Quick answer
A safe-looking badge is not a safety proof
Before you buy a new token or connect a wallet, verify the exact contract and network, inspect who can change token behavior or upgrade the logic, identify who controls the liquidity position, and read the permission your wallet is asking you to sign. A lock, a renounced owner, verified source code, or an audit can each add useful evidence. None of them proves the whole system is safe by itself.
Three control paths
What a crypto rug pull can exploit
“Rug pull” is a broad label, not one technical signature. The useful task is to map the controls that could change what buyers can sell, what a wallet can lose, or whether the market still has usable reserves.
Liquidity can leave
A market can exist because someone deposited both assets into a pool. In Uniswap v2, the provider receives liquidity tokens and can burn them to retrieve its share of the reserves. Initial liquidity is not the same as permanent liquidity; identify who controls the redeemable position and what, if anything, limits withdrawal.
Token behavior can be privileged
Administrator roles may be able to mint supply, freeze transfers, change fees, pause trading, or alter other sensitive behavior. Those powers can be legitimate operational controls, but buyers need to know who holds them and how that authority is constrained.
Logic can be upgradeable
A proxy can keep the same address while forwarding calls to a replaceable implementation contract. Review the implementation as well as the proxy, then identify the upgrade administrator, any delay, and the governance or multisignature controls around it.
Before you buy or connect
Ten checks that produce real evidence
- 1
Confirm the exact chain and contract address
Start from a project channel you independently verified, then compare the complete address. A copied name, ticker, logo, or shortened address can point to a different token.
- 2
Read the verified source and the implementation
A block explorer can show the creator, creation transaction, source code, ABI, and contract events. If the address is a proxy, continue to the current implementation and review both layers. Unverified source is not proof of fraud, but it removes important evidence.
- 3
Map every privileged role
Look for powers to mint, freeze, blacklist, pause, change transfer fees, set trading rules, rescue assets, or move treasury funds. “Ownership renounced” only answers one question if separate roles or contracts still have authority.
- 4
Identify the upgrade path
For upgradeable contracts, find the administrator and ask whether upgrades require a multisignature, governance vote, or visible delay. The same public proxy address can execute new logic after an upgrade.
- 5
Trace who can withdraw liquidity
Find the pool and the position that represents its reserves. Check who controls that position, whether a lock exists, its exact expiry and contract, and whether more liquidity can be created elsewhere. A lock does not remove token-code or admin risk.
- 6
Review holders with context, not a magic percentage
Inspect concentration and connected wallets, but separate pool, burn, bridge, exchange, vesting, and treasury addresses before drawing conclusions. There is no universal top-holder percentage that makes every token safe.
- 7
Match any audit to the deployed code
Confirm the audit covers the same chain, address, implementation, version, and date. Ethereum.org cautions that audits are not a silver bullet and will not catch every bug; an old PDF or logo is not continuing assurance.
- 8
Verify the product and control claims
Check released code, working interfaces, governance records, named partners, and documentation from their original sources. A pseudonymous team is not automatically malicious, and a public profile is not automatically trustworthy.
- 9
Reject pressure and guaranteed returns
The FTC warns that guaranteed profit, big returns, zero-risk language, unsolicited social messages, and fake endorsements are scam signals. Slow down when promotion is doing more work than verifiable product evidence.
- 10
Limit the wallet blast radius
Use a separate wallet for unfamiliar applications, approve only what is needed, and reject unreadable spender or amount prompts. A successful connection or small trade only proves that one path worked at that moment; it does not prove future behavior.
Stop before signing
Five prompts that need no further debate
- The site, token, chain, or contract address does not match the source you verified.
- A page, “support” account, or wallet tool asks for your recovery phrase or private key.
- The spender, approval amount, transfer fee, or transaction effect is hidden or surprising.
- Someone guarantees profit, claims there is no risk, or pressures you to act before a timer expires.
- You cannot explain who controls upgrades, sensitive roles, or the redeemable liquidity position.
If you already connected or approved a token
Disconnecting a site does not cancel an on-chain allowance. Review the spender on the correct network, revoke permissions you no longer need, and wait for the revocation transaction to confirm. If you disclosed a recovery phrase or private key, treat the wallet itself as compromised and move unaffected assets using a fresh wallet created through trusted software or hardware.
Save the contract address and transaction hashes. Report fraud through official channels, and treat anyone promising guaranteed recovery for an upfront payment as another risk.
Crypto rug-pull FAQ
What is a crypto rug pull?
Rug pull is a broad label for a project exit in which insiders or privileged controls leave buyers with impaired value or no practical exit. It can involve withdrawn liquidity, restrictive token logic, an abusive upgrade, concentrated selling, or a promoted project that is abandoned. There is no single contract signature that identifies every case.
Does locked liquidity prove a token is safe?
No. A genuine lock can limit withdrawal of one identified liquidity position until a stated time, but it does not remove malicious token logic, privileged roles, upgrade authority, concentrated supply, a different pool, or risks after the lock expires.
Does renounced ownership prove there are no admin controls?
No. Renouncing one Ownable owner can disable functions protected by that owner, but separate roles, external controller contracts, proxy administrators, or logic already built into the token may remain. Inspect the complete control graph, not one owner field.
Are verified source code and an audit enough?
No. Verified source makes review possible, and a relevant audit adds evidence, but neither guarantees safety. Confirm the source and audit match the deployed chain, address, implementation, version, and date. Ethereum.org warns that audits do not catch every bug.
Will a small test buy prove I can sell later?
No. A small trade only shows that one route worked under the current state. Privileged rules, fees, allowlists, liquidity, or implementation logic can differ by wallet or change later. Do not risk funds solely to test a token you cannot otherwise verify.
What should I do after approving a suspicious token?
Disconnecting the site is not enough. Review the spender and allowance on the correct network, revoke permissions you do not need, and confirm the revocation transaction. If you exposed a recovery phrase or private key, treat the wallet itself as compromised and use a fresh trusted wallet.
Evidence reviewed August 25, 2026
Primary sources
Contract and explorer mechanics were checked against Ethereum.org, OpenZeppelin, and Uniswap documentation. Promotion and guaranteed-return warnings were checked against the U.S. Federal Trade Commission. Interfaces, roles, implementations, and pool positions can change, so verify the live chain state before signing.
- U.S. Federal Trade Commission — cryptocurrency scam and guaranteed-return warnings
- Ethereum.org — block explorer contract, token, holder, and event data
- Ethereum.org — smart contract access controls, testing, audits, and upgrade risks
- Ethereum.org — reviewing and revoking smart contract token access
- OpenZeppelin — ownership, roles, and access-control authority
- OpenZeppelin — how proxy upgrade patterns replace implementation logic
- Uniswap Developers — v2 liquidity pools, LP tokens, and reserve withdrawal