers the structural questions a scanner does not ask.
FAQ
›What does a rug pull check actually test?
Seven on-chain conditions: whether mint authority is revoked, whether liquidity is locked or burned, whether freeze or blacklist authority exists, how concentrated the holders are, whether transfer taxes can be changed, whether the contract is an upgradeable proxy, and whether a sell actually succeeds in simulation.
›Is a free rug pull checker reliable?
For mechanical contract risks, yes — tools like RugCheck, De.Fi, and GeckoTerminal catch mint authority, LP status, and honeypot behaviour reliably. They cannot detect distributed team wallets, off-chain key control, a slow abandonment, or a compromised social account. Use two tools and treat disagreements as a fail.
›What is the single most important check?
Liquidity. Confirm whether the LP tokens are burned, locked, or still held by the deployer; if locked, check the unlock date and what percentage of total LP is covered. A partial lock on a shallow pool is a common way to display a 'liquidity locked' badge honestly while leaving the exit open.
›How is a rug pull different from a pump and dump?
A rug pull removes your ability to exit — liquidity is withdrawn, sells are blocked, or supply is inflated. A pump and dump leaves the market functioning while insiders sell into demand they created. Contract scanners can often predict the first and essentially never predict the second.
›Can a token be safe on Solana but the check still miss something?
Yes. Null mint and freeze authority is the standard check, but Token-2022 mints support extensions such as transfer hooks and permanent delegates that can move tokens from your wallet by design. A Token-2022 token needs its extension list reviewed in addition to the authority fields.
›Does a clean rug pull check mean the token is a good investment?
No. It means six specific mechanical traps are absent. It says nothing about valuation, team competence, whether the product works, or whether holders are concentrated in wallets controlled by one person.
