Safety

How to spot a Solana rug pull: a trader's pre-buy checklist

How to spot a Solana rug pull before buying: check mint and freeze authority, LP status, holder concentration, Token-2022 extensions and metadata in minutes.

By JacobSeptember 21, 20268 min read1689 words

Key takeaways

Most Solana rug pulls rely on a power that is visible on-chain before you buy: an active mint authority, an active freeze authority, withdrawable liquidity or concentrated supply.
A Solana token's top-10 holder concentration is only meaningful after liquidity pool, burn and exchange addresses are excluded, because those are not wallets that can decide to sell.
Token-2022 tokens on Solana can carry a transfer fee, a permanent delegate or a transfer hook, each of which gives the issuer powers that revoked mint and freeze authorities do not remove.
Burned or locked liquidity on Solana only stops the creator withdrawing the pool; it does not stop insiders selling a large share of the supply into it.
No checklist guarantees a Solana token is safe, because a team that passes every on-chain check can still sell its own holdings and abandon the project.

The short answer#

You spot a Solana rug pull by checking, before you buy, which powers the token's creator still holds: can they mint more, freeze your account, pull the liquidity, or sell a dominant share of supply? All four are public on-chain data, and checking them takes a few minutes with an explorer and a couple of free tools.

No checklist guarantees safety. It removes the cheap, mechanical rugs. It cannot detect a team that passes every check and then sells its own bags and disappears.

What should you check before buying a new Solana token?#

Check eight things, in roughly this order, because the first ones are fastest and disqualify the most tokens.

What to check	Where	Red flag
Mint authority	Mint address on an explorer, or a read-only authority lookup	Any active address on a token sold as "fixed supply"
Freeze authority	Same place	Active, with no regulated issuer behind it
Token program and extensions	Explorer: owner program of the mint, extensions list	Token-2022 with permanent delegate, transfer hook, high transfer fee, non-transferable
Liquidity (LP) status	LP mint supply and holders on an explorer; locker contract if locked	Creator wallet still holds the LP tokens; short lock; position NFT in the dev wallet
Holder concentration	Holder Snapshot with pool and burn addresses excluded	A few unlabelled wallets hold a share that dwarfs pool depth
Wallet clustering	Funding source and first-block buys of top holders	Many top holders funded by one wallet, or buying in the launch block
Metadata mutability	Metaplex metadata: `isMutable`, update authority	Mutable metadata on a token imitating a known brand
Actual sell activity	Recent trades; decode a suspicious transaction	Only buys succeed; sells fail with frozen or hook errors

The sections below explain how to read each one.

How do mint authority and freeze authority enable a rug?#

An active mint authority lets the creator print unlimited new tokens and sell them into the pool; an active freeze authority lets the creator freeze your token account so you cannot sell. Both are optional fields on the token's mint account, and both show as an address or as disabled on Solscan and Solana Explorer.

If you prefer one screen for it, the SOLTidy Revoke Mint Authority page has a free lookup: paste any mint and it shows supply, decimals and both authorities as Active or Revoked, no wallet needed. The revoke button itself only works for the token's own authority, so there is nothing you can break.

Active authorities are not proof of a scam. USDC keeps both on purpose. On an anonymous memecoin there is no comparable reason, and I treat it as a disqualifier. The detail, including what "revoked" means on-chain, is in mint authority vs freeze authority.

How do you check whether liquidity is burned or locked?#

Liquidity is safe from withdrawal only if the LP tokens that represent it have been burned or sit in a lock you have inspected. For a standard Raydium pool, open the LP mint on an explorer and look at its supply and holders. After a real burn the LP supply is at or near zero and there is a Burn or BurnChecked transaction signed by the creator. If the creator's wallet still holds the LP tokens, the pool can be emptied in one transaction.

Two traps. LP tokens sent to an "incinerator" address are not the same as a burn instruction, and need interpretation. And concentrated-liquidity pools (Raydium CLMM, Orca Whirlpool, Meteora DLMM) have no fungible LP token at all, so "LP burned" claims about them deserve extra scrutiny. I go through the verification steps in burned vs locked liquidity.

Remember what this check does not cover: a locked pool is exactly what a team dumps its own supply into.

How do you read holder concentration correctly?#

Holder concentration is the share of supply held by the largest wallets, and the raw figure is misleading until you remove addresses that are not people. The largest "holder" of most traded tokens is the liquidity pool's authority address. Burned supply may sit in an incinerator address. Exchanges hold customer balances in a few hot wallets. None of these can decide to sell.

The free Holder Snapshot tool reads every token account for a mint, sums balances per owner wallet, and shows a ranked list with a top-10 concentration figure. It needs no wallet, which makes it safe to point at tokens you do not trust. To get a meaningful number:

Paste the mint address and take the snapshot.
Identify the pool: it is usually the largest holder, and an explorer labels it as a Raydium, Orca or Meteora authority.
Paste the pool address, any burn address and any known exchange or locker wallets into the exclude box, one per line.
Read the top-10 concentration again. It now describes the circulating float that ten wallets could sell.
Compare those wallets' holdings with the SOL in the pool. Ten wallets holding 30% of the float matters far more against a 20 SOL pool than against a deep one.

The tool does not guess which addresses to exclude, because a wrong guess would silently distort the result. That judgement is yours. It also reports what share of supply the snapshot accounts for; 100% means nothing was missed. Very large mints with millions of accounts can exceed what an RPC node will return, and the tool labels a capped result as partial.

Bundled and sniper wallets#

A bundle is a group of wallets, controlled by one party, that buy in the same block as the launch so the supply looks distributed when it is not. You cannot prove common control from the chain alone, but the pattern is visible: click through the top holders on an explorer and look at each wallet's first transactions. Wallets funded from the same source shortly before launch, holding only this token, that all bought in the first block or two, are one holder wearing several hats. Add their balances together before deciding what the concentration really is. Snipers are bots that buy the first blocks independently; they are not insiders, but they are sellers waiting for you.

Which Token-2022 features and metadata settings are red flags?#

Token-2022 is a second token program on Solana that lets a mint carry optional extensions, and three of them matter before a buy.

Transfer fee. A percentage withheld from every transfer, including your sell. Its authority can change the rate later. A small disclosed fee is a design choice; a high or undisclosed one is a tax on exit.
Permanent delegate. One address with irrevocable rights to transfer or burn tokens from every holder's account. You cannot revoke it, because it is set on the mint, not on your account. The free Revoke Delegations tool flags Token-2022 balances in your wallet that carry it, but the only remedy is not to hold the token.
Transfer hook. A custom program that runs on every transfer and can make it fail under any condition the author chose, including "seller is not on my list".

Non-transferable and default-frozen mints are rarer in trading but equally disqualifying for a speculative buy. The full list with risk ratings is in Token-2022 explained for traders.

Why metadata mutability matters#

Mutable metadata lets the update authority change a token's name, symbol and image after you buy. On most tokens that is harmless housekeeping. It matters when the token's identity is the pitch: an imitation of a known brand can be renamed after the dump and reused, and a rename makes a bad token harder to recognise later. Explorers show the Metaplex isMutable flag and the update authority on the token's metadata tab. Treat immutable metadata as a mild positive, not a requirement.

How do you read a suspicious transaction?#

Read the balance changes first and the instructions second, because balance changes show what happened rather than what was requested. The free Transaction Decoder takes a signature or an explorer link and shows status, fee, per-wallet SOL and token balance changes, each instruction in plain language and the program logs. No wallet is involved. Useful things to decode before a buy:

A failed sell by another trader. SPL Token error 0x11 means the account is frozen, which confirms a honeypot. A failure inside an unfamiliar program on a Token-2022 mint points to a transfer hook. Jupiter error 0x1771 is only slippage and means nothing sinister.
The "LP burn" the team posted. It should contain a Burn or BurnChecked instruction on the LP mint, not a transfer to another wallet.
Large transfers out of the deployer wallet before launch, which is how bundles get their supply or their funding.

The same skill helps afterwards too, when one of your own swaps fails and you want to know why.

What can't a checklist tell you?#

A checklist tells you what the creator is able to do, not what they intend to do. A token with revoked authorities, burned LP and a clean holder list can still be sold down by a team whose wallets you did not link, promoted with paid hype, or simply abandoned. The on-chain state can also change after you look: a lock expires, a transfer fee is raised. And no check protects you from signing a malicious transaction on a fake version of the token's website, which is how most wallets are actually drained; that is a separate topic, covered in the wallet security checklist.

I built these checks into SOLTidy because I was running them by hand across several sites as a trader; the about page says more on that. They narrow the field. Position size does the rest.

Bottom line#

A Solana rug pull almost always uses a power that was visible beforehand: mint authority, freeze authority, withdrawable liquidity, a Token-2022 extension, or concentrated supply. Checking all of them takes minutes and costs nothing, since every lookup above is read-only. Passing the checklist means the cheap exits are closed, not that the token is a good buy. Size every position as if the remaining risks will happen, because on new tokens they usually do.

Questions & answers

What is a rug pull on Solana?

A rug pull is a token launch where insiders take buyers' money by using a power the buyers did not check. On Solana the common forms are withdrawing the liquidity pool, minting new supply and selling it, freezing buyers' accounts so only insiders can sell, and dumping a large pre-held share of supply. A slow version, where the team simply sells down and goes quiet, uses no special power at all.

How do I check if a Solana token is a honeypot?

Look at the freeze authority on the mint account first: if it is active, the issuer can freeze your token account after you buy. Then check whether the mint belongs to Token-2022 and carries a transfer hook, permanent delegate, non-transferable flag or a high transfer fee. Finally, look at recent trades for ordinary wallets selling successfully. A chart with only buys is a warning in itself.

What percentage of supply held by top holders is a red flag?

There is no universal threshold, and anyone who gives one is guessing. What matters is who the top holders are after you exclude the liquidity pool, burn addresses and exchange wallets. If ten unlabelled wallets hold a share of the float that is large relative to the pool's liquidity, they can move the price to near zero by selling. Compare their holdings to the pool depth, not to an arbitrary percentage.

Does burned liquidity mean a Solana token is safe?

No. Burned LP tokens mean the creator cannot withdraw that share of the pool, which removes one specific rug method. The team can still hold a large part of the supply and sell it into the locked pool, an active mint authority can print more tokens, and a freeze authority can stop you selling. Burned liquidity is one line on the checklist, not the result.

Are rug check tools and screeners enough on their own?

They are a fast first filter and worth using, but they are automated summaries of the same on-chain fields you can read yourself. They can lag behind a change, mislabel pool or locker addresses, and cannot judge intent. A token that scores well can still be sold down by its team. Use a screener to reject obvious problems quickly, then verify the items that matter to you on an explorer.

Can I get my money back after a Solana rug pull?

Almost never. Solana transactions are final, and there is no authority that can reverse a swap or restore a drained pool. Anyone offering to recover the funds for an upfront fee is running a second scam. What you can do is reclaim the roughly 0.002 SOL of rent in each dead token account by burning the worthless balance and closing the account.

Token Launch

Mint authority vs freeze authority on Solana, explained

Every Solana token has two optional keys stored on its mint account. One can print supply, the other can stop you selling. Here is what each does, when keeping them is legitimate, and how to check any token yourself in a minute.