How to Detect a Rug Pull Before Investing

How to assess a token or protocol for rug-pull risk: liquidity locks, contract verification, owner privileges, and team transparency.

What you'll need (prerequisites)

• Self-custodial wallet
• A second device for verification
• Block explorer (Etherscan, Solscan, etc.) familiarity

Step-by-step

1. Step 1: Check liquidity depth and whether it is locked

   Open the token's main trading pair and see how much liquidity actually backs it — shallow pools can be drained in a single transaction. Then confirm whether the LP tokens are locked (via a locker such as UNCX/Unicrypt or Team Finance) or burned, and for how long. Liquidity the deployer can withdraw at will is the single biggest rug-pull risk.

2. Step 2: Confirm the contract source is verified on the explorer

   Look up the token contract on the chain's explorer (Etherscan for Ethereum, Solscan for Solana) and confirm the source code is published and verified. Unverified contracts hide their logic and cannot be reviewed for traps. Verified source lets you, or a scanner, read exactly what the owner is allowed to do.

3. Step 3: Inspect owner privileges and honeypot behavior

   Run the address through a token scanner such as Token Sniffer, De.Fi Scanner, or GoPlus to surface dangerous owner powers: unlimited mint, blacklist, pausable transfers, and hidden or mutable buy/sell taxes. Cross-check on Honeypot.is, which simulates a buy and a sell to test whether you could actually exit. Any function that lets the owner block selling or mint freely is a hard stop.

4. Step 4: Assess team transparency and audits

   Check whether the team is doxxed and whether the project carries a real audit from a reputable firm, then read the audit findings rather than trusting a badge. Anonymous teams and self-published or unnamed 'audits' are common cover for rug pulls. Verify any audit claim on the auditor's own site, not a linked PDF.

5. Step 5: Check holder distribution and wallet concentration

   On the explorer's holders tab, or with a visual tool like Bubblemaps, see how the supply is spread. If a handful of wallets — especially ones funded from the same source — hold most of the supply, they can dump and collapse the price. Watch for clusters of connected wallets disguised as independent holders.

6. Step 6: Run a final red-flag checklist with tools

   Before committing funds, stack the free scanners: Token Sniffer or De.Fi Scanner for the contract, Honeypot.is for sell-ability, and DEX Screener (or RugCheck for Solana tokens) for liquidity, volume, and pair health. Treat any single red flag — unlocked liquidity, mint authority, extreme concentration, a failed sell simulation — as reason to walk away. No tool is perfect, so require several to agree before you trust a token.

Common errors and fixes

• Approval can't be revoked due to insufficient gas. Revoke transactions cost the same gas as a normal token transfer. Top up the wallet with a small amount of native gas token before revoking.
• Funds already drained. On-chain theft is generally irreversible. Document everything, file police / IC3 / Chainalysis Reactor reports, and contact the protocol team if a known exploit. CEX-side funds may be recoverable if the attacker on-ramped to a regulated exchange.
• Suspected key leak but no losses yet. Move all funds immediately to a freshly created wallet. Burn the old seed. Audit every device the seed touched (browser extensions, cloud backups, email).
• Cannot identify the malicious contract. Use Etherscan's "advanced filter" to filter by token approvals and unusual contract calls. Run the suspicious tx through Tenderly to decode the call.
• Phishing email looks real. Always verify by typing the URL manually. Real exchanges and protocols never email asking for seed phrase, password, or 2FA codes — full stop.

FAQ