How to Check if a Solana Token Is a Honeypot or Rug Pull

Two of the most common ways to lose money on a new Solana token have specific, checkable signatures. A honeypot lets you buy but quietly blocks you from selling. A rug pull waits for buyers, then drains the liquidity and leaves you holding tokens with no market. Both feel like bad luck after the fact. Both are usually visible before you buy, if you know where to look.

I do this check for a living, and it takes about two minutes. Here’s exactly what to look at, why each thing matters, and the order I check them in.

Honeypot vs rug pull: know what you’re looking for

They’re different traps, and telling them apart tells you what to check.

	Honeypot	Rug pull
What happens	You can buy but can’t sell	Liquidity is drained, price → 0
When	The moment you try to exit	Whenever the team decides
Enabled by	Freeze authority, abusive transfer fee, pool permissions	Unlocked LP, concentrated supply
The tell	Money flows in, not out	The team can still pull liquidity

Notice the common thread: in both, value can enter but the exit is compromised. Every check below is really a way of asking “is the exit real?”

The two-minute checklist

Run these four checks on any token before you buy. You only need the token’s mint address — no wallet connection, no signing. If anything ever asks you to connect a wallet to “check” a token, walk away; the data is all public and readable from the address alone.

1. Is the mint authority revoked?

An active mint authority means the team can create unlimited new supply and dilute you to nothing. For a token that claims a fixed supply, the mint authority should be revoked. You can confirm this on Solscan or with a token certificate — the authority field should read as none.

• Revoked → supply is provably capped. Good.
• Active → supply can be inflated at will. High risk unless there’s a clearly explained, legitimate emission schedule.

2. Is the freeze authority revoked?

This is the classic honeypot enabler. While the freeze authority is active, whoever holds it can freeze your token account so you can’t sell — you bought in, and now you’re stuck. A freely tradable token should have freeze authority revoked.

• Revoked → no one can freeze your wallet. Good.
• Active → you can be locked out of your own tokens. Treat as a honeypot risk.

3. Is the liquidity burned or locked?

This is the rug pull check. Find the token’s liquidity pool and look at who holds the LP tokens. If the LP is burned (sent to a burn address) or locked in a time-lock contract, the liquidity can’t be pulled. If a team wallet holds the LP, they can withdraw all of it the moment they choose.

• Burned or locked → liquidity can’t be pulled. Good.
• Held by a wallet → the team can rug at any time. Highest-priority red flag.

Also glance at how much liquidity there is. A pool with almost nothing in it can’t support real trading and swings wildly — thin liquidity is its own trap.

4. How concentrated are the holders?

Even with revoked authorities and locked liquidity, a token can crater if a few wallets own most of it. Pull up the top holders. The burn address and a locked liquidity pool are fine to see near the top — those are supposed to be there. What worries me is one or two ordinary wallets sitting on a large share of supply, because they can dump into your liquidity and collapse the price.

• Widely distributed → no single seller can crash it. Healthier.
• One or two wallets dominate → they can exit on top of you. Elevated risk.

Beyond the checklist: softer signals

The four checks above are the hard, on-chain facts. These don’t confirm a scam, but they raise or lower my confidence:

• Missing or sloppy metadata. No logo, a copy-pasted description, or a name impersonating a known project. Legit teams do the metadata properly.
• Token-2022 transfer fee set high. A tax token with a modest fee is a legitimate design. A transfer fee cranked to something extreme is a soft honeypot — you can technically sell, but the fee eats most of it.
• Brand-new everything. A token, pool, and social accounts all created within the same hour deserve extra scrutiny. That’s not proof of anything, but it’s the profile of a fast launch.
• Pressure to buy now. Urgency is a sales tactic, and on-chain facts don’t expire. If a token is safe, it’ll still be safe after you’ve checked it.

Read it all at once with a certificate

Doing four lookups by hand works, but the fastest way is a page that reads them together. A token certificate takes a mint address and reports the authorities, metadata lock, supply, and top holders live from the chain, in one view. Nothing on it is self-reported by the team — it’s read straight from Solana — so it’s the same data whether the project is honest or not.

Run it before you buy, and if you’re launching a token yourself, publish one so your buyers don’t have to assemble the picture by hand.

The one rule that covers all of it

Verify on-chain; never take a team’s word. Screenshots can be faked, Telegram messages can be deleted, but the mint’s authorities, the LP’s holder, and the supply distribution are public and can’t be edited after the fact. Two minutes of checking the exit is the cheapest insurance in crypto. When you want to run the check, the token safety checker is free and needs nothing but the address.