Honeypot
A token designed so that buyers can purchase but cannot sell — their tokens are trapped by a smart contract mechanism that selectively blocks outbound transfers.
Definition
A honeypot is a token where the contract or program code allows purchases to succeed but causes sell transactions to fail or revert, trapping the buyer's funds permanently. The name comes from the trap metaphor: the price action looks attractive (honey), luring buyers in, but once inside they cannot exit. On Solana, honeypots are implemented through two primary mechanisms: freeze authority (the developer freezes specific holder accounts, preventing transfers) and Token-2022 transfer hooks (custom code that runs on every transfer and conditionally reverts sell transactions). Both mechanisms are detectable on-chain before buying. A third form — selective allowlists — maintains a list of addresses permitted to sell, excluding retail buyers. Honeypot tokens are designed purely to extract money with no path to recovery; once purchased, the buyer's funds are permanently lost unless the developer voluntarily enables selling.
How honeypots work on Solana
Unlike Ethereum, where most honeypots are implemented in custom ERC-20 transfer() logic, Solana's token architecture uses the SPL Token program and Token-2022 extensions. The three main honeypot mechanisms:
- Freeze authority: the developer calls FreezeAccount on your token account after you buy, preventing any outbound transfer. Simple, detectable, but still used. MemeAssist flagged 45 tokens with active freeze authority in a single week (Jul–Aug 2026).
- Transfer hooks (Token-2022): a custom program is registered as a hook that executes on every token transfer. The hook can check whether the recipient is an AMM pool (a sell) and revert the transaction, while allowing peer-to-peer sends and buys to succeed. These are harder to detect because you need to read and audit the hook program's logic, not just check an authority field.
- Allowlist/blocklist programs: a custom token program (not standard SPL) that maintains a whitelist of addresses permitted to transfer. The developer is on the whitelist; buyers are not added.
Why honeypots are hard to spot in the moment
A honeypot looks identical to a legitimate token during the buying phase. The price moves, trades execute, your wallet shows a balance — everything appears normal until you try to sell. By that point, the developer has collected all the buy-side SOL and disappeared. The only reliable detection method is pre-purchase contract inspection, not post-purchase observation.
Pre-purchase honeypot detection
Check all three before buying:
- Freeze authority: look at the token mint account on Solscan. Freeze authority field must be null/revoked.
- Token program: is it standard SPL Token or a custom program? Custom programs require additional scrutiny.
- Token-2022 extensions: if the token uses Token-2022, check for transfer hook extensions in the mint account data. If a hook program is registered, that program's code must be audited or treated as a disqualifying risk.
MemeAssist checks all of these automatically. Transfer-hook extensions were flagged on 58 tokens in a single week of telemetry — making them one of the most common detected honeypot vectors.
Frequently asked questions
Can a honeypot be reversed if the developer decides to enable selling later?
Technically yes for freeze-authority honeypots — the developer can unfreeze accounts. In practice, developers who deploy honeypots never do this; the entire intent is to extract funds permanently. There is no recourse mechanism for buyers. Never buy a token where selling depends on the developer's future goodwill.
Is wash-traded volume on a honeypot a detection signal?
Yes. Honeypots often show high buy volume and near-zero sell volume — because sells fail. If a token's on-chain data shows many buy transactions but almost no successful sells, that asymmetry is a strong honeypot indicator. MemeAssist's wash-trade detection looks at buy/sell ratios alongside transfer-hook and freeze-authority checks.
Are honeypots more common on pump.fun or on manual launches?
More common on manual launches. pump.fun's bonding curve uses its own program and does not support custom transfer hooks or external freeze authority — the mechanism doesn't apply while a token is on the bonding curve. After graduation to Raydium, or on tokens launched directly to Raydium without pump.fun, all honeypot mechanisms are available. Always check Token-2022 extension status on tokens that didn't originate on pump.fun.