How to Check a Solana Token for a Rug Pull Before Buying
By Bathyr Devs · Published October 24, 2026
To check a Solana token for a rug pull, confirm mint and freeze authority are revoked, look for risky Token-2022 extensions, prove the token can be sold, read holder concentration and insider clusters, and see how the liquidity is held. It takes about a minute with free tools. Then keep re-checking after you buy.
No check proves a token is safe. What a checklist does is throw out the tokens that are built to trap you, which is a large share of new launches. For how each trap works under the hood, read how Solana rug pulls actually work; this page is the practical version.
The 60-second checklist
- Paste the mint into a scanner. Copy the mint address from the launchpad or a block explorer, never from a chat, and paste it into RugCheck or PumpStriker's free RugKit.
- Check mint and freeze authority. Both should read none or revoked. A live mint authority can print new supply; a live freeze authority can lock your tokens so you cannot sell.
- Check the token program. If the token uses Token-2022, look for a permanent delegate, transfer hook, transfer fee, pausable flag, default-frozen accounts or non-transferable setting.
- Prove you can sell. Look for real sells from wallets outside the creator's circle, get a sell quote for the size you plan to buy, and read any transfer fee or sell tax.
- Read the holders. Check the top-10 share after excluding the bonding curve, pool and burn accounts, then the dev wallet's share and any linked wallet clusters.
- Check how liquidity is held. Is the token still on a bonding curve, graduated with its LP burned, or sitting in a pool where the LP is locked or held by a wallet that can pull it?
If anything on that list fails, the decision is easy: skip it. If everything passes, you still decide your size and your exit before you buy, because passing a checklist is where due diligence starts, not where it ends.
Mint and freeze authority
Every Solana token is defined by a mint account with two powerful switches. Solana's documentation describes the mint authority as the account authorized to create new units of the token, increasing the supply, and notes that a mint with no mint authority has a fixed supply. The freeze authority can freeze tokens in a holder's account, preventing them from being transferred or burned (Solana token docs).
- Live mint authority: the holder of that key can print supply and sell it into the pool.
- Live freeze authority: the holder of that key can freeze your account so you watch the chart while unable to sell.
Any scanner or block explorer shows both on the mint account. "None" is what you want to see. Revoked authorities remove two tools from a scammer's kit; they do nothing about insiders who already hold most of the supply.
Token-2022 traps
Token-2022, also called Token Extensions, is a newer token program that adds optional features to a mint. Several are legitimate tools for regulated or utility tokens, and dangerous on an anonymous memecoin, because whoever holds the authority holds power over your balance (Token-2022 extension docs):
| Extension | What it allows | Why it matters on a memecoin |
|---|---|---|
| Permanent delegate | Unlimited delegate privileges over every token account for that mint | The delegate can transfer or burn your tokens |
| Transfer hook | Every transfer calls a custom program | That program can add conditions to selling |
| Transfer fee | A fee withheld on every transfer, and a fee authority that can change it | A built-in sell tax that can be raised later |
| Pausable | Transfers, minting and burning can be paused | Nobody can sell while it is paused |
| Default account state | New token accounts can be created frozen | Buyers depend on someone else to unfreeze them |
| Non-transferable | Tokens cannot be moved to another owner | There is nothing to sell |
⚠️ On a fresh memecoin, treat a permanent delegate, a pausable flag or a transfer hook as a hard stop unless you know exactly who controls it and why.
Honeypots and sell tax
A honeypot lets you buy and never sell. On Solana the usual mechanisms are a live freeze authority, one of the Token-2022 extensions above, or a transfer fee so high that selling is pointless. Three quick tests catch most of them:
- Look for real sells. On the trades tab, are wallets outside the launch cluster selling successfully, or are the only sells from a few related addresses?
- Quote the exit. Ask a swap aggregator for a sell quote at the size you plan to buy. No route out means no trade in.
- Read the fee from the mint. A transfer fee is stored on the mint itself, not in a promise in the token's Telegram group.
For reference, PumpStriker's Rug Cancel treats a sell tax of 15% or more as a honeypot-grade exit fee and cancels the signal.
Holders, insiders and bundles
Plenty of rugs need no contract tricks at all, only a small group holding most of the supply. Read the holder list carefully:
- Exclude program accounts first. On pump.fun the bonding-curve account holds the unsold supply, and after graduation the pool account holds the liquidity. Neither is a whale.
- Measure concentration. PumpStriker's own cancel thresholds are a useful yardstick: top-10 holders at 60% or more, a dev wallet at 15% or more, or an insider-network cluster holding 30% or more of supply combined.
- Look for links between wallets. Wallets funded from the same source, or that all bought in the launch block, often sell together. Holder maps make this visible in seconds.
- Check the dev's past. A deployer with past rugs is a red flag on its own.
LP burned vs bonding curve
"Is the liquidity burned?" means different things depending on where the token trades.
- On a pump.fun bonding curve there is no LP token to pull. The program holds the reserves and prices every trade along the curve until it completes. The risk on the curve is supply: insiders and snipers selling into later buyers.
- After a pump.fun graduation the token migrates to a PumpSwap pool, and pump.fun's program documentation says the LP tokens received from that pool are burnt (pump.fun public docs). The classic liquidity pull is off the table for that pool.
- On other launchpads and pools, check whether the LP is burned, locked and until when, or simply sitting in a wallet that can withdraw it. Scanners report the locked share.
Burned liquidity is not a safety certificate. Holders can still dump into it, and most tokens never get far enough for liquidity to matter: as of mid-June 2026, the seven-day average share of pump.fun tokens graduating had fallen to 0.26% (The Block, June 16, 2026).
Free tools: RugCheck, RugKit and Bubblemaps
| Tool | What it shows | Best for |
|---|---|---|
| RugCheck | A Solana token risk scanner. Its public API reports a risk score with named risks, mint and freeze authority, LP locked share and insider networks. | A fast first read on any mint |
| PumpStriker RugKit | A free, read-only, keyless report that returns SAFE, CAUTION or DANGER with the evidence: authorities, Token-2022 extensions, a sell simulation routed through Jupiter, tax and transfer fee, holder concentration, LP status, insider and bundle clustering, dev history, a RugCheck cross-check and a live watch mode | Builders who want the same checks PumpStriker runs |
| Bubblemaps | A visual map of token holders that reveals wallet clusters and the connections between them, across chains including Solana | Spotting bundles and insider groups |
Use at least two. A single score can be gamed or can miss a new trick, and when two independent tools disagree, that disagreement is the signal. RugKit's code and updates are currently handed out on request on Telegram while its GitHub situation clears; the RugKit page explains how to ask.
Re-check after you buy
A token can pass every check at entry and turn minutes later: the dev sells, an insider cluster dumps, or a retained authority gets used. Scanning once is not enough. Re-run the holder, dev-wallet and liquidity checks while you hold, and set a stop-loss before you need it. PumpStriker's bot settings guide covers the sell tiers.
This second pass is what Rug Cancel automates in PumpStriker, the self-hosted Solana memecoin trading bot. Within seconds of every Telegram signal it runs another safety scan using three independent sources: RugCheck, on-chain holder and insider mapping, and GMGN's security audit. If any of them flag rug indicators that were not visible when the signal fired, it sends a CANCEL alert, and if you are already in, it can sell for you. RugKit's live watch mode is the open version of the same idea.
💡 The cheapest rug check is the one you run before the hype reaches you. Paid call channels push tokens at the exact moment checks feel like a waste of time, which is why following Telegram call channels gets people rekt.
Frequently asked questions
How do I check if a Solana token is a rug?
Paste the mint address into a scanner, confirm mint and freeze authority are revoked, check for Token-2022 extensions such as a permanent delegate, prove the token can be sold, read holder concentration and insider clusters, and check how liquidity is held. Then keep checking after you buy, because tokens can turn later.
What is the best Solana rug pull checker?
Use more than one. RugCheck gives a fast risk score with authority, liquidity and insider data, Bubblemaps shows wallet clusters, and PumpStriker's free RugKit returns a SAFE, CAUTION or DANGER report with the evidence behind each call. No checker can promise that a token is safe.
Is a token safe if mint and freeze authority are revoked?
No. Revoked authorities remove two common rug switches, but insiders can still dump supply they hold, a Token-2022 extension can still restrict transfers, and liquidity can still be pulled from pools where it is not burned or locked.
Can a pump.fun token still be a rug?
Yes. On the bonding curve there is no LP to pull, but insiders, bundles and snipers can buy early and sell into later buyers. Most pump.fun tokens never graduate, so treat every new launch as high risk and check the holders before you buy.
Can a token turn into a rug after I buy?
Yes, and many do. A token can pass every check at entry and then the dev sells, insiders dump or a retained authority is used. Re-check while you hold, set a stop-loss, and use tools that keep watching after entry, such as Rug Cancel.
This is not financial advice. Rug checks reduce risk; they cannot remove it, and a token that passes every check can still go to zero. Memecoins are extremely high risk and your exits decide profit. Always do your own research (DYOR).