How to Avoid Rug Pulls on Solana: 10 Checks Before You Buy
2026-10-2010 min read
Most rug pulls on Solana are not surprises. The clues are on-chain before you ever press buy: a dev who can still print tokens, liquidity that can be pulled, ten wallets holding half the supply, a "launch" where twenty wallets bought in the same block. If you want to avoid rug pulls, you don't need insider tools. You need a fixed routine and about two minutes per token.
This guide gives you that routine: 10 checks, where to find each one, what a red flag looks like, and which of them a trading bot can run for you automatically.
Quick summary
- Rugs on Solana come in four shapes: liquidity pulls, dev dumps, bundles and "trap" token settings. Each one leaves a trace you can check.
- The first three checks (mint authority, freeze authority, token extensions) take 20 seconds and rule out the worst traps.
- Supply is the real risk on Pump.fun tokens: check the top holders, the dev wallet and bundles before anything else.
- No checklist makes a token safe. It makes the obvious traps rare, and your position size and stop loss handle the rest.
What a rug pull looks like on Solana in 2026
"Rug pull" is used for anything that went to zero, but the mechanics matter, because each one is caught by a different check:
- Liquidity pull. The creator adds liquidity to a pool, waits for buyers, then removes the liquidity. The price can't recover because there is nothing left to sell into.
- Dev dump. The creator, or wallets they control, holds a big part of the supply and sells it into the first wave of buyers.
- Bundle. The dev buys their own token across many wallets in the launch block, so the supply looks spread out while one person controls it. We broke down a real case in Robinhood Chain Rug Pull Ring: $18.43M Drained, where the group held 82–86% of supply after launch.
- Trap settings. The token itself is built to stop you: new supply can be minted, your account can be frozen, or a transfer fee eats your sell.
A note on Pump.fun: tokens there launch with a fixed supply of 1 billion, and the liquidity is burned when a token graduates to PumpSwap. The classic liquidity pull is rare. The danger on Pump.fun is who holds the supply and when they sell, which is why checks 6 to 8 matter most for those tokens. Our Pump.fun sniping guide shows how fast that selling usually comes.
The 10 checks
1. Mint authority is revoked
If the mint authority is still active, someone can create new tokens at any moment and sell them into the pool. Look it up on Solscan or a token scanner such as RugCheck: you want Mint Authority empty or revoked.
Red flag: an active mint authority on a token that is already trading.
2. Freeze authority is disabled
A freeze authority can freeze the token account in your wallet. You still see the balance, but you can't sell it. That is the Solana version of a honeypot.
Red flag: freeze authority set to any wallet.
3. No dangerous token extensions
Tokens created with the newer Token-2022 program can carry extensions. Most are harmless, but a few can be used against buyers: a transfer fee that takes a cut of every sell, a transfer hook that runs custom code on each transfer, a permanent delegate that can move tokens out of any wallet, or accounts that start frozen by default.
Red flag: any of those four on a memecoin. A meme doesn't need them.
4. Liquidity is burned or locked
For tokens trading in a pool, check whether the LP tokens were burned or locked. Burned LP means the liquidity can't be withdrawn. Graduated Pump.fun tokens burn it automatically; tokens launched straight into other pools may not.
Red flag: LP held in a normal wallet that can withdraw it whenever it wants.
5. Liquidity is deep enough for the market cap
A token with a $1M market cap and $20K of liquidity looks big but trades small: a few sells move the price hard, and your own exit will cost you more than you think. Compare the pool size with the market cap and with the size you plan to buy.
Red flag: your planned buy is more than 1–2% of the pool, or liquidity is a tiny fraction of the market cap.
6. Top holders are not too concentrated
Open the holders list and ignore the pool and bonding curve accounts. Add up the top 10 real wallets.
Red flag: the top 10 hold more than about 25–30% of supply, or one wallet holds more than 5–10%.
7. The dev wallet holds little and has a clean past
Find the creator wallet. How much of the supply does it still hold? What happened to the last tokens it launched? A wallet that launched 40 tokens that all went to zero within an hour is not unlucky, it is a business.
Red flag: the dev holds more than 5–10%, or most of their previous launches died within hours.
8. No bundle in the first block
Look at the first transactions. If 10 or 20 wallets bought in the same block as the launch, with similar amounts, often funded from the same source minutes earlier, that is a bundle. A bubble map such as Bubblemaps makes the links between those wallets easy to see.
Red flag: a cluster of linked wallets holding a big share of supply from block one.
9. Volume comes from real traders
High volume is easy to fake: the same handful of wallets buying and selling to each other, often in round sizes, to push the token onto trending lists. Look at how many unique wallets are trading and whether the same addresses keep appearing on both sides.
Red flag: huge volume from a small number of wallets, or a sudden volume spike right after a paid promotion.
10. Socials and story hold up
The weakest signal, but still useful as a filter: does the token have a website or X account, was that account created yesterday, is the name a copy of a token that ran last week? Missing socials rule out most auto-generated tokens.
Red flag: no links at all, or links to accounts created the same day with bought followers.
A two-minute routine
Order matters, because the first checks are instant fails and the later ones need judgment:
- 0:00 to 0:20: mint authority, freeze authority, token extensions. Any red flag: skip, no discussion.
- 0:20 to 0:50: liquidity burned or locked, liquidity versus market cap and your size.
- 0:50 to 1:30: top 10 holders, dev wallet and its past launches, first-block bundle.
- 1:30 to 2:00: volume quality and socials.
- Decide: a red flag in 1–2 means skip. One soft flag in 3–4 means buy smaller than usual with a tight stop. Clean on all ten means normal size, still with a stop loss.
Let your bot run the checks for you
Checking every token by hand works when you buy two tokens a day. It doesn't when a copy trade or a sniper fires in under a second. That is where filters do the job:
- Copy trading in TradeWiz can skip tokens whose ownership isn't renounced (Unrenounced) or whose pool LP isn't burned (Unburned), skip pools below a Min LP, and only copy inside a market cap and token age range. Details in the Copy Trading guide.
- Sniping can cap Dev Holding, require Social Media links and keep a blacklist of up to 50 tokens. See the Sniper guide.
Filters won't catch everything, and the wallets you copy matter just as much: a wallet that buys bundled tokens will drag you into them. Our guide to finding smart money wallets covers how to spot those wallets before you follow them.
What checks can't protect you from
A token can pass all ten checks and still drop 80% in ten minutes. Clean contracts don't stop early buyers from taking profit, and narratives die fast. The checks remove the traps; your risk rules handle the rest:
- Size every trade so that a total loss is boring, not painful.
- Set your exit before you buy: an auto sell with a stop loss, as in Memecoin Take Profit: Auto Sell, Trailing Stop or Limit Order?
- Keep your trading wallet separate from your savings, as explained in Are Trading Bots Safe? 10 Rules to Keep Your Wallet Safe.
FAQ
Can a token pass every check and still rug?
Yes. A dev can hold through the first hour and sell later, or a group can use fresh wallets that look unrelated. The checks make the obvious traps rare; they don't make any token safe.
Is burned liquidity enough?
No. Burned LP stops a liquidity pull, but not a dev or a bundle dumping their tokens into that liquidity. Check holders and bundles too.
Are Pump.fun tokens safer than other launches?
They remove some risks: fixed supply and burned LP at graduation. They don't remove supply risk. Bundles and dev dumps are common on Pump.fun, so checks 6 to 8 matter most there.
What is a honeypot on Solana?
A token you can buy but not sell. On Solana that usually means an active freeze authority or a Token-2022 setting such as a permanent delegate or a huge transfer fee.
Which free tools should I use?
Solscan for authorities, holders and transactions, a bubble map for wallet clusters, and any token scanner that summarizes authorities and LP status. Use more than one: they read the same chain but present it differently.
Key takeaway
To avoid rug pulls on Solana, check the same ten things in the same order every time. Trap settings first, then liquidity, then supply, then activity. Skip anything that fails the first three, size down on soft flags, and never buy without an exit plan. When you trade fast, let the filters in your bot run the checks for you.
Set up those filters in TradeWiz and test them with a small budget first.
Trade Fast. Trade Smart.