Every day, thousands of new tokens launch across EVM chains, Solana, Tron, and others. The majority are not legitimate projects — they are honeypots, rugs, pump-and-dumps, or brand-impersonation tokens created to capture flow from uninformed buyers. Separating the serious projects from the dangerous ones is not a matter of intuition; it is a checklist of on-chain and off-chain signals that any buyer can run through in ten minutes.
This article walks through that checklist in roughly the order you should apply it, with the specific tools that make each check fast.
Check 1: Contract Verification
Look up the token's contract address on the relevant explorer (Etherscan, BscScan, Polygonscan, Solscan, Tronscan). The first thing to confirm is that the contract source code is verified — meaning the deployer has published the human-readable Solidity or Rust source that matches the deployed bytecode.
If the contract is unverified: Treat it as high-risk. You cannot audit what you cannot read. Legitimate projects verify their contracts as a matter of course.
If the contract is verified: Move to the next check. Verification is necessary but not sufficient.
Check 2: Automated Honeypot and Risk Scan
Run the token through at least two of the following automated checkers:
- Honeypot.is — simulates a buy+sell cycle and flags tokens that cannot be sold.
- Token Sniffer — risk-scoring tool with a detailed breakdown of common scam indicators.
- GoPlus Security — API-backed scanner used by multiple wallets and DEX aggregators.
- DEXTools "Audit" tab — shows key contract properties and flags for the specific token.
- De.Fi Scanner — comprehensive risk analysis across chains.
If any of these tools flag the token as a honeypot, do not buy. If they return conflicting results, lean toward the more cautious assessment.
Check 3: Holder Distribution
On the contract page, check the "Holders" tab. Look at the top 10 holders.
- Healthy pattern: Top holder is typically the liquidity pool contract (Uniswap V2/V3, PancakeSwap, etc.). The next few holders are exchanges, the project's locked team/treasury wallets, and a distribution of smaller holders.
- Unhealthy pattern: One or two wallets hold more than 30–40% of supply, and those wallets are not clearly labeled as LP or exchange wallets. A single EOA holding 20%+ of supply is a massive rug risk — they can dump at any moment.
Sybil Warning
Sophisticated scams split large supply across dozens of small-looking wallets to avoid triggering holder-concentration alerts. Check for many wallets funded in sequence from the same source address — a pattern visible by looking at each holder's first incoming transaction.
Check 4: Liquidity and Lock Status
Look up the token on DEXScreener, DEXTools, or similar. Check:
- Liquidity amount. Thin liquidity (under $10,000) means large trades will move the price dramatically and the pool can be drained fast.
- Lock status. Is LP locked? For how long? In what service (Unicrypt, TeamFinance, PinkLock)? Locks of less than 6 months are a warning; unlocked liquidity is a red flag.
- Lock verifiability. Click through to the lock contract itself. Some projects fake lock URLs. Verify that the actual LP tokens sit in a time-locked escrow.
Check 5: Ownership and Admin Privileges
In the verified source, look for functions restricted to the owner or similar. Specifically hunt for:
- A mint function that the owner can call to create new tokens.
- A pause or freeze function that can stop all transfers.
- A blacklist or allowlist function.
- A dynamic tax setter that can raise buy or sell tax after launch.
- A function that lets the owner withdraw arbitrary tokens from the contract.
The presence of these functions is not always disqualifying, but they must be governed — by a multi-sig, a timelock, or a renounced owner. Ownership held by a fresh EOA is a high-risk configuration.
Check 6: Deployer History
Click the deployer address. Look at their history:
- How many tokens have they deployed previously?
- Do any of their prior tokens show rug or honeypot patterns?
- Is the deployer funded from a known exchange deposit address (indicating KYC exists somewhere) or from a mixer?
Serial rug deployers reuse wallets. Checking the history often reveals that "this project's developer" has shipped twelve rugs in the last year from the same funding wallet.
Check 7: Off-Chain Signals
After the on-chain checks, look at the project itself:
- Website quality and age. Domain WHOIS records show when the site was registered. Sites younger than the token launch by only a few days are suspicious.
- Team. Are real names and backgrounds listed? Do those people have prior verifiable presence in crypto? Anonymous teams are not automatically scams, but they have no reputational cost if they rug.
- Audit reports. If the project claims an audit, read the actual audit document and verify it on the auditor's site. Scam projects frequently claim fictional audits or post fake audit PDFs.
- Community activity. Is the Telegram or Discord real-looking, or is it mostly bot activity? A community of 50,000 members where every message is "To the moon!" is usually bot-filled.
- Social engagement vs. follower count. A Twitter account with 100,000 followers but 20 likes per post likely bought the followers.
Check 8: Price Action Patterns
Look at the chart on DEXScreener. Pump-and-dump tokens usually show:
- A vertical early pump (usually the deployer's paid promotion kicking in).
- A plateau where retail buys in.
- A cliff drop when the deployer or insiders exit.
If the chart looks like a classic rug pattern with insiders already gone, buying the "dip" rarely works — the contract is often a honeypot preventing sales from the remaining bag holders.
A Ten-Minute Checklist
Condensed, in order:
- Explorer: contract verified? ✅ or ❌
- Honeypot.is + Token Sniffer: any flags? ✅ or ❌
- Top holders: concentration acceptable? ✅ or ❌
- LP locked for 6+ months with verifiable escrow? ✅ or ❌
- Owner renounced or multi-sig with timelock? ✅ or ❌
- Deployer history clean? ✅ or ❌
- Real team, real website, real audit? ✅ or ❌
- Chart pattern not rug-shaped? ✅ or ❌
Eight for eight does not guarantee the token is legitimate — but even one ❌ at positions 1, 2, 4, or 5 should be disqualifying unless you are explicitly speculating with money you are prepared to lose entirely.
Brand Impersonation Tokens
A specific common scam is deploying a token with the same name and ticker as a real project — but a different contract address. When a user searches a DEX for "USDC" or "LINK," search results may return the impersonator at the top.
Defense: Always verify the contract address against the official source (the project's official website, CoinGecko, or CoinMarketCap). Copy the address from the verified source, not from DEX search. Major wallets and DEX aggregators warn about unknown tokens, but users routinely click through these warnings.
When a Real Project Turns Malicious
Even projects that pass every check at launch can turn malicious later through a proxy upgrade or a governance takeover. See how approval phishing works — malicious upgrades often weaponize existing token approvals. The defensive posture for medium- and long-term holdings:
- Monitor governance proposals that affect the token's contract.
- Subscribe to alerts for admin function calls on the relevant contract.
- Limit exposure to any single token to a percentage of your portfolio you can absorb as a total loss.
- Reconsider deposits into freshly upgraded or actively changing contracts.
The market pays you to bear risk. It does not pay you to ignore it. Review the crypto safety best practices guide to build habits that catch these patterns early.