How to Check if a Solana Token Is a Honeypot (Before You Buy)
By the MemeAssist Research Desk · Published 2026-08-25 · Updated 2026-08-25 · 6 min read
To check if a Solana token is a honeypot, verify three things before buying: the freeze authority is revoked (an active one can freeze your wallet's token account), there is no Token-2022 transfer hook or permanent delegate extension, and recent sells from ordinary wallets actually landed on-chain. An automated scanner like MemeAssist runs all three checks in seconds from the mint address.
Key Learnings
- Most Solana honeypots work through one of three mechanisms: an active freeze authority, a Token-2022 transfer hook, or a permanent delegate — all three are readable on-chain before you buy.
- In our 24-hour outcome study of 5,014 resolved tokens, 'clean contract' status alone was no safety guarantee — tokens with revoked authorities but extreme behavioural risk still died at 48.7%.
- Our real-funds desk pre-checks sellability before any automated entry and treats an unreadable or ambiguous permission state as a rejection, not a maybe.
What a honeypot is on Solana
A honeypot is a token engineered so that buying works and selling doesn't — at least not for you. On Ethereum this is done with malicious contract code. Solana's SPL token standard doesn't allow arbitrary code in the token itself, so Solana honeypots mostly work through a short list of permissions instead. That's good news: permissions are readable before you buy. If you've ever asked why can't I sell my Solana token, one of these three mechanisms is usually the answer.
The three mechanisms — and how to check each
1. Active freeze authority
If the freeze authority hasn't been revoked, the token's creator can freeze any holder's token account at will. You still "own" the tokens; you just can't move them. This is the classic Solana honeypot and the easiest to check: look up the mint on Solscan and confirm the freeze authority field reads null or revoked. Our freeze authority guide covers the nuances, including why a large established token with an active authority is a different case from a day-old memecoin with one.
2. Token-2022 transfer hooks
Token-2022 mints can attach a transfer hook — a program that runs on every transfer and can reject the ones it doesn't like, such as sells to a liquidity pool. A hook isn't automatically malicious, but an unverified hook on a fresh memecoin is a sell-blocker waiting to be switched on. The extension list is visible in the mint account; if you can't verify what the hook program does, treat the token as unsellable.
3. Permanent delegate
Another Token-2022 extension gives a designated wallet permanent authority to transfer or burn tokens out of any holder's account. It has legitimate uses in regulated assets. On an anonymous memecoin it means the creator can confiscate your position — a honeypot's meaner cousin.
A honeypot isn't detected by watching the chart. It's detected by reading the token's permissions — before your money is inside.
The fourth check: did anyone actually sell?
Permissions tell you whether a honeypot is possible. Recent transaction history tells you whether one is active. Open the token's recent trades and look for successful sells from ordinary wallets — not the creator, not the top holders. A token with hundreds of buys and no outside sells landing on-chain is telling you everything. This also catches the softer honeypot: sell taxes or hook logic tuned so sells technically succeed but return dust.
Passing the honeypot check is not the same as safe
The reverse mistake costs more money than honeypots do. In our study of 816 clean-contract tokens — mint revoked, freeze revoked, no honeypot mechanics at all — the ones our behavioural signals rated extreme-risk still died at 48.7% within 24 hours. Sellability is the floor, not the verdict. Holder concentration, creator history and liquidity depth decide what happens after you're allowed to sell; the full rug-check workflow covers the rest of the sequence.
Automating the check
All of the above is public on-chain data, and all of it is checkable by hand in a few minutes per token. MemeAssist runs the authority checks, Token-2022 extension checks and sell-history read on every analysis — the same pre-flight our own automated desk requires before it will commit real funds to a token, where an ambiguous permission state is treated as a hard rejection. Paste the mint address and the honeypot verdict is part of the first screen you see.
Frequently asked questions
What is a honeypot token on Solana?
A token engineered so you can buy but not sell. On Solana this is done through permissions rather than contract code: an active freeze authority, a Token-2022 transfer hook that blocks sells, or a permanent delegate that can move your tokens.
How do I check for a honeypot for free?
Look up the mint on Solscan: confirm freeze authority is revoked and check for Token-2022 extensions (transfer hook, permanent delegate). Then read recent trades and confirm ordinary wallets have successfully sold. An automated scanner does all three in seconds.
If the freeze authority is revoked, is the token safe to buy?
It's sellable, not safe. In our outcome data, clean-contract tokens with extreme behavioural risk signals still died at 48.7% within 24 hours. Honeypot checks are the floor — holder concentration, creator history and liquidity decide the rest.
Can a token become a honeypot after I buy?
Only if the mechanism already existed when you bought — an unrevoked freeze authority or a hook that gets activated. That's why the check is on permissions, not behaviour: if the authority is revoked and no hook exists, the creator cannot add one later to an existing mint.