How to Check if a pump.fun Token Is Safe (Before You Buy)

Most “is this token safe” checklists tell you to confirm the mint authority is revoked, the freeze authority is revoked, and the metadata is locked. On pump.fun, all three are always true — and a check that’s always true tells you nothing.

I’ve verified this directly against well-known pump.fun graduates on mainnet. It means the standard rug-check, applied to a pump.fun token, produces three green ticks and zero information. Buyers see the green ticks and feel safe. They shouldn’t. The real risks live somewhere else entirely, and this guide is about where.

What every pump.fun token already looks like

Here’s the on-chain state of Fartcoin, Peanut the Squirrel (PNUT), and Goatseus Maximus (GOAT) — three genuine pump.fun graduates, read straight from the mint:

Property	Value
Token program	Classic SPL Token
Mint authority	None
Freeze authority	None
Metadata	Immutable
Decimals	6

Identical, every time. pump.fun mints tokens this way by default. So:

“Mint authority revoked ✅ Freeze authority revoked ✅ Metadata locked ✅” on a pump.fun token is the equivalent of praising a car for having wheels. It’s the baseline, not a distinguishing feature.

The good news buried in that table

It’s worth being precise, because it cuts both ways. Since a genuine pump.fun token has no freeze authority and is a classic SPL token (no transfer fees, no transfer hooks, no exotic extensions), the classic honeypot mechanics can’t apply to it. Nobody can freeze your account, and no punishing transfer fee eats your sale. If there’s liquidity, you can sell.

And on a graduated token, the bonding-curve SOL was moved into a locked pool, so the creator can’t withdraw the liquidity either. A classic liquidity rug isn’t available to them.

Which raises the obvious question: if it can’t be a honeypot and the liquidity can’t be pulled, what goes wrong? Plenty.

The four checks that actually matter

1. Holder concentration — the main event

With the authority checks neutralized, this is the risk. Nothing stops a handful of wallets that accumulated cheaply from selling into your liquidity and collapsing the price. That isn’t a rug in the technical sense; it’s just a dump. Your money is equally gone.

Pull the top holders and look hard:

• The liquidity pool near the top is expected and fine — it’s not a person.
• The burn address holding supply is fine, and good.
• One or two ordinary wallets holding a large share is the warning. They can exit on top of you.

Context from a real case: when the ANSEM memecoin ran, reporting indicated a single party controlled roughly 60–66% of supply. Whatever you think of the token, that is the number that decides your downside — not the authority fields.

2. The contract address — verify it, always

Ticker symbols are not unique on Solana. Anyone can mint a token named identically to a trending one. This isn’t theoretical: when ANSEM trended, multiple distinct tokens bearing that name appeared simultaneously, with no canonical version. Impersonators exist specifically to catch people who search by ticker and buy the first result.

Worse, a lookalike token wasn’t necessarily minted on pump.fun — so none of the reassurances above apply to it. A copy could be a Token-2022 token with a punishing transfer fee, or carry an active freeze authority, and behave like a genuine honeypot.

Get the mint address from the project’s own official channel and compare it character by character. The address is the token; the name is decoration.

3. Liquidity: how much, and has it migrated?

Two different questions:

• Pre-graduation, the token is still on the bonding curve. Price is formula-driven and there is no conventional pool. It’s early and thin by design.
• Post-graduation, there’s a real pool with locked liquidity. Check the depth. A shallow pool swings violently on modest trades and is easy to push around, regardless of who can or can’t withdraw it.

Locked liquidity that is also tiny is not the reassurance it sounds like.

4. Age, distribution, and the boring signals

Nothing here is proof, but it moves the needle:

• A token, socials, and website all created within the same hour is the profile of a fast launch, not a project.
• Supply spread across many wallets beats supply parked in a few.
• Urgency is a sales tactic. On-chain facts don’t expire; if it’s safe now, it’s safe after you’ve checked.

Read it all in one place

Doing four lookups by hand is fine. Doing them in one view is faster: a token certificate takes any mint address and reports the authorities, metadata lock, supply, and top holders — read live from Solana, not self-reported by the team. It’s free and needs no wallet connection.

Be suspicious of any “checker” that asks you to connect a wallet. Everything that matters here is public and readable from an address alone. A safety check should never ask you to sign anything.

The one-line version

On pump.fun, ignore the authority ticks — they’re automatic. Check who holds the supply, check the pool’s depth, and above all check that you’re buying the exact contract address the project published. The token that takes your money usually isn’t the one that couldn’t be sold. It’s the one whose ticker you trusted, or whose top holder was waiting for you.

Run any mint through the free safety checker before you buy. And for the general framework across all Solana tokens — where the authority checks do mean something — see how to check if a Solana token is a honeypot or rug pull.