Rug Pull Checker: Contract and Holder Checks, Step by Step
Lesson 5 of 8 · Intermediate
The contract is the token's real rulebook
A website, a whitepaper and social posts can say anything, but a token's real behaviour is determined by its smart contract. If the contract lets the creator mint new tokens, block your sales or pull out the liquidity, no promise stops them.
The good news is that most of these checks are public and free. With a block explorer (such as the explorer of the network the token was built on) and a few minutes, you can see the most important warning signs. This lesson walks through five core checks. None of them gives a final verdict alone, but together they build a clear picture.
Dangerous permissions: mint, freeze and upgradeable contracts
- Mint authority: if someone still has permission to create new tokens, they can multiply the supply at any moment and sell it into the market. On Solana, the token account information shows directly whether the mint authority is active or has been revoked. On Ethereum-compatible networks you need to read the contract's functions.
- Freeze authority or blacklist: this allows the balance of an address to be locked. It is not always a sign of fraud; centralised stablecoins such as USDT also have freeze functions controlled by the issuer. But in a new, unknown token it means the creator can effectively shut your ability to sell.
- Upgradeable contract (proxy): the code behind the contract can be replaced later, so what you checked today may not hold tomorrow. The question is whether upgrade rights sit with one wallet or with a multisig that has a timelock.
- Renounced ownership: if the contract owner has been renounced, admin functions can no longer be used. But make sure ownership has not come back through another contract or a separate role.
Honeypots and sell taxes
A honeypot is a token you can buy freely but effectively cannot sell. It is done with a few tricks:
- Very high sell tax: the contract deducts a large percentage on every sale. Worse is when the owner can change the tax rate later; 5% today and 99% tomorrow.
- Sell whitelist: only specific addresses are allowed to sell.
- Transaction or wallet caps: limits labelled "anti-whale" that can in fact block selling.
- Transfer pause: a function that halts transfers for everyone except the owner.
Online honeypot checkers simulate a buy and a sell and are useful, but they have limits: if the tax or blacklist can be changed, today's result is no guarantee for tomorrow. Always look for the ability to change, not just the current state.
Liquidity: is the LP locked or in the creator's hands?
When a token launches on a decentralised exchange, the creator puts the token and another asset into a liquidity pool and receives LP tokens in return. Whoever holds the LP tokens can withdraw the liquidity. That is the classic rug pull: the creator pulls the liquidity out and buyers are left with a token nobody will buy.
Tell three situations apart:
- LP held by the creator's wallet: the highest risk.
- LP locked: held in a lock contract for a set period. Check the lock duration, the end date and the lock owner; a lock of a few days is almost meaningless.
- LP burned: sent to a burn address and impossible to withdraw.
Even with locked LP, if a large part of the supply sits in a few wallets, they can drain the pool by selling their tokens. An LP lock closes only one kind of rug pull.
Holder concentration and verified source code
Holder concentration: in the explorer's Holders section, look at the top ten or twenty wallets. Before drawing conclusions, set aside addresses that belong to the liquidity pool, lock contracts, the burn address or exchanges. If a large percentage still sits in a few ordinary wallets, the risk of coordinated selling is high. Also watch for several apparently separate wallets funded from the same source; that pattern usually means one person is behind them all.
Hypothetical example: the holder list shows ten large wallets holding 65% of supply. After checking, 25% turns out to be in the liquidity pool and 10% in the team's lock contract. That leaves 30% in eight ordinary wallets. If all eight were funded from one address on the same day, in effect one person or group controls about a third of supply and could drain the pool.
Verified source code: in an explorer, a contract with verified code has readable source and you can inspect its functions. An unverified contract means you are buying a black box. But verification only means the published code matches the deployed code; it does not show the code is safe. Also confirm any security audit report on the audit firm's own website.
Common mistakes
- Trusting a single honeypot checker without seeing whether the tax or blacklist can be changed.
- Treating an LP lock as enough while a few wallets hold a large share of supply.
- Counting the liquidity pool or a lock contract among the large holders and drawing the wrong conclusion about concentration.
- Equating "verified code" with "safe code."
- Ignoring contract upgradeability, which can invalidate all of today's checks.
What do volume and data say here?
This lesson is mostly about security, so "data" here means checking on-chain with your own eyes:
- The contract tab in the explorer: see whether the code is verified, the write functions only the owner can call, and the current owner's address.
- The holders tab: calculate the percentage of the large wallets after setting aside the pool, the lock and the burn address.
- Pool transactions: look at the ratio of buys to sells. If hundreds of buys are recorded and almost no sells, that is one of the strongest signs of a honeypot.
- The first buyers: if several wallets bought in the same block as the launch and were funded from one source, the creator has probably spread the supply across wallets of their own in advance.
- Pool size: compare the pool's liquidity with market cap. Thin liquidity means even small sales move the price sharply.
📊 See real gold futures volume behind these ideas: free order flow course · today's gold volume map
Frequently asked questions
Where does spotting a scam token start?
With the contract: check mint and freeze permissions, upgradeability, changeable taxes, the state of the LP tokens and holder concentration in a block explorer. No single check is enough, but together they reveal most risks.
What is a honeypot token?
A token that can be bought but is effectively impossible to sell because of a very high tax, a whitelist, a transfer pause or similar tricks.
If the LP is locked, is a rug pull no longer possible?
No. An LP lock only prevents direct withdrawal of liquidity. If large wallets hold a lot of supply or the contract is upgradeable, there are still ways to drain the pool.
Education only, not a recommendation to buy or sell; we never give signals. Price examples are illustrative. Test any method on a demo account first, with strict risk management.