How to spot a memecoin rug pull before you buy

Run eight checks: confirm the contract address, read the contract, check mint and freeze authority or their EVM equivalents, check whether liquidity can be removed, read holder distribution, look for bundled supply, run a honeypot test, and check the deployer's wallet history. None of them proves a token is safe. Together they remove the mechanical traps.

That last sentence is the point, and most guides skip it. A rug pull is one specific failure mode, and it is the one most successfully automated away. The checks below catch a classic liquidity pull, a hidden mint, a sell tax set to 99% and a bundled launch. They do not catch a founder who simply sells everything they hold at the top — now the more common way people lose money, and one that breaks no rule, triggers no scanner and looks identical on-chain to a normal trade.

Start with the address, not the token

More money is lost to buying the wrong contract than to any clever exploit, and the fix takes ten seconds.

Tickers are not unique. Anyone can deploy a token called CASHCAT, PEPE or anything else on any chain in seconds. Search engines and social feeds do not distinguish the original from the copy, and neither does your wallet.

The failure has a recent, well-documented example. On 23 July 2026, Vlad Tenev's X account was compromised, and the attackers used it to promote a token called Vladhood ($VLAD), described as "the official mascot of Robinhood Chain" and claimed to be slated for a listing in the Robinhood app. Robinhood confirmed the compromise. Everything about the source looked legitimate — a verified account belonging to the actual CEO — and the token had no relationship to Robinhood at all.

The rule is about provenance, not plausibility: take the contract address from the launchpad's own token page or from the pool you are about to trade against, never from a social post, a Telegram message, a screenshot or a search result. Checking that you have the right contract before you trade covers the method, including what to do when two pools with the same ticker both have real volume.

Check 1: is the contract readable at all

What "reading the contract" means depends entirely on the chain, and this is where guides written for one chain mislead readers on another.

On Solana, most memecoins are not custom programs. They are mint accounts owned by the SPL Token program or Token-2022 — standard code every token on the chain shares. There is usually no bespoke source to verify, and "unverified contract" is not the red flag it is on Ethereum. What matters is the configuration of that mint account: its authorities, and any Token-2022 extensions attached to it.

On EVM chains — Ethereum, Base, BNB Chain, Robinhood Chain — the token is a Solidity contract someone wrote, and it can do anything Solidity can do. Open the address on the chain's explorer (Etherscan, Basescan, BscScan, or robinhoodchain.blockscout.com for Robinhood Chain's official Blockscout instance) and look at the Contract tab. Verified source means you can read what the code does. Unverified means nobody can, and unreadable should be treated as unacceptable rather than neutral.

Where source is verified, find five things: a function that increases supply and who can call it; a tax or fee setter with no hard cap in the code; blacklist, pause or transfer-restriction modifiers; whether the token sits behind an upgradeable proxy, in which case today's code is not necessarily tomorrow's; and what "ownership renounced" means here — renouncing to a burn address is a real commitment, renouncing to a second wallet the same person controls is theatre, and the transaction looks similar either way.

Check 2: mint authority, freeze authority, and the EVM equivalents

This is the single most checkable thing about a token, and the single most over-interpreted.

On Solana, open the mint address on Solscan and read the token detail panel, or paste it into RugCheck, which is the standard first pass in the Solana workflow. Two fields matter. Mint authority is the address permitted to create new supply; if it is not revoked, someone can print more tokens whenever they like. Freeze authority is the address permitted to freeze individual token accounts; if it is not revoked, someone can stop specific holders from transferring — which is a honeypot with extra steps. Revoked authorities display as null or absent.

Two things people miss. First, Token-2022 extensions. A token issued under Token-2022 rather than the original SPL Token program can carry a transfer-fee extension whose rate is adjustable by a config authority, a transfer hook that runs arbitrary code on every transfer, a permanent delegate that can move tokens out of any holder's account, or a non-transferable flag. Check which program owns the mint before you assume the standard rules apply. Second, the Metaplex update authority on the token's metadata, which controls the name, symbol and image. That does not let anyone touch your balance, but it does let a token rebrand itself into an impersonation of something else after you buy.

The EVM equivalents are Solidity functions rather than protocol-level fields, so there is no single place to look: an owner-callable mint, a setTax or setFees without a maximum, and a blacklist mapping do the same three jobs. Mint authority and freeze authority on Solana, explained is the long version, including the reason a revoked authority is a floor rather than a pass.

Check 3: can the liquidity actually be removed

A rug pull in the original sense is a liquidity pull: the creator withdraws the paired asset, leaving holders with a token that has nothing to sell into. Venues have mostly engineered this away, so knowing which one deployed a token often answers the question outright.

Pools.trade, launched by Uniswap Labs on 5 August 2026, deploys every token into a standard Uniswap v4 pool with permanently locked, creator-unremovable liquidity, and its 0.25% LP fee autocompounds into that position. hood.fun runs a bonding curve then auto-migrates into a locked Uniswap v3 pool. Pons.family has no bonding curve and no migration at all — fixed supply, pool live from block one. pump.fun migrates the full LP atomically to PumpSwap at its graduation threshold. In each case a conventional liquidity pull is not on the menu.

Where the token was deployed independently, check by hand. Find the pool address, identify the LP token or position NFT it issues, and look at who holds it. A burn address means it can never be withdrawn. A locker contract means it can be withdrawn on the unlock date stated for that specific position. A wallet means it can be withdrawn now. LP burning vs LP locking compares the first two, including where burning is worse.

Then read the limitation into the result. Locked liquidity does not stop the creator selling their own allocation into the pool, does not stop a mint authority, and does not survive its own expiry date. What a liquidity lock actually protects you from — and what it does not is the piece to read before treating a lock badge as a verdict.

Check 4: read the holder distribution properly

Open the holders list — the Holders tab on Solscan or on a Blockscout or Etherscan-family explorer — and look at the shape rather than the headline percentage.

The top-ten number alone is close to meaningless, because the list mixes in addresses that are not holders in any economically relevant sense: the liquidity pool's vault, burn addresses, locker contracts, bridges and exchange omnibus wallets. A token where the pool holds 60% and no individual wallet holds more than 1% reads as "top 10 hold 65%" and is far healthier than one where the same 65% sits in ten fresh personal wallets.

What you want is the largest non-contract holdings, whether those wallets were funded from the same source at the same time, and whether any of them has history predating this token. How to read a token's holder distribution walks through identifying contracts in the list and the patterns worth acting on.

Check 5: look for bundled supply

Bundling is the mechanic where a deployer buys a large share of supply across many wallets in the same block as the launch, so distribution looks organic while one person controls most of the float. It is the most common form of concealed concentration in 2026 and it is invisible on a price chart.

The signature is specific: wallets whose first-ever transaction lands in the same slot or block as pool creation, funded from one address shortly beforehand, buying near-identical amounts. Venues now defend against it directly — Pools.trade's Crowd Launch mode runs a four-hour bidding window priced by time-weighted average, explicitly to defeat bundling, and refunds bidders if the launch fails to reach a $10,000 minimum fully diluted valuation.

Cluster tools are what most people use here, because the pattern is easier to see than to query. How to read a Bubblemaps bubble map covers the tool, and bundled launches and sniper wallets covers the mechanic and its limits.

Check 6: the honeypot test

A honeypot is a token you can buy and cannot sell. The mechanism varies — a sell-side transfer restriction, a whitelist, a freeze authority, or a sell tax set so high that selling returns nothing — but the symptom is the same, and it is usually discovered at the worst possible moment.

Two ways to test. Automated: GoPlus is the multi-chain security layer that flags honeypot behaviour, buy and sell taxes, mint capability and owner privileges, embedded inside many other tools rather than being a destination itself. Meme Central runs GoPlus on EVM tokens and RugCheck on Solana ones and surfaces the result on each token page. honeypot.is and TokenSniffer run similar EVM simulations directly.

Manual: buy the smallest amount the venue allows, then immediately sell part of it. This costs fees and slippage and is worth it on anything you plan to size into. It has one hard limitation — a token sellable when you test it can become unsellable ten minutes later if the owner can still change tax or transfer rules, which is why check 1 comes first. What a honeypot token is and how detection actually works covers the variants scanners miss.

Check 7: social age and engagement quality

Social checks are soft, and the useful ones concern age and texture rather than follower count.

Look at when the account was created and whether the handle has been reused — an aged account that posted about something entirely different until last week has been bought, which is a different signal from a new account simply being new. Read the replies rather than counting them: a real community argues, complains about the price and posts badly; a purchased one posts identical emoji strings from accounts with no history. Check any claimed endorsement at the endorser's own channel rather than in a screenshot.

One dated data point is worth knowing, with its caveat attached. In a study of 832,941 Solana mints observed between 8 May and 10 June 2026, launches advertising a Telegram graduated at 1.485% versus 0.166% for those that did not — an 8.94× difference. That is a real measured association and it is trivially gameable: adding a Telegram link costs nothing, so the correlation reflects effort at launch, not honesty. Use it as a floor for what a serious launch looks like, never as evidence a specific one is legitimate. Red flags in a memecoin's social presence goes further.

Check 8: the deployer's wallet history

The deployer address is on the token's creation transaction, and it is the most underused input in this workflow.

Follow it both ways. Backwards: where was this wallet funded from, and how recently? A wallet created an hour before launch and funded by a fresh exchange withdrawal tells you the deployer took steps to have no history, which is itself the history. Forwards: what else has this address deployed, and what happened to those tokens? A deployer with a trail of launches that each ran for six hours and went to zero is running a business model, not a project.

Solscan and Blockscout both let you page through an address's full transaction history; Birdeye's wallet tracking is the more comfortable read on Solana. Keep watching after you buy rather than only before — what to watch in a dev wallet after the launch covers the movements that matter.

The checklist, by chain

Run in that order this takes a few minutes on a token you already have the address for. If that is longer than the launch window, it is a fact about launch windows, not a reason to skip it.

What these checks do not catch

Everything above tests the contract, the pool and the wallets. Here is what sits outside that boundary.

A creator selling their own allocation. If a deployer legitimately holds 8% of supply and sells all of it into your bid, nothing here fires. The contract is fine, the liquidity is locked, the scan is green, and the price is down 80%. No scanner can distinguish that transaction from any other sell, because there is no difference.

Slow abandonment. Most tokens do not die dramatically. The team stops posting, volume decays, the pool thins and exiting at any size becomes impossible. That is a soft rug, and it fails every check by passing all of them — see soft rugs versus hard rugs for why the distinction matters when you claim a loss.

A reflexive design that works until it doesn't. Heaven's "God Flywheel" routed 100% of protocol revenue into buying and burning its LIGHT token. LIGHT went from roughly $15M to $130M and back to about $33M market cap, with the mechanism disclosed and functioning throughout. The design was the risk. By Q3 2026, Heaven's protocol fees were $0 across 24h, 7d and 30d.

The venue itself failing. Noxa was Robinhood Chain's dominant launchpad, took roughly $12M in fees across about 60,000 launches in under two weeks, halted new launches on 11 July 2026 and went dark on 13 July 2026. The community split between calling it FUD and calling it a soft rug, and no conclusive fraud finding has been published. Every token on that platform passed its token-level checks; the failure was one level up. Rival Vlad.fun went offline days later citing an "internal integrity issue."

Protocol bugs. Four.meme lost $183,000 in February 2025 to a swap-logic flaw and $80,000 in March 2025 to an access-control vulnerability. Neither was visible in any individual token's data.

Alleged coordination at the venue level. pump.fun faces multiple US class actions alleging unregistered securities offerings, plus a suit alleging an internal scheme to rig Solana memecoin launches, supported by a whistleblower who reportedly produced more than 5,000 messages. Meteora has separately been sued over an alleged pump-and-dump launch. These are allegations, not findings — but they describe a category of risk no contract check reaches.

The base rate. This is the number that should recalibrate the whole exercise. As of 10 June 2026, pump.fun had recorded roughly 11.9 million cumulative launches since January 2024, of which 18 tokens have ever exceeded $10M market cap and 96 have ever exceeded $1M. In a study of 832,941 mints between 8 May and 10 June 2026, the pooled graduation rate was 0.198%, and the authors were explicit that this is a lower bound, since each mint was observed for only about six minutes. The defensible range for a true 24-hour rate in 2026 is roughly 0.5–2% depending on the window, and any figure quoted without one is close to meaningless — why so few memecoins graduate unpacks that dispersion. A clean check does not move you meaningfully out of that distribution.

What happens after you buy. The threat shifts from the token to what you sign. One CASHCAT holder lost $56,000 to a malicious contract on Robinhood Chain, and other traders have lost funds on transactions that confirmed successfully. A successful transaction means the code ran, not that it did what you expected. Review approvals on a schedule, and use a separate wallet for launch-day activity.

And the per-venue figures on the Meme Central analytics hub reflect tokens indexed by Meme Central, not the whole market.

Frequently asked questions

What is the single fastest rug pull check?

Confirm you have the right contract address, taken from the launchpad's token page or the pool itself. It takes seconds and prevents the most common loss. The fake Vladhood token promoted through Vlad Tenev's compromised X account on 23 July 2026 is the clearest recent example of what skipping it costs.

Does a locked liquidity pool mean a token is safe?

No. A lock secures the LP position for a fixed term and nothing else. The creator can still sell their own token allocation, a mint authority can still inflate supply, a sell tax can still be raised, and the lock eventually expires. Treat it as one answered question among eight.

Can I tell a rug pull from a normal price collapse?

Often not, and that is the honest answer. A liquidity pull is visible on-chain as a removal transaction. A creator selling their allocation, or a project quietly abandoning, looks identical to ordinary selling. Most tokens that go to zero do so without anything you could point to as fraud.

Are these checks enough for a launch in its first minute?

No. In the first minute there is no holder history, no deployer trail and no social record to read, so most of this workflow returns nothing. Buying that early is a bet on the absence of information, and it should be sized as one.

---

Lock your liquidity before you ask anyone to trust it

Every check above is a buyer trying to infer a creator's intentions from outside. If you are the creator, the fastest way to end that guessing is to make one commitment verifiable: Team Finance — built by TrustSwap, which also builds Meme Central — locks LP tokens for a fixed term on Ethereum, Robinhood Chain, Polygon, Base and BNB, and the lock shows as a verified badge on your token's page in the live launch feed. It applies to a token from any launchpad and can be added after launch. It does not stop you selling your own allocation, and it does not substitute for a single check in this article.

---

Nothing here is financial, legal or tax advice. Memecoins are extremely high-risk: most lose most of their value, and the majority of tokens launched never reach a decentralised exchange at all. Never spend money you cannot afford to lose entirely. Meme Central does not recommend any specific token. Data described as Meme Central's own reflects tokens indexed by Meme Central and is not whole-market data.