how to spot a rug pull before it rugs you

a rug pull is when the team takes the money and leaves. most rugs aren’t clever. they’re just public, and nobody looked.

the six checks

most of these start on a block explorer, with the holders list:

• supply. the pool, vesting contracts and exchanges are normal big holders. a fresh, unlabelled wallet sitting on a big chunk is not.
• liquidity. who holds the lp tokens (the receipt for liquidity in a pool)? if they’re burned, the liquidity can’t be withdrawn. if they’re locked, they can’t be pulled until the unlock date, if the lock contract holds. if they’re in the deployer’s wallet, it can be pulled any time.
• minting. whoever can mint can print tokens and sell them.
• admin powers. people check for uncapped fees, a blacklist, a pause switch or upgrades. “renounced” ownership only removes the owner role. other roles can still exist.
• sells. lots of buys and almost no successful sells from normal wallets is the honeypot pattern: a token that can be bought but not sold.
• behaviour. guaranteed returns, countdown timers, and bans for asking “who holds the lp tokens?”

admin powers alone aren’t proof of fraud. one anonymous key, unlimited power and no timelock is simply the setup a rug needs.

the project’s whitepaper is a separate check, covered in whitepaper red flags in 5 minutes.

hypothetical example

a made-up token:

• the deployer holds unlocked lp tokens;
• there’s an active mint function;
• a fee setter has no maximum;
• three big wallets were funded from the same address an hour before launch.

nobody has to prove it’s a scam. it could rug four different ways, and the only thing stopping it is strangers’ goodwill. that’s a reason many people pass.

what passing doesn’t mean

clean checks don’t make a token safe or a good investment. they rule out a few ways to lose everything in one block. a token can still go to zero slowly, because nobody wants it.

the boxer has a rule for this: sniffing the bowl first doesn’t make it dinner.

nerd corner

• lp position. on some dexs (concentrated-liquidity designs) the lp position is an nft, not a token (uniswap concentrated liquidity docs). a token can also have several pools, and only one of them may be locked. locks can often be extended or moved by their owner, and a lock is only as good as its contract.
• solana (spl tokens). the mint authority and the freeze authority show up on explorers. freeze works like a blacklist. both can be set to none, and that’s permanent (solana token program docs).
• evm chains. there’s no standard authority field. the things to look for are mint functions and who can call them.
• renounced ≠ powerless. whoever holds the proxy admin (upgrade) right can swap in new code that brings the powers back. separate minter, pauser or admin roles may also exist (openzeppelin access control, openzeppelin proxy).
• scanners miss things, and some traps switch on later.

not financial advice. dyor. you can lose all of your money. interests: see /disclosure.