How to check if a pump.fun token is a rug (before you buy)
November 3, 2026 · 7 min read · by the Rugsight team
"Is this pump.fun coin a rug?" is a slightly different question from "is this Solana token a rug?". Pump.fun takes a few of the classic rug-pull tools away from creators by design. That's good, but it also means the usual checklist gives you a lot of green ticks that tell you very little. This guide explains what pump.fun already rules out, what it doesn't, and how to check the rest in a few minutes.
If you want the general checklist for any Solana token, read how to check a Solana token for rug-pull risk first. This post is the pump.fun-specific version.
What pump.fun already rules out
According to pump.fun's public program documentation, a coin created through the Pump program works like this:
- Every coin has the same fixed total supply of 1 billion tokens. About 793.1 million of them start on the bonding curve for sale; the rest is reserved for the liquidity pool later.
- Mint authority and freeze authority are revoked. Nobody can print more tokens, and nobody can freeze your token account so you can't sell.
- While the coin is on the bonding curve, there is no liquidity pool that someone owns. The Pump program itself sells you tokens and buys them back, priced by a formula.
- When the curve's tokens are all bought, the curve is marked complete and anyone can trigger migration to a PumpSwap pool. The LP tokens from that pool are burned, so the liquidity in this canonical pool can't be withdrawn.
So on a genuine pump.fun coin, three famous rug patterns are off the table: the infinite mint, the freeze honeypot and the "dev pulled the liquidity" exit.
So how do pump.fun coins rug?
Mostly by selling. Whoever holds a large share of the supply can sell it into the curve or the pool at any time, and the price falls with every sell. The common versions:
- Dev dump: the creator buys early, often in the same transaction that creates the coin, and sells into the first wave of buyers.
- Bundles: the creator (or a group) buys from many fresh wallets at launch, so the supply looks spread out when it isn't. Those wallets then sell together.
- Snipers: bots that buy in the first seconds and sell as soon as there is a profit. Not always malicious, but the effect on late buyers is the same.
- Post-migration dump: big holders wait for graduation, when attention and buyers spike, then sell into the new pool.
- Copycats: a second coin with the same name, ticker and picture. Nothing is wrong with its code; you just bought the wrong token.
Burned LP doesn't help with any of these. That's why, for pump.fun coins, who holds the supply matters far more than the authority checks.
Step 1: make sure you have the right mint
Names and tickers are not unique. Before anything else, get the mint address from a source you trust: the coin's page on pump.fun (the address is in the URL, pump.fun/coin/<mint>), or a link the project itself published. Don't copy it from a reply under a post.
Most pump.fun mint addresses end in the letters pump. That's a vanity suffix, not proof: anyone can generate an address ending in pump, and a coin elsewhere can copy the name. Compare the full address, not the first and last few characters.
Step 2: confirm the authorities anyway
Even though pump.fun revokes mint and freeze authority, check them. It takes seconds, and it catches a specific scam: a token that claims to be a pump.fun launch but was created somewhere else.
- Mint authority active or freeze authority active on a coin that says it's from pump.fun: it isn't a normal pump.fun coin. Stop there.
- If the token uses the Token-2022 program, look at its extensions too. A permanent delegate lets one address move or burn tokens from any wallet, a transfer hook runs custom code on every transfer, and a non-transferable or paused token can't be sold. A large share of new Solana launches now use Token-2022 (95.5% of the 558 new tokens in our feed snapshot), so this check is not optional.
Rugsight checks the authorities and Token-2022 extensions for you, and you can paste a pump.fun link directly instead of the bare address.
Step 3: is it still on the bonding curve or has it graduated?
This changes how you read everything else.
Still on the curve. The price comes from the curve formula, and each buy makes the next one more expensive. Small amounts of SOL move the price a lot, in both directions. You can sell back to the curve, but what you get depends on how many people sold before you. In holder lists, the largest token account is usually the bonding curve itself: that's the program's inventory, not a whale. Rugsight separates it out and flags curve coins with a moderate risk note, because the price swings are extreme even when nothing malicious is going on.
Graduated. Trading moved to a PumpSwap pool whose LP tokens were burned at migration. Two things to check:
- The liquidity in the pool. Under about $10k, a single sell can crash the chart.
- That the chart you're looking at is the canonical pool. Other pools for the same token can exist if someone creates them separately; they don't come from the migration and their liquidity isn't locked the same way.
Step 4: look at real-wallet concentration and the dev wallet
Ignore the bonding curve, pools, programs and burn addresses, and look at what real wallets hold:
- One wallet over 20% of supply can crash the price on its own.
- Top 10 real wallets over 50% means a handful of people control the exit.
Then find the creator. The pump.fun page shows who created the coin. On an explorer, check how much the creator wallet still holds and whether it has already sold. A creator holding a big bag is a risk; a creator who sold everything in the first minutes is a signal about how they see their own coin.
Rugsight resolves the top token accounts to their owners and removes pools, programs and burn addresses before measuring concentration. We explain why that matters in why "top 10 holders own 90%" is often wrong on Solana.
Step 5: check for bundles and snipers (by hand)
This is the part automated scores, including ours, mostly miss. Open the token on an explorer and look at its earliest transactions:
- Many buys in the same block as the creation, or in the first few seconds, from wallets that had no history before.
- Those wallets funded from the same source shortly before launch. Bubble-map style tools make this visible as a cluster.
- Similar buy sizes and then sells at the same time.
Twenty wallets with 2% each can be one person with 40%. If the early buyers look like a cluster, treat the real-wallet concentration as much higher than it appears.
Step 6: check the creator's history
On pump.fun, the creator's profile lists the other coins they launched. A wallet that has launched dozens of coins that all died within hours is telling you its business model. On an explorer you can also check where the creator's SOL came from and where it went after previous launches.
Step 7: check age, activity and the off-chain story
- Age: a coin that's minutes or hours old has no track record. Most coins that die, die early.
- Volume vs liquidity: huge volume on thin liquidity can be wash trading or bots.
- Socials: links on the pump.fun page that don't exist, were created yesterday, or don't link back to this exact mint are a warning, not a comfort.
A two-minute pump.fun routine
- Copy the mint from the coin's own pump.fun page and compare the full address.
- Paste the link or address into Rugsight (free, no sign-up) or check the authorities on an explorer. Any active mint or freeze authority, permanent delegate or transfer hook: walk away.
- Note whether it's on the bonding curve or graduated, and check pool liquidity if graduated.
- Check real-wallet concentration and how much the creator holds or has sold.
- Scan the first transactions for bundled or sniper wallets.
- Look at the creator's previous coins.
- Size the position as if you could lose all of it, because on a new pump.fun coin you can.
Examples to compare
Some of the best-known Solana memecoins started on pump.fun and later graduated, for example Fartcoin and Goatseus Maximus (GOAT). Their pages show what a mature pump.fun coin looks like on the same checks. For the opposite end, the new-token feed shows freshly launched tokens checked every 30 minutes, many of them pump.fun coins, and token risk stats aggregates what those checks find. You can also run /check <mint> in our Telegram bot.
What this can't tell you
A clean result means the technical traps are absent and the supply isn't obviously concentrated. It doesn't mean the coin will go up, that the holders won't sell, or that the people behind it are honest. Pump.fun coins are extremely volatile even when nothing is wrong. Rugsight does not currently detect bundles, sniper clusters or developer history; use the manual checks above for those.
Rugsight is an automated technical tool. Nothing here is financial advice.