Rug Pull Risk Checklist
Score a token against the contract powers, liquidity conditions and distribution patterns that make a rug possible, separating what is verifiable on chain from what is only claimed.
Last reviewed by the Radiatus Cloud team
Need this done properly for your business?
Radiatus delivers secure cloud, DevOps & compliance engineering.
Score the powers, not the promises
Almost everything a project says about itself is unverifiable, and almost everything that matters is readable from the contract and the chain. Can supply be minted, can transfers be paused, can the fee be raised, is the liquidity actually locked, is the code upgradeable: each of these is a yes or no anybody can check, and each of them outweighs any amount of communication. A project with an active community, a detailed roadmap and an unlimited mint function is a project with an unlimited mint function.
Upgradeability makes the audit a statement about the past
A report on an upgradeable contract describes the code that existed at the audited commit. The proxy can point somewhere else the moment the team chooses, and nothing about the audit constrains where. This is why a timelock matters more than the audit does for this specific question: it does not stop a malicious upgrade, it only guarantees you see it coming with enough time to leave, which is the whole of what a holder needs.
The honeypot is a selling restriction, not a buying trick
The characteristic construction lets everyone buy and prevents most people selling, through a fee that can be raised to totality, a blocklist, a pause, or a transfer check that only the deployer passes. The chart therefore looks perfect right up until an exit is attempted. Checking whether selling is possible, rather than whether the price is rising, is the test that distinguishes them, and simulating a sale costs nothing.
Related tools
- Ethereum Unit Converter — Convert between Wei, Gwei, and Ether units.
- Gas Fee Calculator — Calculate transaction costs based on gas price and limit.
- IPFS CID Generator — Generate IPFS Content Identifiers (CID) from text or files.
- Wallet Address Validator — Validate Ethereum and Bitcoin wallet addresses.
Frequently Asked Questions
What is the single biggest red flag?
A mint function with no cap, followed by upgradeability without a timelock. Either one outweighs every positive signal, because both mean the contract you reviewed is not necessarily the contract that will execute.
Does a liquidity lock guarantee anything?
Only what it says. Check the lock contract, the amount and the expiry date on chain. A lock expiring shortly is a scheduled exit with a countdown, and a lock claim without a verifiable contract is only a claim.
Is an audit enough?
No. Confirm the auditor names the exact commit and that the commit is what is deployed. Auditing an earlier version and deploying a later one is common and technically truthful.
What is a honeypot?
A token everyone can buy and most cannot sell, through a raisable fee, a blocklist, a pause or a transfer check only the deployer passes. The chart looks perfect until an exit is attempted.
Does a good score mean it is safe?
No. It means the specific mechanisms listed here were not found. A project can be free of every one of them and still fail, and this checks capability rather than intent.
Privacy & Security
Everything runs in your browser; nothing is uploaded.
How to Use
Tick what you have verified to score the token.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.