Most Solana rug pulls do not involve clever exploits. They use permissions the creator simply never gave up: the ability to mint more supply, to freeze your account, or to withdraw the liquidity pool. All three are visible on-chain, for free, before you buy.
Run these in order. The first three take a minute each and rule out the most common outright thefts. The last three are judgement calls about how a launch is likely to behave. If you are launching your own token rather than buying one, the same list read backwards is what your holders will check, which is why our security checklist covers the other side of it.
Six checks, in order of importance
Paste the token's mint address into Solscan and work down the list.
Mint authority
On the mint's Solscan page this appears near the top of the token overview. You want null or "revoked". If an address is shown, whoever controls it can create unlimited new tokens and sell them into the pool, which dilutes every existing holder to nothing. There is no warning and no way to stop it.
Legitimate exception: a project that has publicly committed to a scheduled emission and holds the authority in a multisig. Rare, and it should be documented.
Freeze authority
Same panel, and again you want null. An active freeze authority lets the holder freeze individual token accounts. In practice that means you can buy, watch the price rise, and then find your account frozen so you cannot sell. This is the mechanism behind "honeypot" tokens on Solana.
See revoking authorities for what each authority does in detail.
Metadata mutability
Check the update authority on the Metaplex metadata account. If metadata is mutable, the name, symbol and logo can all be changed after launch. A token you bought as one thing can be renamed to impersonate something else, or quietly rebranded after a failed launch to recycle the holder list.
Less severe than the first two, since it cannot directly take your funds. Still a strong signal about intent.
Liquidity: locked, burned, or neither
This is where most money is actually lost. Find the pool, then find its LP token, then find who holds it. Burned to an incinerator address means the liquidity can never be withdrawn. Held in a locker with a future unlock date means it is safe until that date, so check the date. Sitting in the deployer's wallet means the pool can be emptied in a single transaction.
Our guide to locking liquidity explains what each arrangement looks like on-chain.
Holder concentration
Open the holders tab and look at the top twenty. Exclude the pool address itself, which will legitimately be large. If a few wallets hold most of the remaining supply, they can exit into your liquidity whenever they choose. Watch for many wallets holding suspiciously round, identical amounts: that usually means one person spread a position across addresses to look decentralised.
Pool age and trade history
A pool minutes old with a handful of trades tells you nothing about how it behaves under selling pressure. Look at whether volume is real or a small set of addresses trading with each other. Sustained volume across many distinct wallets over days is a much better signal than a large number on day one.
Walk away immediately if
- Freeze authority is active on an ordinary community token.
- Mint authority is active and nobody can point you at a published emission schedule.
- LP tokens are sitting in the deployer wallet.
- One non-pool wallet holds a very large share of supply.
- Anyone asks for your seed phrase or private key for any reason at all.
A clean result on all six checks is the minimum bar, not a recommendation. It proves the creator cannot steal from you through these specific mechanisms. It says nothing about whether the token is worth owning. Nothing on this page is financial advice, and you are responsible for your own decisions.