How to Check if a Solana Token Is a Rug Pull in 2026: The Signals Buyers Actually Read

A March 2026 study of Solana DEX launches, published on arXiv as SolRugDetector, screened 100,063 tokens issued in the first half of 2025.

It flagged 76,469 of them as rug pull candidates and traced at least $151 million in direct losses.

Streamflow, the Solana-native token operations platform behind $709M+ in total value locked across 40,000+ projects, sees the other side of that data: the tokens that survive are the ones whose commitments can be verified on-chain.

The survival odds are getting worse, not better. A CoinGecko analysis published in June 2026 found that 68.67% of the 18.67 million tokens launched on Pump.fun since January 2024 never traded again after their first day. Buyers have learned to read a small set of on-chain signals fast, because the window to get it right is often under an hour.

This guide breaks down the signals that actually separate a rug from a real project, where to check each one, and why provably locked insider supply has become the signal that matters most.

Key Takeaways

• A Solana token rug pull often completes within an hour, so check signals before buying.

• Revoked mint and freeze authorities stop two attacks but cannot prevent insider pump-and-dumps.

• Streamflow token locks give buyers on-chain proof that insider supply cannot move before unlock.

• Verify every lock or vesting contract on Solscan, Solana Explorer, or RugCheck yourself.

• Over 40,000 projects use Streamflow to make Solana token commitments transparent and enforceable.

The Problem: Most Rug Pull Checklists Stop Too Early

The standard Solana rug pull checklist is short. Mint authority revoked, freeze authority revoked, LP burned. If all three are green, the token gets called “safe.”

That checklist catches the wrong attacks. In the SolRugDetector data, 60,402 of the 76,469 flagged tokens were pump-and-dumps, nearly 8 in 10 cases. Only 15,606 involved liquidity withdrawal and just 461 involved freeze authority abuse.

• Pump-and-dumps use supply the insiders legitimately hold, so revoked authorities do nothing.

• Liquidity withdrawals are blocked only if LP tokens are burned or locked, not just “mostly” handled.

• Freeze abuse is rare but total, because a frozen wallet cannot sell at all.

A token can pass every authority check and still be designed to dump on buyers within minutes. The real question is not whether the contract can be abused, but whether the people holding the most supply can sell it right now.

What’s Really Going On: Rugs Are Fast, Coordinated, and Cheap

Speed is the defining feature of a modern Solana rug. The SolRugDetector researchers measured a median of roughly 35 minutes from token creation to the first profit-taking transaction across flagged tokens, and around 32 minutes for pump-and-dumps specifically. Legitimate tokens in the same study had a median lifespan of 375 days.

Coordination is the second feature. The study identified 78 large rug pull groups, with a median of 36 member wallets each and some groups launching over 200 tokens. These clusters fund fresh wallets, buy early to create fake distribution, and exit together.

Cheap launches make this repeatable. The same near-zero fees and sub-second finality that make Solana ideal for real token economies also make throwaway tokens nearly free to deploy. That is why buyers cannot rely on reputation or hype; they need signals that are enforced by code and visible on-chain.

The Framework: Five Signals Buyers Actually Read

The fastest way to evaluate a token is to work through five signals in order. Each one closes off a specific attack, and together they show whether the people with power over the token have given it up.

1. Check Mint and Freeze Authority First

Mint authority lets the holder print new supply, which dilutes every buyer instantly. Freeze authority lets the holder freeze any token account, which means buyers can be blocked from selling while insiders exit.

The SolRugDetector team defined freeze abuse precisely this way: the creator kept the freeze authority and actually used it against user accounts.

• Confirm mint authority shows as revoked or null in the token details.

• Confirm freeze authority is revoked, not just “unused so far.”

• For Token-2022 tokens, check extensions like a permanent delegate, which can move or burn tokens from any holder’s account.

• Treat a transfer hook or a high configurable transfer fee as a reason to dig deeper.

A token with an active freeze authority and a strong chart is not a bargain. It is a token that can stop you from selling at the exact moment you need to.

2. Read the Liquidity, Not Just the Market Cap

Market cap on a thin pool is fiction. What matters is how much real liquidity sits in the pool and who controls the LP tokens that represent it.

• Check whether LP tokens are burned or locked in a verifiable contract.

• Check what share of total LP the burn or lock actually covers.

• Compare pool depth to market cap to see how much a single sell would move price.

For example, a token showing a $2M market cap with $40K of liquidity can lose most of its price on one mid-sized sell. If the deployer also holds unlocked LP, that liquidity can disappear entirely.

3. Map Holder Concentration and Wallet Clusters

Holder counts lie when one entity controls many wallets. The flagged benchmark tokens in the SolRugDetector study had a median of just 9 holders, and the syndicate data shows how often those holders are the same group.

• Exclude the liquidity pool and any lock contracts, then check the top 10 holders’ combined share.

• Look for wallets funded from the same source shortly before launch.

• Watch for snipers who bought in the first block and have not sold yet.

A healthy distribution is spread across unrelated wallets. A distribution where a dozen fresh wallets hold 40% of supply is a pump-and-dump waiting for its exit liquidity.

4. Verify Whether Insider Supply Is Actually Locked

This is the signal that answers the pump-and-dump problem directly. If team, contributor, and treasury tokens sit in transparent token locks or vesting contracts, they cannot hit the market before the unlock date, no matter what the chart does.

• Find the lock or vesting contract address, not just a screenshot or a tweet.

• Confirm the amount, recipient, and unlock schedule on Solscan, Solana Explorer, or RugCheck.

• Check whether the schedule releases gradually or dumps everything on a single date.

• Note whether unlocks are time-based or tied to price conditions.

Locked tokens cannot be transferred, traded, or accessed until the unlock criteria are met. A project that says “the team won’t sell” is making a promise; a project with an on-chain lock has made it enforceable.

5. Confirm Identity and Metadata

Impersonation is a cheap and common attack. The SolRugDetector researchers found 1,030 flagged tokens using look-alike or impersonating names, and among flagged tokens that listed a website, only 29.3% of those sites were authentic and functional.

• Get the contract address from the project’s official channels, never from a reply or DM.

• Check that the name, symbol, and metadata match across explorers and the project’s site.

• Open the website and confirm it works, links back to the same contract, and has real content.

Identity checks will not stop a well-funded rug, but they filter out the lowest-effort scams in seconds.

How Streamflow Fits Into This

Every signal above is something a legitimate project can choose to send. Streamflow makes the most important one, verifiable insider supply commitment, fast and permissionless for any SPL token.

A creator can lock tokens in about 37 seconds through a no-code flow, with no smart contract development required.

• Token locks support fixed-date and price-based unlocks, plus LP token locks for liquidity commitments.

• On-chain vesting releases contributor tokens on linear, cliff, graded, or milestone schedules.

• Proof links and public dashboards let buyers verify a lock without trusting the team’s word.

• The tokenomics dashboard shows locks, vesting contracts, and unlock events in one real-time view.

Streamflow’s smart contracts are audited by FYEO and OPCODES, and contracts are immutable once deployed. For creators, that means a lock is a credible signal; for buyers, it means a Streamflow contract they can verify on Solscan is a commitment the team cannot quietly undo.

Creators who want to send that signal can open the Streamflow app and lock supply before the first buyer arrives.

Case Study: How Bonk and Heavenland Made Supply Commitments Verifiable

Bonk shows what a credible supply commitment looks like at scale. The Solana meme coin allocated 55% of its supply to airdrops for early Solana users and used Streamflow for core team vesting: 20% of total supply across 22 early contributors on a 3-year linear schedule. The Bonk vesting case study shows how putting contributor supply on a public, gradual schedule built trust and transparency with the community.

Heavenland took the same principle further. The Solana metaverse placed 97% of its $HTO supply on 5-year linear vesting, with every allocation subject to cliffs.

That structure allowed initial liquidity without excessive inflation, and the Heavenland case study points to a more engaged, dedicated player community as the result. In both cases, a buyer running the checklist above would find exactly what they look for: insider supply that provably cannot dump.

What This Means for Buyers and Token Creators

For buyers, the order of operations matters. Authorities and identity checks take seconds and rule out the cheapest scams; holder clusters and insider supply status take longer but catch the pump-and-dumps that make up most rugs.

• Treat unverifiable team promises as no lock at all.

• Read the unlock schedule, including price-based token lock conditions, before you size a position.

• Re-check concentration after launch, because the first hour is when most rugs happen.

For creators, the lesson is the mirror image. Buyers now screen for verifiable commitments before they buy, so a token launched without locked insider supply starts at a disadvantage. The simplest path is the one the market already rewards: launch the token, lock the tokens, and make the proof public.

Conclusion

Checking a Solana token for rug pull risk in 2026 comes down to one question: can the people with the most power over this token hurt you right now?

Revoked authorities, real liquidity, spread-out holders, and clean metadata all help, but on-chain locked and vested insider supply is the signal that answers the pump-and-dump problem behind most rugs.

Streamflow gives creators that signal in under a minute and gives buyers a contract they can verify on any Solana explorer.

Book a demo to see how Streamflow handles token locks and vesting schedules that buyers can verify on-chain.

Read Next:

• How to Create a Meme Coin on Solana in 2026: Mint, Lock and Launch Step by Step

• The Solana Token Launch Checklist for 2026: Revoke Authorities, Lock Liquidity, Vest the Team

• The Best Hedgey Alternatives for Token Vesting and Airdrops in 2026

FAQs:

1. How do I check if a Solana token is a rug pull before buying?

To check if a Solana token is a rug pull before buying, start with mint and freeze authority, then liquidity, holder concentration, insider supply locks, and metadata. Use Solscan, Solana Explorer, or RugCheck to verify each one on-chain. The insider supply check matters most, because pump-and-dumps make up most flagged rugs and pass authority checks.

2. Is a token safe if mint and freeze authority are revoked?

A token is not automatically safe if mint and freeze authority are revoked. Revoking them blocks new supply and account freezing, but insiders can still dump supply they already hold. Buyers should also confirm that team and contributor tokens sit in verifiable lock or vesting contracts.

3. How can I verify that a project’s team tokens are locked on Streamflow?

You can verify that a project’s team tokens are locked on Streamflow by opening the project’s proof link or the contract address on Solscan, Solana Explorer, or RugCheck. Check the locked amount, the recipient, and the unlock schedule. Streamflow contracts are audited by FYEO and OPCODES and are immutable once deployed.

4. What’s the difference between a token lock and vesting for rug pull protection?

The difference between a token lock and vesting is how supply is released. A token lock holds tokens until a fixed date or price condition, while vesting releases tokens gradually over time, often after a cliff. Both prevent insiders from selling early, and vesting also avoids a single large unlock that can crash price.

5. How fast can a token creator lock tokens on Streamflow?

A token creator can lock tokens on Streamflow in about 37 seconds through the no-code interface. It works with any SPL token, including LP tokens, and requires no smart contract development. The lock is then publicly verifiable through proof links and Solana explorers.