Ethereum Rug Pull Checker

Quick Answer

Ethereum ERC-20 rug pulls use six primary mechanisms: honeypot (sell blocked in contract), unlocked Uniswap LP tokens, active mint authority, hidden fee escalation functions, blacklist capabilities, and unrenounced ownership with dangerous admin functions.
AnubisDAO ($60M, October 2021) — deployer drained $60M in ETH liquidity 20 hours after launch. Squid Game Token ($3.38M, November 2021) — honeypot blocked all sells while deployer drained the Uniswap pool.
Always verify: LP tokens locked in Unicrypt or Team Finance, ownership renounced, no fee manipulation functions, verified source code on Etherscan. Free scan below — results in 60 seconds.

Free · Instant · No sign-up

Check Any Token Address

Honeypot detection · LP lock · Mint authority · Sell tax

Ethereum Rug Pull Signals

Signal	Risk	Description	Real Example
ERC-20 Honeypot	Critical	The token's _transfer() function includes conditional logic that allows buys but reverts or applies 100% tax on sells. Common pattern: require(from == owner \|\| to == owner) in the sell path.	Squid Game Token (Nov 2021, $3.38M) — users could buy but contract reverted all sell transactions. Deployer drained the Uniswap pool when price peaked.
Uniswap LP Tokens Unlocked	Critical	LP tokens representing the Uniswap liquidity pool are held by the deployer address or project multisig, not locked in Unicrypt or Team Finance. The deployer can call removeLiquidity() at any time, crashing the price to near zero instantly.	AnubisDAO (Oct 2021, $60M) — deployer held all LP tokens from a $60M raise. Called removeLiquidity() 20 hours after launch, draining the entire pool.
Active Mint Authority	High	The token contract has a mint() function accessible to the contract owner. Post-deployment minting allows the team to create new tokens and dump them, diluting all holders. Check if owner is address(0) — if not, mint authority exists.	Deployer mints 10 billion tokens after launch, sells them through the Uniswap pool, crashes the price 99%. Existing holders' positions are worthless.
Hidden Fee Manipulation	High	The contract has setTax(), setFee(), or updateFees() functions accessible to the owner with no cap parameter. Initial fee is 3% (looks normal) but owner can raise it to 99% at any time, making the token unprofitable to sell.	A deployer sets a 5% launch tax, grows the community to $5M in TVL, then calls setFee(99) — all subsequent sells drain 99% to the dev wallet. Soft rug via fee escalation.
Blacklist / Freeze Functions	High	The contract has blacklist() or setBlacklist() functions that allow the owner to block specific addresses from transferring tokens. This enables a targeted rug: let buyers accumulate, blacklist them all, then drain liquidity.	Owner calls blacklist(address[]) on all non-dev wallet holders, then removes liquidity — only the dev wallet can sell, everyone else's tokens are frozen.
Ownership Not Renounced	Medium	The owner() address is still set to the deployer EOA or a team-controlled address. Ownership renounced means owner() returns address(0) or a burn address. Active ownership means all onlyOwner functions remain accessible indefinitely.	Legitimate projects renounce ownership after launch or transfer to a DAO/timelock. A non-renounced token with fee manipulation functions is one owner() call away from a rug.

Ethereum Rug Pull Checker — FAQs

How do I check if an Ethereum token is a honeypot?

Three methods: (1) Attempt a simulated sell: use Tenderly or a mainnet fork to simulate the exact sell transaction — if the transaction reverts, it is a honeypot; (2) Read the contract source on Etherscan — look for conditional logic in _transfer() that behaves differently for the deployer address vs regular holders; (3) Use token analysis tools that run a sell simulation automatically. Key code pattern to look for: `require(from == _owner || to == _owner || whitelist[from])` — if this wraps a sell path, it is a honeypot.

How do I verify Uniswap liquidity is locked?

Steps: (1) Find the Uniswap V2 or V3 pair address for the token (use Etherscan or Dexscreener); (2) Check who holds the LP tokens on Etherscan — go to the pair contract → Token Holders tab; (3) If the deployer or team wallet holds LP tokens, liquidity is not locked — hard rug is possible at any time; (4) If LP tokens are at a locker contract (Unicrypt: 0x7f5a4369273C323338eC4102984dA13BCe3cfdc4, Team Finance: 0xe2fe530C047f2d85298b07D9333C05737f1435fB), verify the lock end date on their respective dashboards; (5) Minimum acceptable: 6-month lock. Burned LP (sent to 0x000...dead) is the strongest guarantee.

What is EIP-2612 permit() and can it be exploited?

EIP-2612 adds an off-chain permit() function to ERC-20 tokens that allows token approvals via signature rather than on-chain transaction. Legitimate use: saves gas on approvals. Exploit potential: a token with a malicious permit() implementation can allow the deployer to sign a permit that approves themselves to spend all user tokens — effectively stealing from holders without any on-chain approval transaction from the victim. Verify permit() implementations match the standard EIP-2612 reference implementation exactly.

What are the most common Ethereum ERC-20 rug pull patterns in 2024-2026?

The most common patterns have evolved: (1) Fee escalation rug: launch with normal 3% tax, grow TVL, then raise fee to 95% via setFee(); (2) Blacklist + drain: accumulate holders, then blacklist all non-dev addresses, remove liquidity; (3) Migration rug: deploy 'V2' contract, ask holders to migrate, abandon the V2 migration contract and drain V1 liquidity; (4) Slow drain via dev allocation: team holds 20-30% of supply with no vesting, sells gradually over weeks; (5) Oracle manipulation on ETH L2s (Base, Optimism): deploy token + AMM pool, manipulate the pool price, use it as oracle for a collateral contract, borrow against inflated value, drain the lending pool.

Is the Ethereum rug pull checker free?

Yes. SmartContractAuditor.ai provides free smart contract analysis — paste any Ethereum contract address and get an instant security report covering honeypot risk, mint authority status, access control vulnerabilities, and common rug pull patterns. The free scan analyzes contract source code and bytecode. Professional-grade reports with detailed remediation guidance are available on paid plans.

Written by Duron Epps, Founder of SmartContractAuditor.ai · Last updated July 2026

Rug Pull Checker Hub·BSC Rug Pull Checker·Ethereum Audit·DeFi Hacks Database