Most Solana memecoin rug pulls are visible on-chain before you buy. Four checks expose them: whether the mint authority is revoked, whether the liquidity is locked or burned, whether a few wallets hold most of the supply, and whether the trading volume is real. Free tools run all four checks in about five minutes.
Those checks work because each one reads stored blockchain state, not vibes. A live mint authority is a fact on the token's account, readable by anyone, because transparency is built into the Solana network's design. The scammer needs you to skip the reading: research that scanned every token launched on pump.fun over fourteen months found 98.6% collapsed into pump-and-dump or rug patterns (source: Solidus Labs' Solana rug-pull research).
One honest warning before the checklist: a token that passes every check can still go to zero, so what follows removes scams, not risk.
Why rug pulls thrive on Solana
Rug pulls concentrate on Solana because creating a token there costs almost nothing and takes minutes. Launchpads made deployment a one-click job, fees are fractions of a cent, and buyers race in fast. A scammer can launch fifty tokens for lunch money and only needs one to catch.
The same research scanned more than seven million tokens deployed on pump.fun between January 2024 and March 2025, and only about 97,000 ever held more than $1,000 in liquidity. Most rugs are small and industrial, not dramatic: the median rug pull took about $2,832 from its buyers. That is not a heist movie; it is a production line, and your $200 is one unit of raw material.
The scam comes in a few shapes worth naming once. A hard rug pulls the trading liquidity so the price instantly collapses. A honeypot lets you buy but blocks you from selling. A slow rug drip-sells insider supply into every bounce until nothing is left. The full anatomy and economics of these schemes across every chain live in Blofin's guide to rug pulls and exit scams; this article stays on the Solana-specific job of spotting one before you buy.
The useful twist: the same cheap, transparent chain that makes token spam easy also makes the scammer's setup readable, starting with two switches on the token itself.
Check one: the mint and freeze switches
Every Solana token carries two authorities that decide who controls it. The mint authority can create new units of the token, and the freeze authority can lock tokens inside any holder's account. On a memecoin you are evaluating, both should be revoked. Either one still live is a walk-away signal.
Solana's own documentation defines the mint authority as the account authorized to create new units of a token, and the freeze authority as the account authorized to freeze tokens in a token account so they cannot be transferred (source: Solana's token documentation). In scam terms: a live mint authority means the creator can print trillions of new tokens and sell them into your buy, diluting you toward zero. A live freeze authority is the honeypot lever: you buy, your token account gets frozen, and you can watch the chart but never sell. Revocation sets the authority field to null, permanently and publicly. Serious launches revoke both at creation, major launchpads do it automatically, and an explorer's authority tab confirms it in seconds (source: Helius's token authority guide).
The Token-2022 fine print
Newer tokens use the Token-2022 program, the upgraded standard behind SPL and Token-2022 tokens, and it adds features a naive authority check misses. A permanent delegate has unlimited authority over every account holding that token and can transfer or burn any amount from anyone (source: Solana's Token-2022 extensions documentation). A transfer-fee extension can tax every sale at the protocol level, and a creator who keeps it adjustable can quietly raise the exit fee to 99%. A default-frozen setting can even require the creator's approval before new buyers' accounts work at all. None of these show up as a "mint authority" problem, so use a scanner that reads Token-2022 extensions rather than eyeballing one field.
The switches cover the token contract. The money, though, sits somewhere else entirely.
Check two: where the liquidity lives
A memecoin's price only exists because a liquidity pool pairs the token with SOL, and whoever controls the pool's LP tokens controls the floor. Developer-held LP can be pulled at any moment. That is the classic rug. Locked LP is better, and burned LP means that pool can never be drained.
If pools are new to you, the mechanics live in Blofin's explainer on liquidity pools on Raydium; rug-checking only needs the ownership question. LP tokens are the receipt for the pool's contents, and whoever holds the receipt can redeem it and walk off with the SOL side, leaving your tokens priceless.
| LP status | What it means | Risk read |
|---|---|---|
| Held by the dev wallet | Pool can be drained in one transaction | Walk away |
| Time-locked | Safe until the lock expires; check the date and the locker | Caution, verify duration |
| Burned (sent to a dead address) | That pool's liquidity can never be pulled | Best available state |
When a pump.fun token graduates, meaning its bonding curve fills at roughly $69,000 in market cap, the platform moves the liquidity to its own exchange, PumpSwap, and burns the migrated LP automatically (source: blocmates' PumpSwap coverage). That burn protects only the migrated pool, not tokens the creator kept and not any second pool added later. Graduation removes one rug lever, not the scammer's hands. The Solidus Labs scan cited earlier found roughly 93% of 388,000 Raydium pools it examined showed soft-rug traits, liquidity abruptly withdrawn by insiders, which is why the receipt question comes before the chart.
A burned pool still cannot stop insiders dumping a hoarded supply into it, so the next read is the holder list.
Check three: who holds the supply
Open the token's holder list and look at the top ten wallets. As a screening heuristic, if the top ten non-pool wallets hold more than 30% to 40% of the supply, any one of them can crash the price at will.
The read takes a minute on a block explorer: open the token, switch to the holders tab, and scan the top of the table (source: Solscan). Exclude the pool itself and obvious program accounts, which legitimately hold large balances, then add up what the remaining top wallets control. A fair launch spreads supply across thousands of small holders. A trap concentrates it in a handful of wallets funded, often from the same source, minutes before launch.
Scammers know buyers check concentration, so they split the insider stash across twenty or fifty fresh wallets, called a bundle, that all bought in the first seconds. The percentages look decentralized while one operator holds the whole cluster. Scanners flag this by tracing where the buying wallets got their SOL, and a creator whose previous tokens all died within days is part of the same fingerprint. Concentration numbers are a heuristic, not a verdict, so the volume check comes next.
Holders tell you who could dump. Volume tells you whether anyone real is actually buying.
Check four: whether the volume is real
Manufactured volume is cheap on Solana, so a busy chart proves nothing by itself. Fees this low let one operator wash-trade a token between their own wallets thousands of times for a few dollars. The tell is mismatch: big reported volume on a few hundred holders and thin liquidity.
Solana's base fee is about 0.000005 SOL per transaction, a few hundredths of a cent, so a thousand self-trades cost well under a dollar even with tips. During launch frenzies bots also pay for speed, which is when priority fees spike, but the wash loop stays pocket-change cheap. The result is a token showing, say, $5 million in 24-hour volume with 400 holders and $60,000 of liquidity. Real demand grows holder count, volume, and liquidity together, with trades spread across many unrelated wallets rather than a metronome of identical buys and sells.
In practice the four reads collapse into one short routine.
The five-minute pre-buy checklist
Run a scanner first, confirm the two worst flags on an explorer second, and only then look at the chart. Any single red line below is a walk-away, no matter how good the meme is. There will always be another token; there will not always be another bankroll.
| Check | Where to look | Red line (walk away) |
|---|---|---|
| Mint authority | Scanner or explorer authority tab | Not revoked |
| Freeze authority | Same view | Not revoked |
| Token-2022 extensions | Scanner extension flags | Permanent delegate, adjustable transfer fee, default-frozen |
| Liquidity | Scanner LP section | LP loose in dev hands, or lock expiring soon |
| Top holders | Explorer holders tab | Top 10 non-pool wallets over ~30-40%, or bundle pattern |
| Volume reality | Chart + holders together | Volume massively out of scale with holders and liquidity |
The routine, in order:
- Paste the token address into a free scanner and read the authority, LP, and holder sections, not just the headline score (source: RugCheck).
- Confirm on the explorer, with your own eyes, that mint and freeze authority are revoked.
- Check where the LP tokens sit: burned, locked until when, or loose in a wallet.
- Read the top-ten holders, excluding the pool, and look for same-time, same-source buying.
- Compare volume against holders and liquidity, then decide with the numbers, not the group chat.
Walk $200 through it. The scanner shows mint revoked, freeze revoked, no Token-2022 tricks: thirty seconds. The explorer confirms both nulls: one minute. LP shows 100% burned at graduation: thirty seconds. Holders show the top ten at 22% excluding the pool, no bundle flags: two minutes. Volume, holders, and liquidity sit in believable proportion: one minute. Five minutes, and that $200 dodged the traps that took a median $2,832 from buyers who skipped the reading. If the token you were about to buy by swapping through Jupiter shows a live freeze authority at step two, you stop at step two.
What the checklist cannot do is turn a surviving token into a good buy, and pretending otherwise is how the last scam works.
What a clean checklist still can't save you from
A token that passes every check is only a token that probably will not be stolen from you directly. It can still lose everything the ordinary way. Fewer than 2% of launchpad tokens ever graduate to real exchange trading, and most that do still fade toward zero.
That under-2% graduation figure comes from a peer-reviewed study of the launchpad wave (source: Mancino's IEEE study of Solana memecoins). The base case for any memecoin is death by boredom: the crowd moves on, volume dries up, and the price bleeds out with no scam required. The checklist also has honest blind spots. A slow rug passes the liquidity check and drip-sells clean-looking wallets for weeks, and a dev who simply abandons the project fails no on-chain test. None of this covers malicious sites and signature prompts either, a different attack covered in Blofin's guide to wallet drainer scams: a rug steals value through the token, a drainer steals it through what you sign.
| Outcome | What happens | Does the checklist catch it? |
|---|---|---|
| Hard rug | LP pulled, price collapses in minutes | Yes, at the liquidity check |
| Honeypot | You can buy but never sell | Yes, at the freeze and extension checks |
| Slow rug | Insiders drip-sell into every bounce | Partially, via holders and creator history |
| Natural death | Attention leaves, price bleeds to zero | No. This is the most common outcome |
From Blofin's operational perspective, these four checks are a compressed version of the first layer an exchange listing review applies before any token gets near a trading venue, and most candidates never survive that first layer. The difference is posture: a listing desk walks away by default and needs reasons to proceed, while a memecoin buyer mid-frenzy needs reasons to stop. Borrow the desk's posture. Treat any memecoin position as entertainment money you can lose entirely, and keep it in a separate burner wallet, created by repeating the steps for setting up Phantom with a fresh account. Your core position belongs in the majors you accumulate by buying SOL on an exchange, not in lottery tickets, and when you want on-chain earning with better odds, Solana DeFi safely is the next read.
The checklist will not make you rich. It will keep you out of the machine built to take your money in the first five minutes.
Frequently asked questions
Does revoking mint authority make a memecoin safe?
No. Revoked mint authority removes exactly one attack, unlimited supply printing. The token can still be a honeypot through freeze authority or Token-2022 transfer fees, still carry dev-held liquidity, and still hide a bundled insider supply. The four checks only mean anything together; a single green flag is a car with good brakes and no steering wheel.
What does "LP burned" actually mean on Solana?
The liquidity provider tokens, the receipts proving ownership of the pool's contents, were sent to an address nobody controls. Nobody can redeem them, so nobody can drain that pool. It protects only that specific pool: a creator can still hold unburned LP in a second pool or dump a hoarded token supply into the burned one.
Can I recover money after a rug pull?
Realistically, no. Solana transactions are final, the stolen SOL is usually split across fresh wallets within minutes, and most individual rugs are too small for law enforcement to chase. Report the token on the scanner you use, warn the community, and treat the loss as tuition. Prevention is the only reliable remedy.
Is pump.fun itself a scam?
No. Pump.fun is infrastructure: a launchpad that standardizes token creation, revokes authorities at launch, and burns migrated liquidity at graduation. That removes several rug levers while doing nothing about the humans behind each token, and the overwhelming majority of tokens launched there still failed or were manipulated. It is a well-lit casino floor: the building is not cheating you, but the games are still games.
How much money is safe to put into a Solana memecoin?
Only money you can lose completely without changing your plans, because total loss is the statistically normal outcome even without a scam. Decide the number before you look at any chart, and keep memecoin funds in a separate burner wallet away from your core position. If losing the amount would sting for more than a day, it is too much.
Researched and written by the Blofin Academy editorial team with AI-assisted drafting. Primary sources include Solana's token documentation, Solana's Token-2022 extensions documentation, Solidus Labs' Solana rug-pull research, Mancino's IEEE study of Solana memecoins, Helius's token authority guide, blocmates' PumpSwap coverage, RugCheck, and Solscan. All facts independently verified against cited documentation current as of July 2026.
This article is for informational purposes only and does not constitute financial advice, investment guidance, or a recommendation to buy, sell, or hold any digital asset. Cryptocurrency markets involve significant risk and you should conduct your own research and consult qualified professionals before making investment decisions. Blofin Academy content reflects the state of public information at time of publication; protocol parameters, fees, and ecosystem data change frequently.