Rug Pull Check: A Practical Guide for Solana Traders
Learn how to run a rug pull check on any Solana token. Step-by-step liquidity, ownership and holder signals that reveal real risk before you buy.
Published
Updated
In the late-2024 Solana memecoin boom, CoinGecko reported an average of 35,500 new memecoins per day, with issuance peaking at 73,700 tokens in January 2025 (CoinGecko's State of Memecoins report). At that pace, a rug pull check isn't a final safety stamp. It's a fast, evidence-based decision about who controls the token, where the liquidity sits, and whether trading activity looks organic.
Historical research shows why price action alone is inadequate. Exit scams accounted for 37% of cryptocurrency scam revenue in 2021, compared with 1% in 2020, while another academic analysis placed losses from cryptocurrency rug pulls above $2.8 billion in 2021 (peer-reviewed study of rug pulls and cryptocurrency scams). The practical problem today is more nuanced: many Solana launches aren't obviously fraudulent, but they still expose buyers to insider control, thin liquidity, and coordinated exits.
A useful check therefore produces a calibrated reading of evidence, not a binary “safe” or “unsafe” label. The grey zone between a genuine early launch and an engineered exit is where most of the judgment matters.
Table of Contents
- Why a Rug Pull Check Matters More Than Ever on Solana
- The Three Layers Every Rug Pull Check Should Cover
- Reading Token Control Permissions the Right Way
- Reconstructing Liquidity Behaviour From Pool Events
- Analysing Trading Patterns and Creator-Linked Wallets
- The Grey Zone Between Fair Launch and Exit Scam
- A Pre-Trade Rug Pull Check You Can Reuse
Why a Rug Pull Check Matters More Than Ever on Solana
74% of new Solana tokens are scams, according to An infographic titled The Solana Rug Pull Reality highlighting that 74% of new Solana tokens are scams.. That figure matters because Solana compresses token creation, promotion, and trading into minutes, not days. By the time a chart starts moving, traders are often still trying to identify the deployer, map linked wallets, and work out whether early volume came from real buyers or a coordinated cluster. As noted earlier, CoinGecko's late-2024 issuance data shows how quickly that flow can overwhelm any manual screening process.
In practice, this means a trader looking at a 2-hour-old token cannot rely on social proof, a moving chart, or a busy Telegram. The first useful clues are usually on-chain. Who still holds control. Who seeded liquidity. Who bought first. Which wallets keep reappearing around the launch.
History supports that caution. The peer-reviewed study of 101 rug pulls cited earlier found six recurring service types and showed that most affected projects were short-lived. Short project age does not prove malicious intent, but it does remove one of the few things traders often assume they have, time to observe behaviour before taking risk.
Why one score fails
A single score hides the part that matters, the mix of signals behind it. An active mint authority, concentrated holders, or strange liquidity movement are all meaningful. None of them settles the case alone. I have seen tokens with revoked authorities still collapse because creator-linked wallets controlled enough supply to exit into retail demand. I have also seen messy launches survive because the risky permissions were removed quickly and liquidity stayed in place long enough for distribution to widen.
That is why a rug pull check works better as a calibrated reading of evidence than a safe or unsafe label.
A systematic analysis of rug-pull causes identified 34 underlying causes, while commonly used datasets covered only 2,448 incidents across seven causes, about 20% of that taxonomy. A broader dataset reached 54% coverage, which still leaves room for patterns that simple scanners miss. On Solana, the grey zone is common. Some launches are sloppy, insider-heavy, and still tradable. Others look functional right up to the exit. The job of a rug pull check is to separate direct kill-switch risk from weaker but still serious evidence, then judge whether the remaining upside justifies that specific structure of risk.
The Three Layers Every Rug Pull Check Should Cover
The most reliable workflow has three sequential layers. Each answers a different question, and each has blind spots that the others can expose.
Layer one focuses on control
Start with the token's permissions. On Solana, inspect whether mint authority and freeze authority remain active, whether ownership can be transferred, and whether upgradeable program logic or external calls create additional control paths. This layer detects direct technical powers, but it won't reveal every economically important relationship between wallets.
An active freeze authority can create a direct restriction risk. A revoked freeze authority removes that particular control, but it doesn't eliminate insider concentration, coordinated selling, or liquidity extraction. The result is a control assessment, not a safety verdict.
Layer two reconstructs liquidity
Next, follow the pool rather than relying on a current liquidity snapshot. Record the initial deposit, later additions, withdrawals, last interaction, and inactive periods. Compare withdrawals with the wallets that received the assets, then ask whether the remaining pool can absorb selling from concentrated holders.
This layer catches hard liquidity pulls and helps separate an abrupt drain from normal rebalancing. It can miss a soft rug in which insiders retain liquidity but distribute tokens gradually.
Layer three identifies economic behavior
Finally, cluster creator-linked wallets and inspect their early buys, sells, transfers, and timing. Look for bundled transactions, synchronized launches, and groups of wallets that behave as one actor. Then compare price and volume changes with net liquidity movement. Rising volume paired with falling liquidity can indicate that apparent demand is masking an exit.
| Layer | Detects well | Can miss |
|---|---|---|
| Permissions | Mint, freeze, ownership, and program-control risks | Coordinated selling by wallets without privileged permissions |
| Liquidity | Withdrawals, inactivity, and pool-asset extraction | Slow insider distribution without a pool drain |
| Trading behavior | Bundled buys, wallet clusters, synchronized exits, and pump-and-dump patterns | Relationships that aren't visible from available wallet history |
The layers work together because no single flag has enough context. A token with revoked authorities, stable liquidity, and independent holder growth presents a different profile from one with the same authority status but synchronized creator-linked selling.
Reading Token Control Permissions the Right Way
A Solana token's mint authority determines whether an authorized account can create additional supply. Freeze authority can let an authorized account restrict token-account activity. Those permissions deserve attention because they describe direct control, but they're only the first part of the analysis.
What to verify on-chain
Open the token account in a Solana explorer or a reputable scanner and record the current mint and freeze authorities. Don't stop at a green or red label. Preserve the authority addresses and the transaction that established their current state, because control can change after your initial review.
A revoked authority means the relevant permission has been removed from the token configuration. It doesn't prove that the creator has no influence. Related wallets may still hold a large, sellable allocation, and an upgradeable program may retain capabilities that a basic token-permission view doesn't show.
For a focused explanation of the mechanics, review this guide to Solana freeze authority.
Ownership transferability matters as well. Ask whether ownership can move to another account, whether the controlling program is upgradeable, and whether hidden owner functions or external calls can alter behavior. A project can present a “renounced” appearance while the economically important controls remain elsewhere.
Authority status is evidence about permission, not evidence about intent.
The video below provides another visual way to understand how mint and freeze controls fit into a token review.
The residual-risk question
Suppose mint and freeze authority are revoked. That removes two direct technical risks, but the check still needs to examine creator-linked wallets, pool control, distribution, and trading behavior. A creator can't mint more tokens but may still sell an existing allocation into shallow liquidity.
Conversely, an active authority isn't automatically proof of an exit scam. A legitimate project may retain a permission for an operational reason, but it should explain the purpose and show behavior consistent with that explanation. The key distinction is between documented, bounded control and unexplained control combined with concentrated ownership or suspicious wallet activity.
Reconstructing Liquidity Behaviour From Pool Events
Liquidity failures rarely look identical on Solana. Some pools are drained in one move. Others stay tradable long enough to look healthy while risk shifts from the LP to outside buyers. A rug pull check works better when you read liquidity as a sequence of decisions, not a single number on a dashboard.
Start at the first meaningful pool deposit on Raydium, Meteora, or the venue where price discovery began. Record who supplied each side of the pair, whether those wallets trace back to the creator, and what happened once trading opened. Then separate each later add or removal into its own event. Pool history gets distorted fast when every liquidity change is collapsed into one balance.
Follow the assets, not just the chart
A withdrawal matters most when it changes exit conditions for everyone else. If related wallets remove a large share of the valuable asset, the pool stays thin, and no independent liquidity comes back in, risk rises sharply. Check where the withdrawn assets went, whether those wallets later swapped or consolidated funds, and whether the removal lined up with a sudden drop in price or sellability.
Context matters. An LP rebalance by an unrelated wallet can look alarming on a chart while the market remains orderly on-chain. The same raw event means something very different when the withdrawing wallet is tied to launch funding or early token allocation.
Quiet periods are useful too. A pool that gets seeded, attracts a burst of buying, then goes still while linked wallets move assets deserves closer attention than one that keeps attracting fresh deposits and independent trading flow. Inactivity does not prove intent, but it helps distinguish organic participation from launch-only activity.
For a faster event-by-event review, use a Solana liquidity checker to organize deposits, removals, and timing.
Hard pull versus gradual distribution
The clearest hard-rug pattern is still an immediate liquidity withdrawal. The valuable side leaves the pool, holders are left with tokens, and ordinary exits stop working.
Gradual distribution is less obvious. Liquidity can remain in place while creator-linked wallets sell into demand over time, which is why a token can sit in the grey zone between fair launch and obvious scam. The chart may still print volume. Buyers may still get fills. But if related wallets hold more tokens than the remaining pool depth can absorb without severe slippage, the risk is real even without a visible LP drain.
As noted earlier, token-distribution failures accounted for a large share of reported losses in broader rug-pull research. The practical takeaway is simple. Pool size only answers part of the question. You also need to measure who can still sell, how much they control, and whether liquidity behavior gives them an easy path to exit.
Analysing Trading Patterns and Creator-Linked Wallets
Wallet clustering is where a basic token scan becomes on-chain analysis. The goal isn't to label every early buyer as an insider. It's to identify wallets that appear coordinated and then test whether their behavior creates an exit risk.
Begin with the creator wallet and trace initial funding, token distribution, early buys, transfers, and sells. Group wallets that share funding sources, receive tokens from the same account, trade in synchronized windows, or repeatedly interact with the same launch infrastructure. Bundled transactions in the same block deserve attention because they can indicate planned allocation rather than independent discovery.
Read timing with price and liquidity
A single early sell may be profit-taking. Several related wallets selling in a coordinated sequence while promotional activity intensifies is materially different. Compare those sales with net liquidity movement, price changes, and volume. A pump-and-dump pattern often shows apparent demand accelerating while insiders distribute into it.
Consider a token with stable liquidity and no active mint authority. On a surface-level scan, it may look acceptable. If the creator and several funded wallets bought in the same block, retained a large sellable allocation, and began synchronized selling as outside volume rose, the token still fails the behavioral part of the check. Healthy liquidity doesn't cancel coordinated distribution.
Record transaction signatures at the time of analysis. Wallet relationships and pool conditions change, so a stored signature lets you verify what happened rather than relying on a later chart or an altered dashboard.
| Pattern | What it looks like | Interpretation |
|---|---|---|
| Same-block clustered buys | Several wallets acquire tokens during the launch window and share funding links | Possible coordinated allocation, especially if the wallets later sell together |
| Creator-funded wallets | The creator sends funds or tokens to multiple buyers before trading activity expands | Potential insider distribution or concealed ownership |
| Synchronized sells | Related wallets sell within a narrow period while public volume rises | Stronger evidence of an organized exit than one isolated sale |
| Price rises while net liquidity falls | Chart momentum continues as pool assets leave | Demand may be absorbing an exit, leaving weaker support |
| Gradual creator distribution | Related wallets sell in stages while liquidity remains active | Soft-rug or pump-and-dump risk, depending on timing and concentration |
A Solana smart-money wallet tracker can support the clustering process, but no tool knows the intent behind every transfer. Use wallet evidence with permissions, liquidity events, and holder changes.
The Grey Zone Between Fair Launch and Exit Scam
Concentration, bundled buys, and creator-linked wallets aren't automatically proof of fraud. Early-stage launches often begin with a small group of wallets, and a creator may use several addresses for operational reasons. On Solana, a noisy launch can resemble an engineered one before enough independent trading history exists.
The question is whether the signals strengthen or weaken each other. Did related wallets buy in the same block and receive funds from one source? Do creator-linked wallets still control a large sellable allocation? Is liquidity deep enough to handle that supply, or would a coordinated exit overwhelm the pool?
Watch the direction of change
A risky but genuine fair launch can improve as independent holders arrive and concentration declines. That trend doesn't guarantee success, but it reduces the influence of the earliest wallets. A dangerous insider-controlled token may show the opposite pattern, with related wallets retaining supply, controlling the narrative, and selling into newly arrived buyers.
Timing separates several patterns that scanners often combine. An immediate pool withdrawal is different from gradual insider distribution. A coordinated launch allocation is different from unrelated early buyers who happen to trade around the same time. Freeze-authority abuse, liquidity withdrawal, and pump-and-dump behavior have appeared as distinct on-chain patterns in Solana research (Solana rug-pull measurement study).
The useful question isn't “How many red flags are there?” It's “Do the signals describe one control pattern?”
Treat uncertainty explicitly. If the evidence is incomplete, reduce confidence rather than forcing a clean label. A token can be too risky to buy even when fraud hasn't been proven, and a token can be legitimate while still carrying severe early-stage volatility and liquidity risk.
A Pre-Trade Rug Pull Check You Can Reuse
Before buying, run the same sequence every time:
- Permissions: Record mint and freeze authority, ownership transferability, upgradeability, and any unusual program controls.
- Liquidity: Reconstruct deposits, additions, withdrawals, inactivity, and the wallets receiving removed assets.
- Distribution: Separate pools, exchanges, burn addresses, and contracts from economically relevant holders.
- Wallet behavior: Cluster creator-linked wallets, inspect early buys and sells, and check for shared funding or same-block activity.
- Market context: Compare price and volume with net liquidity and the amount of concentrated supply that could be sold.
- Evidence log: Save transaction signatures and the analysis time so you can repeat the review after material changes.
Automated scanners are effective at surfacing obvious permission problems, wallet concentration, liquidity events, and trading anomalies. They're less reliable when legitimate early-stage behavior and insider coordination produce similar patterns. A flagged token still needs a human reading of the underlying evidence, while a clean result doesn't remove market or execution risk.
For deeper review, MemeAssist provides on-demand Solana token reports that combine live checks across liquidity, holder concentration, creator behavior, wallet activity, trading patterns, and historical indicators. Its outputs include a Rug Risk Rating, an AI-written verdict, and a detailed risk breakdown, without requiring a wallet connection. Rerun any analysis after meaningful liquidity or holder changes, because a token's risk profile is a moving record rather than a permanent property.
MemeAssist turns a Solana token address into an on-demand risk report covering rug-pull signals, holder concentration, liquidity, creator behavior, and trading patterns. Run a report before you trade, compare the evidence behind the rating, and visit MemeAssist to examine a token with a more disciplined rug pull check.