Every week, hundreds of tokens launch on Solana and disappear within hours. Some are obviously malicious. Others look legitimate long enough to collect liquidity from buyers — then the developer withdraws everything and leaves. This is called a rug pull, and it's the single biggest reason most new snipers lose money in their first month.

The good news is that rug pulls are rarely random. They follow patterns, and those patterns leave on-chain traces that you can check before buying. This checklist covers the 12 signals that matter most — the same ones that power the Solana Sniper Bot's automated safety scoring system.

What Is a Rug Pull — and Why Solana Is Different

A rug pull is when the developers of a token drain liquidity or dump their holdings in a way that makes the token worthless, leaving other holders unable to sell. The term covers several distinct attacks:

  • Liquidity removal. Developer adds liquidity, attracts buyers, then calls the pool contract to withdraw all SOL. Price drops to zero instantly.
  • Dev wallet dump. Developer holds a large percentage of supply and sells it all in one or several transactions once the price has risen.
  • Honeypot. A token contract where buy transactions work but sell transactions are blocked or taxed at 99%. Holders can never exit.
  • Slow rug. Gradual selling over days or weeks to avoid triggering alarm bells, while maintaining a façade of activity.

Solana's high throughput and low fees make it uniquely attractive to rug pull operators. A new token can be created, marketed, and rugged — all within a single afternoon — with total gas costs under $5. The speed that makes sniping Solana tokens attractive is the same speed that enables abuse.

No checklist eliminates risk entirely. Even tokens that pass every safety check can fail legitimately — a bad product, a loss of community interest, or simple market conditions. Safety filters reduce exposure to malicious intent, not to market risk.

Signals 1–4: Liquidity Red Flags

1. Unlocked Liquidity

Legitimate projects almost always lock their liquidity for a defined period — typically 6 to 24 months — using services like Raydium's built-in lock, Unicrypt, or similar protocols. An unlocked pool means the developer can withdraw all SOL at any moment. It is not proof of malicious intent, but it is the most common precondition for a rug pull. Always check this first.

2. Thin Initial Liquidity

A pool that launches with less than 2–3 SOL is trivially easy to manipulate. A single mid-size buy can move the price dramatically, creating artificial FOMO — then the developer sells into it. Minimum liquidity filters in your sniper bot exist for exactly this reason. Set yours to at least 3 SOL for Pump.fun tokens and 5–10 SOL for Raydium direct launches.

3. Single Liquidity Provider

When one wallet controls 100% of pool liquidity, that wallet can withdraw everything in a single transaction. Two or more independent liquidity providers makes this harder to coordinate. Check the pool LP token distribution — legitimate community launches often have multiple LP holders within the first few hours.

4. Abnormal Pool Age

Tokens where the pool was created minutes before a coordinated marketing push are almost always pre-planned. Conversely, a pool that has been live for less than 60 seconds but already has a high market cap means large buys happened before any public announcement — often the developer buying their own token to inflate the starting price.

Signals 5–8: Dev Wallet Patterns

5. High Dev Wallet Concentration

The single most reliable on-chain rug signal. When the developer's wallet holds more than 15–20% of the total token supply, one sell transaction can collapse the price. Set your bot's maximum dev wallet percentage filter to 10–15%. For very small market-cap tokens, anything above 5% is worth treating as a yellow flag.

6. Wallet Cluster Ownership

Sophisticated operators split supply across many wallets that appear independent but were all funded from the same source wallet. Check the top 10 holders: if multiple addresses received tokens in the same transaction block, or were all funded by the same parent wallet, you're likely looking at controlled distribution. The bot checks first-degree wallet connections automatically.

7. Fresh Wallet Creation

A deployer wallet with zero transaction history prior to this token creation is a significant warning. Legitimate project teams have wallets with months or years of on-chain history — interacting with DeFi protocols, holding other assets, paying for services. A brand-new wallet that only created this token and nothing else is a strong indicator of a throwaway deployment.

8. Dev Sells Before Public Launch

Check whether the deployer wallet made any token sells between pool creation and your entry point. Even one small sell in the first 60 seconds — before the public has had time to react — is unusual and worth factoring into your risk assessment. The mechanics of how a sniper bot monitors transactions in real time make this kind of check possible at scale.

Signals 9–12: Metadata and Social Red Flags

9. Missing or Generic Metadata

Every SPL token has an optional metadata account that stores the token name, symbol, and URI pointing to an image and description. Tokens without metadata — or with metadata pointing to a generic placeholder image — are almost always disposable. Real projects invest in at least minimal branding before launch.

10. Freeze Authority Not Revoked

Solana's token program includes a freeze authority — an address that can freeze any holder's token account, preventing transfers. If the developer retains freeze authority, they can lock your tokens at any time. Check that freeze authority has been set to null (revoked) before buying. This is a non-negotiable filter for many experienced snipers.

11. Mint Authority Still Active

Mint authority allows the holder to create new tokens at will. An active mint authority means the developer can dilute the supply indefinitely, making your holdings worth less without technically stealing them. Legitimate tokens revoke mint authority immediately after the initial supply is created. If mint authority is still active at the time of launch, treat it as a critical warning.

12. Recycled or Plagiarised Social Content

Many rug pull operations copy the branding, website template, or whitepaper of successful tokens and change only the name. Check the project's Telegram or Twitter for account age, follower authenticity, and whether the content is original. A one-hour-old Telegram group with 2,000 members added in the last 30 minutes is a bot farm, not a real community.

No single signal is conclusive. Even legitimate projects sometimes have imperfect metadata or a single LP provider in the first minutes. The weight of evidence across all 12 points is what matters — not any one flag in isolation.

How the Bot's Safety Score Works

The sniper bot runs all 12 checks automatically for every detected token — before the buy decision is made. Each check carries a weight based on its historical correlation with rug outcomes. The combined result is a safety score from 0 to 100:

  • 0–40: High-risk. Multiple critical flags. Bot will not buy unless you override the minimum threshold.
  • 41–65: Elevated risk. Some warning signs present. Recommended only for very small position sizes.
  • 66–80: Moderate risk. Passes most checks with minor concerns. Standard sniping range for most users.
  • 81–100: Lower risk. Passes all or nearly all checks. Still carries inherent market risk.

You can set a minimum safety score threshold in the bot configuration. If you're running the Pump.fun aggressive strategy, you might accept 55+ with a very small buy amount. For larger position sizes, 70+ is a reasonable floor. The threshold you choose should scale inversely with your position size.

Position Sizing as a Risk Management Layer

Even with every filter in place, some tokens that appear legitimate will fail. The second defence after safety scoring is position sizing. A few principles worth building into your approach:

  • Never risk more than 1–3% of your sniping capital on a single trade. If your sniping budget is 5 SOL, your per-snipe buy should be 0.05–0.15 SOL. This ensures no single rug destroys your account.
  • Scale down for lower safety scores. A token scoring 60 should get half the buy amount of a token scoring 80. Let the scoring system influence position size, not just the yes/no decision.
  • Scale up only when multiple signals confirm. Larger position sizes require locked liquidity, revoked authorities, multi-wallet distribution, and a high safety score simultaneously. If even one critical signal is missing, default to small.

When to Override the Bot's Safety Score

The safety score is a tool, not a law. Experienced traders override it in specific circumstances:

  • Known developer wallet. If you recognize the deployer address from a previous legitimate launch, you have out-of-band information the algorithm doesn't.
  • Verified project context. A major influencer launching a token publicly with a known team reduces the rug probability meaningfully, even if the on-chain signals are neutral.
  • Community confidence. A project with months of community development pre-launch, active GitHub commits, and audited code warrants more weight than a score calculated from launch-day snapshots.

That said: override conservatively. The score is right more often than intuition is, especially in the chaos of a live launch. Most overrides should still keep position sizes smaller than usual — treat the additional information as permission to buy, not as permission to size up.

The best rug pull protection is a combination of filters, a minimum safety score, small position sizes, and a hard stop-loss. No single layer works in isolation — the system works as a whole.