How to check a Solana token for rug-pull risk before you buy

October 31, 2026 · 5 min read · by the Rugsight team

Most Solana rug pulls are not clever. They rely on a few technical controls that anyone can read on-chain in under a minute, and on buyers who don't look. This guide walks through the checks we run in Rugsight, in the order we'd run them by hand, and is honest about what none of them can tell you.

You can do every check below with a block explorer such as Solscan and a DEX screener. Rugsight just runs them together and explains the result. Either way, you need the token's mint address, not its name or ticker: copycat tokens reuse popular names all the time.

1. Mint authority: can someone print more?

Every SPL token has an optional mint authority. If it is set, that address can create new tokens whenever it wants. A team that keeps it can dilute every holder, or mint a huge amount and sell it into the pool.

• Revoked (empty): the supply is fixed forever.
• Active: someone can still mint. That is normal for stablecoins and wrapped assets, where an issuer mints against reserves. For a memecoin it is a serious red flag.

Rugsight takes 30 points off the score for an active mint authority.

2. Freeze authority: can someone stop you from selling?

The freeze authority can freeze any holder's token account, so the tokens in it can't be moved or sold. That is the classic Solana honeypot: you can buy, but you can't sell.

Regulated stablecoins keep a freeze authority for compliance, and that is documented and expected. An anonymous token with an active freeze authority is not something you want to hold. Rugsight deducts 20 points.

3. Token-2022 extensions: the newer, quieter controls

Tokens created with the Token-2022 program can carry extensions. Several of them give an address power over your tokens without touching the mint or freeze authority:

• Permanent delegate: one address can transfer or burn tokens from any wallet. Rugsight deducts 25 points.
• Non-transferable: the token can't be sold at all.
• Transfer hook: a custom program runs on every transfer and could block sales.
• Default account state = frozen: new holders start frozen.
• Transfer fee: a cut on every transfer. A few percent is a tax; very high fees can make selling pointless.
• Pausable: an authority can pause all transfers.

Explorers show these, but they are easy to miss. If you only check mint and freeze authority, a Token-2022 token can still trap you.

4. Holder concentration: count wallets, not pools

"Top 10 holders own 90%" sounds alarming, and on Solana it is very often wrong. The biggest token accounts usually include the liquidity pool itself, the pump.fun bonding curve, program-owned accounts, or burn addresses. Those are not people who can dump on you.

What matters is how much of the supply sits in real wallets. We rank the largest token accounts, resolve each one to its owner, drop pools, programs and burn addresses, and then measure:

• Top 10 wallets over 80% of supply: high risk (30 points).
• Over 50%: elevated (20 points). Over 30%: worth noting (10 points).
• One wallet over 20%: a single whale that can crash the price alone (15 points).

We wrote up the details, and the edge cases, in why "top 10 holders own 90%" is often wrong on Solana.

5. Liquidity: can you actually get out?

Liquidity is the money in the trading pools. With thin liquidity, one sell moves the price a lot, and "the chart looks fine" means very little.

• No pool at all: you may not be able to sell (25 points).
• Under $10k: one sell can crash the chart (20 points).
• $10k to $50k: still low (10 points).
• Still on the pump.fun bonding curve: not a rug by itself, but price swings are extreme (10 points).

Liquidity can also be pulled. If the team controls the LP tokens, they can withdraw the pool. Check whether LP tokens were burned or locked. Rugsight does not score LP locks yet (see "what this misses" below).

6. Age: no track record is a risk on its own

A token whose first pool is less than a day old has no history at all. Most tokens that die, die early. Rugsight deducts 15 points under 24 hours, 8 under a week and 3 under a month. This is not an accusation; it is just the absence of evidence.

7. Read the score as a summary, not a verdict

Rugsight starts at 100 and subtracts the points above. 85 and up is grade A, 70 B, 50 C, 30 D, and anything lower is F. If we could not read holder or market data, the score is capped at B, because we can't call something low-risk without that data.

Some assets are designed to be controlled: USDC, USDT, tokenized stocks, wrapped and staked assets. Their issuers keep mint and freeze authority on purpose. For a short allowlist of those, Rugsight shows IC (issuer-controlled) instead of a letter, and still shows the technical score. That is counterparty risk, not a rug-pull pattern.

What automated checks miss

Be skeptical of any tool, including ours, that claims to detect every rug. These checks describe technical control and market structure. They don't read intent. Things Rugsight does not check today:

• Bundled launches and sniper wallets: many "different" wallets funded from one source at launch. Bubble-map tools are better for this.
• Developer history: whether the deployer launched and abandoned other tokens.
• LP lock or burn status for every pool type.
• Off-chain promises: team, roadmap, socials, or whether the "partnership" is real.
• Metadata tricks: a mutable name or logo that can change after you buy.

A clean score means the common technical traps are absent. It does not mean the token will go up, and it does not mean the team is honest.

A one-minute routine

1. Copy the mint address from a source you trust, not from a reply under a post.
2. Paste it into Rugsight (free, no sign-up) or check the authorities on an explorer.
3. If mint or freeze authority is active on a non-stablecoin, or there's a permanent delegate, stop there.
4. Look at real-wallet concentration and liquidity. Under $10k liquidity or one wallet over 20%: size your position like you could lose all of it.
5. For anything you're putting real money into, look at the full holder breakdown, then do the off-chain homework.

You can browse checks for popular tokens, see newly launched tokens checked every 30 minutes, or compare two tokens side by side. Developers and AI agents can call the same checks through the API, npm and PyPI clients.

Rugsight is an automated technical tool. Nothing here is financial advice.