Solana Rugpull Detection (8 Checks Before You Buy)
How to spot a Solana rug pull in 90 seconds: check mint authority, freeze authority, LP lock, holder concentration, and deployer history on Solscan.
About 60-70% of Solana memecoins end as rugpulls. Liquidity vanishes before Pump.fun graduation, LP holders dump on classic pools, retail holders are left with nothing tradable. A 90-second pre-buy scan is the only practical way to see this coming.
The eight checks, in the order they are worth running:
- Mint authority reads "None" on the mint account.
- Freeze authority reads "None" as well.
- LP tokens are burned or locked, not sitting in the deployer wallet.
- Top 10 holders are under 30% of supply between them.
- Deployer wallet has no history of launching and dumping.
- Volume comes from hundreds of wallets, not the same ten.
- Metadata shows "Is Mutable: false".
- Stage is known: bonding curve or graduated AMM.
Who this is for
Anyone glancing at a fresh Pump.fun or Raydium token. You know your way around the Solana ecosystem, you can open the Solscan token explorer, and you want to know what a healthy project looks like before you commit capital. Eight checks, none take more than 30 seconds.
1. Mint authority permanently revoked
If mint authority is still open, the owner can dilute supply at any time. A healthy token shows mint authority as "None" on Solscan. If a wallet address is still listed there, the risk is high. The owner is supposed to close that door with the Solana mint authority revoke tool, and the action is one-way.
2. Freeze authority and wallet freeze risk
Freeze authority left open lets the owner freeze any holder wallet at will. Yours included. You want to see "None" on Solscan in that field too. The Solana freeze authority revoke tool closes it. Exception: stablecoins and whitelist tokens that legally need the freeze power.
3. LP locked or burned
The liquidity pool is the single highest-impact failure point. If the LP tokens are not burned or locked, the owner can pull SOL from the pool in five minutes and the token price collapses. Check the pool details: are the LP tokens still in the deployer wallet, or sent to a burn address or lock contract? More on this in the Solana token guides category with side-by-side LP burn vs lock comparisons.
4. Top 10 holder concentration
Open the Solscan holder list and read off how much supply the top 10 wallets hold. Below 30%: healthy. 30-50%: watch closely. 50%+: high risk. 70%+: insider concentration, and a single sale tanks the chart. If multiple "fresh wallets" (only ever traded this token) appear in the top 10, the deployer is probably masquerading as holders.
5. Deployer wallet history
Look up the wallet that holds, or recently revoked, mint authority on Solscan. Does its tx history show other token launches? Were they all dumped 1-2 weeks later, with the wallet emptied afterwards? A repeating pattern is a serial rugpull signature. Brand-new wallets with less than a week of tx history carry their own risk.
6. Volume, real or fake
Pull up trade history on DexScreener or Birdeye. If 60%+ of volume comes from the same 5-10 wallets, you are looking at bot-generated volume. Real volume comes from hundreds of distinct wallets organically. Fake volume buys temporary listing visibility but has no demand under it. The holder analytics for Solana tool exposes the holder-to-volume ratio quickly.
7. Metadata immutable
If update authority is still open, the owner can change the name, symbol, image, and URI fields whenever they want. The thing you bought can rebrand into something else overnight. Solscan should show "Is Mutable: false" in the metadata section. A still-mutable token is a project that has not finalized its identity.
8. Bonding curve or AMM, which stage
On Pump.fun: still on the bonding curve, or graduated to PumpSwap? Pre-graduation has different risks (the owner cannot pull until the curve fills, but post-graduation behaviour shifts to LP-based). Once graduated, LP lock/burn becomes critical (loop back to check #3).
When to walk away
Three of these eight flagged red is a pass. One or two flagging amber means smaller position size. All green still does not guarantee anything; these checks reduce risk, they do not eliminate it.
Automating the checks
Manual checking takes 90 seconds per token. If you scan 20 tokens a day you need automation. The Solana token snapshot tool covers checks 1 through 6 from a single form. If you are launching your own token with the Solana token creator tool, run this same list against your project before launch, because investors will run it against you. More guides under the Solana tag page.
What is a Solana rug pull?
A rug pull is when the people who launched a token take the money and leave holders with something they cannot sell. On Solana it usually means the deployer drains the liquidity pool, or mints a flood of new supply, or rugs the metadata so the token you bought is no longer the token you thought you held.
The name comes from pulling the rug out: one moment there is a price and a chart, the next there is no buyer on the other side. The eight checks above exist to catch the setup before the pull happens, because once liquidity is gone there is no undo on-chain.
How a rug pull actually works on Solana
Almost every Solana rug traces back to one of three open doors. Mint authority left open lets the team print more tokens and sell them into your buys. Freeze authority left open lets them freeze your wallet so you cannot sell at all. Unlocked liquidity lets them withdraw the SOL side of the pool and walk away. A token that has closed all three doors can still fail on its own merits, but it cannot be rugged through any of these three mechanisms. That is the whole logic behind checks one, two, and three.
Soft rug vs hard rug
A hard rug is fast and obvious. The deployer pulls liquidity or dumps a hidden mint, the price goes to near zero in a single block, and the chart flatlines. There is nothing subtle about it and nothing you can do once it lands.
A soft rug is slow and quieter. Liquidity stays in the pool, authorities may even be revoked, but the team stops shipping, abandons the socials, and the insider wallets bleed their bags into every bounce over days or weeks. The chart does not crash, it grinds down.
Soft rugs are harder to score because the on-chain setup can look clean. This is where checks five and six earn their keep: a deployer with a history of dead launches, plus volume concentrated in a handful of wallets, is the fingerprint of a slow bleed even when mint and freeze read "None".
A clean authority scorecard rules out a hard rug. It says nothing about a soft rug. Always pair the authority checks with deployer history and holder spread.
Free Solana rug pull check tools
You can run every check in this guide for free without connecting a wallet. Solscan gives you mint authority, freeze authority, holder list, and the "Is Mutable" flag. DexScreener and Birdeye give you the volume and wallet spread. To pull checks one through six into one screen instead of six browser tabs, the Solana holder snapshot tool reads authority status, top holder concentration, and the holder-to-volume ratio from a single mint address. Reading a token costs nothing and needs no signature, since it only queries public on-chain data.
If you are checking your own project before launch, the same authority states are what investors will grade you on. Closing the mint door with the revoke mint authority tool and the freeze door with the revoke freeze authority tool turns two of your three biggest red flags green. Both actions are one-way and run from your own wallet in the browser, and the current platform fee is shown on each tool page before you confirm.
Frequently asked questions about a Solana rug pull
How fast does a rug pull happen?
Pulling liquidity is a single transaction. The price reaches the floor within one block, so under half a second. The warning signs, on the other hand, sit there for days: unlocked LP, open mint authority, supply stacked in the top ten wallets. Run the checks before you buy and you have all the time you need. After you buy, you have none.
If mint authority reads "None", is the token safe?
No. One door is shut, that is all. A closed mint authority stops supply dilution and nothing else. If liquidity still sits in the deployer wallet, or three wallets hold seventy percent of supply, the token can still go to zero overnight. The eight checks only mean something together.
Are Pump.fun tokens safer?
While a token is on the bonding curve the liquidity lives inside the contract and the creator cannot withdraw it, so the classic liquidity pull is off the table at that stage. The moment it graduates to PumpSwap that changes, and the LP check becomes the most important item on the list again.
How do I track a wallet that has rugged before?
Open the deployer address on Solscan and read its transaction history for other mints. If the same wallet launched three tokens two weeks apart and emptied all three, the pattern is already visible. Save the address. The same team comes back under a new name.
Can I run every check with free tools?
Yes. Solscan shows the authority fields, the holder list and the "Is Mutable" flag at no cost, and DexScreener covers the volume spread. You never connect a wallet, because all of it is public on-chain data.
Should I run this list against my own token?
Yes, and before launch rather than after. Buyers will run it against you. Close mint and freeze, lock the metadata, then burn or lock the LP. Turning those three green removes the biggest single objection standing between a stranger and a buy.
Extend the safety review
Pair the eight checks with the structural differences between memecoins and utility tokens, the common token holder problem checklist, and the on-chain evidence in the 121-wallet PUMP unlock investigation.
