Rug-pull safeguards: how PumpStriker reduces rug risk
PumpStriker reduces rug-pull risk in layers. Before a signal, the Engine removes tokens that GMGN's data flags as honeypots or unsellable, or with live mint or freeze authority, high sell tax or other red flags. Unknown safety facts are re-checked for 5 minutes, and a hard-rug exit watches every position the bot opens. No tool can remove rug risk.
By Mezyan D, Bathyr Devs Last reviewed
- Before the signalLaunchpad scope and one-day age limitEleven safety killsFresh-price, liquidity and pool checks
- Before any buy5-minute re-check of unknown factsYour filters fail closedPre-sign verification and simulation
- After the buyHard-rug exit on a sudden collapseRug stop or floorLanded-check before any retry
- Wallet safetyKeys encrypted on your machineOwner-only private chatLocal-only Engine link
What are the key facts about PumpStriker's rug safeguards?
| Approach | Risk reduction in layers; no tool can remove rug risk |
|---|---|
| Before the signal | Launchpad scope, a one-day age limit, eleven safety kills, fresh-price, liquidity and pool checksLive |
| Missing data | Unknown core safety data marks the signal safety pending: grade C, every auto-buy tier closedLive |
| Second look | Unknown safety facts re-checked for 5 minutes; a late failure sends one cancelLive |
| Before any buy | Your filters fail closed; every buy and sell is checked and simulated before signingLive |
| Auto-buy | Off by default, dry run first, cappedBeta |
| After the buy | Hard-rug exit, rug stop or floor, cancel exit, landed-check before any retryLive |
| Keys | Encrypted at rest on your machine (scrypt plus AES-256-GCM) and signed locallyLive |
| Data sources | GMGN, Solana RPC providers and Jupiter, all run by third parties |
- Live
- In the current build and on by default, or on when you turn it on.
- Beta
- Works, but experimental, opt-in and capped.
- Needs setup
- Built, but off until you configure it.
What does PumpStriker check before a signal?
Every token goes through the Engine's scope, price and safety checks before a decision. A token that fails a kill is recorded and never sent.
| Safeguard | What it does |
|---|---|
| Launchpad scope and age limit | Only supported launchpads (Pump.fun with PumpSwap and Mayhem launches, Bags, LetsBonk, Jupiter Studio); a token whose curve or pool is known to be more than a day old is dropped |
| Safety kills K1 to K12 | Honeypot, cannot sell, blacklist, live mint or freeze authority, sell tax of 10% or more, Mayhem launch, dev wallet over 25%, top-10 holders at 50% or more, wash trading, market cap under $5,000 |
| Unknown core safety data closes auto-buy | Unknown mint authority, freeze authority, sell tax or top-10 share marks the signal safety pending: grade C, hidden at the default setting. Other unknown checks are re-checked for 5 minutes, and a late failure sends a cancel |
| Fresh-price gate | No decision on a quote older than 30 s, a token with no trade in 10 minutes, or a frozen price |
| Liquidity and pool checks | Unknown liquidity, liquidity under 2% of market cap, or a pool under $1,000 closes every auto-buy tier |
| Falling-knife, spike and run-up checks | knife, spike5, young-pump and launch-run close the higher tiers; a token under 60 minutes old that already trades 3x or more above its launch price is never marked for Telegram, never auto-bought, and gets no card for 30 days |
| Recorded risk checks | Insider share, bundler share, rug ratio, dev-team share and concentration are recorded on every decision for transparency |
What happens when safety data is missing?
A check with missing data is marked unknown, not safe. An unknown value never kills a token on its own, but it is never treated as a pass either:
- If mint authority, freeze authority, sell tax or the top-10 share is unknown, the signal is marked safety pending. That makes it grade C, hidden at the default setting, and closes every auto-buy tier.
- Other unknown checks (honeypot, cannot-sell, blacklist, dev wallet, wash trading, Mayhem) are recorded as data gaps and re-checked for 5 minutes after the signal. If one now fails, one cancel goes out and a position that auto-buy opened in that token is sold.
- Unknown liquidity keeps every auto-buy tier closed and fails any liquidity bound you set.
Which checks run between a signal and a buy?
| Safeguard | What it does |
|---|---|
| Retro-kill window | Unknown safety facts are re-checked for 5 minutes; a late failure sends one cancel |
| Launch-run suppression | No card of any kind for 30 days |
| Your filters fail closed | An unreadable bound, or unknown liquidity against a set bound, removes the card and the buy |
| Auto-buy gate Beta | Off by default; dry run first; strategy PASS plus a typed confirmation; default caps, reserve, a 15% impact cap and a 5 s stale-price guard (configurable; higher values are logged as deviations); one buy per token; an unknown balance means skip |
| Manual buy guards | Balance check, duplicate-buy guard, one buy at a time per wallet and token |
| Pre-sign verification and simulation | Every buy and sell is checked against your request and simulated before signing; the pump.fun builder refuses anything unusual and steps aside to Jupiter |
Pre-sign verification covers every buy and sell. Send SOL, wSOL wrap and unwrap and rent-reclaim transactions are sent without this check. See every filter, guard and default on the filters page.
How does PumpStriker exit a collapsing token?
| Safeguard | What it does |
|---|---|
| Hard-rug exit | A sudden collapse between two closely spaced price checks triggers an immediate full sell; for your own buys this is 40% between checks up to 60 s apart |
| Rug stop and floor | Default plan: a rug stop at 0.62x of entry while the peak is under 1.5x. Buys from /buy, a pasted address or a token card: a floor 25% below the first evaluated quote (a Buy tap on a signal card follows that signal's plan instead) |
| Cancel exit | If the Engine withdraws a signal, a position that auto-buy opened is sold; your own buys, including Buy taps on a signal card, are never touched |
| Exit failure policy | Landed-check before any retry, escalating slippage, lockouts with alerts, never a double sell |
| Price-source rules | Take-profits never fire on an Engine-only price; an "exits blind" alert goes out when no price can be read |
| Clean-up | Positions sold elsewhere are closed only after two confirmed zero balances |
How does PumpStriker handle your keys?
| Safeguard | What it does |
|---|---|
| Self-hosted keys | Keys are stored only on your machine, encrypted at rest (scrypt plus AES-256-GCM), and transactions are signed locally. Import and Generate pass the key through your Telegram chat once |
| Owner-only private chat | Only your own Telegram account can command the bot or press its buttons, so protect that account with two-step verification |
| Secret guard and redaction | Pasted keys or seed phrases are deleted; logs never show keys |
| Local-only link | The Engine and the bot talk over 127.0.0.1 with a shared secret; the link is not reachable from the LAN or the internet |
| Browser-wallet dashboard Needs setup | Your browser wallet is the only signer; the sign-in message signs no transaction and grants no permission. Trades made from your browser wallet are not watched by the bot's exit engine (no automatic stop-loss or rug exit), and buying a pasted address shows a warning that no token flags were checked |
| Rent recovery partner | The UnclaimedSol scan is read-only, and the bot signs nothing for it |
What are the limits of these safeguards?
- No tool can remove rug risk.
- Data can be missing, late or wrong.
- A token can change faster than any check.
- The checks rely on third-party data: GMGN, Solana RPC providers and Jupiter.
- Protective exits may sell at a much worse price than the trigger, because they put getting out first.
- Trades from your browser wallet on the dashboard are not watched by the bot's exit engine.
Where can I check a token myself?
Signals get these checks automatically. In the bot, paste any token address for a card with its market cap, liquidity and venue, each with its age, and use research commands such as /holders and /dev. To check a token by hand, start with RugKit, the free and open token-safety toolkit, and the step-by-step answer on how to check a Solana token for a rug pull. For the background, read how Solana rug pulls work.
Frequently asked questions
Can PumpStriker stop every rug pull?
No. No tool can remove rug risk. PumpStriker reduces it with checks before a signal, a 5-minute re-check after it, fail-closed filters, pre-sign checks and protective exits. Data can be missing, late or wrong, and a token can change faster than any check.
Does PumpStriker check honeypots and mint authority?
Yes, using GMGN's data. A token that GMGN reports as a honeypot, that cannot be sold, has a blacklist function, keeps mint or freeze authority, or has a sell tax of 10% or more is removed before any card is sent. An unknown mint authority, freeze authority or sell tax never kills; it marks the signal safety pending, which closes every auto-buy tier.
Does a cancelled signal sell my own buys?
No. When the Engine withdraws a signal, only a position that auto-buy opened in that token is sold. Your own buys, including Buy taps on a signal card, are never touched; they keep the exit plan they opened with.
Will a protective exit sell at the trigger price?
Not always. Protective exits put getting out first: they use at least 40% slippage, then a 99% leg, so they may sell at a much worse price than the trigger. Before any retry the bot checks whether the earlier sell already landed, so nothing is sold twice.
Do these exits cover trades from the dashboard's Wallet page?
No. Trades made from your browser wallet on the Engine's dashboard are not watched by the bot's exit engine, so they get no automatic stop-loss or rug exit. Buying a pasted address there also shows a warning that no token flags were checked.
Sources and review
- Product facts: the current PumpStriker Engine and Telegram bot code (kills, tiers, guards and exits), checked in November 2026.
- Telegram FAQ: two-step verification
- Telegram Bot API documentation
Last reviewed by Mezyan D, Bathyr Devs. Facts are as of November 2026 and follow the current build; release notes are on the changelog.
Risks and disclosures
- High risk: Memecoins are extremely high-risk and can move very fast in either direction. Only trade with money you can afford to put at risk.
- No guarantees: PumpStriker does not promise profit, a win rate or any trading result. A signal or grade is information, not a prediction, and no tool can make an outcome certain. Anything promising guaranteed returns is a scam.
- Self-custody: You run PumpStriker on your own computer or VPS and hold your own keys. Bathyr Devs never holds or moves your funds and never asks for your seed phrase; the software trades only from your own wallet, when you tap or within the auto-buy and exit rules you switch on. Importing a wallet means pasting its key into your private Telegram chat once (the bot deletes it at once), and Generate New shows a new key once in that chat, so use a dedicated trading wallet. On-chain transactions are final; we cannot reverse them or recover keys, so keep your machine, Telegram account, bot token and
.envfile secure. - Experimental auto-buy: Auto-buy is an experimental, opt-in feature. It is off by default, starts in dry run, and live buys stay inside caps (by default 3 per hour, 20 per day, 5 open positions, a daily SOL cap, a 0.03 SOL reserve and a 15% price-impact cap). The caps are set in your own configuration; a value above the default is accepted and logged as a deviation. Turning it on is your decision.
- Third parties and partners: PumpStriker relies on services run by others (GMGN, Helius, Jupiter, pump.fun, Telegram), and their uptime, fees and terms apply. UnclaimedSol is a partner: rent-recovery claims made through the in-bot button may earn Bathyr Devs a referral share.
- No token: There is no PumpStriker or BATHYR token, presale or airdrop. Anyone selling one is running a scam.
Not financial advice: PumpStriker is software, not financial advice. Nothing on this site is a recommendation to buy or sell any token. Do your own research (DYOR). Read the risk disclaimer and the terms of use.