Free tool · Read-only · No wallet connection

Crypto Rug Pull Risk Checker for Ethereum Tokens

Short answer

Paste a token’s contract address to see, from live Ethereum data, whether someone can upgrade it, mint supply, blacklist wallets, pause trading, raise fees or pull its Uniswap liquidity. Then answer 11 questions the chain can’t answer to get a 0–100 risk score. It flags warning signs; it cannot prove a token is safe.

Privacy: No wallet connection or signature. The address goes from your browser to public Ethereum nodes (PublicNode, dRPC, 1RPC) to read public contract data. We do not receive or store it. Never paste a seed phrase or private key anywhere.

Magnifying glass over a token contract revealing a rug pulled from under gold coins, surrounded by lock, owner crown, pause and mint warning icons

Step 1 · Read-only contract check (Ethereum mainnet)

Paste a token contract address

Your browser asks public Ethereum nodes for the contract’s bytecode, ERC-20 details, owner, proxy slots and its Uniswap v2 pool. No wallet connection, no signature, nothing stored by us.

Try a known token: ·

Step 2 · What the chain can’t tell you

Answer 11 questions about the project

Weighted by how directly each item relates to losing your money. “Not sure” and unanswered questions count as half risk, because unknowns are risk.

1.Is the trading liquidity burned or locked in a lock contract you checked yourself (amount and expiry)?weight 15
A screenshot or a “liquidity locked” claim in Telegram is not a check. In its Game Coin case the SEC alleges liquidity was promoted as “locked” while LP tokens sat unlocked.
2.Can you see ordinary wallets (not the deployer or team) successfully selling on a block explorer?weight 15 · critical
Honeypots let anyone buy but block or tax sells. Look at recent token transfers into the pool from many different wallets.
3.Is the contract source code verified on Etherscan (green check on the Contract tab)?weight 10
Unverified code is not proof of fraud, but it hides the functions you most need to read.
4.Do a handful of wallets, other than the pool, burn address, exchanges or vesting contracts, hold most of the supply?weight 12
Check the Holders tab and label each top address before you decide. There is no single safe percentage.
5.Is anyone promising guaranteed or very high returns, or pressuring you to buy before a timer runs out?weight 12 · critical
The FTC, SEC and CFTC all list guaranteed returns and urgency as fraud signals.
6.Are buy/sell taxes disclosed, modest, and capped or fixed in the code?weight 8
If the owner can raise fees at will, a 5% tax today can be 99% tomorrow.
7.Is there an audit from a named firm that covers this exact deployed address and version?weight 8
Audits miss bugs and can be faked. Find the report on the auditor’s own website and match the address.
8.Is the team publicly identifiable and accountable (real names, history, legal entity)?weight 6
Pseudonymous teams are common and not automatically malicious, but they are harder to hold to account.
9.Is there a working product, documentation or public code beyond a website and a chat group?weight 6
A token whose only “product” is the token itself depends entirely on new buyers.
10.Did you hear about it from an unsolicited DM, a paid influencer, or a “signal” group?weight 6
Pump-and-dump groups recruit buyers through social tips, according to the CFTC.
11.Did the token launch in the last few days, or has the price multiplied within days?weight 6
Fresh launches and parabolic charts are where most liquidity pulls happen.

0 of 11 answered Yes/No · checklist score 50/100

Your rug-pull risk score

Run the contract check, answer the questions, or both. Your score and the reasons behind it appear here.

How to use the rug pull checker

Get the contract address from a source you verified independently (the project’s own site reached by typing the URL, or the token page on Etherscan), not from a DM or a reply. Check it with our Ethereum address checker if you copied it from history.
Paste it in Step 1 and press Check contract. Read every flag, not just the score: each one says what the power allows and why it matters.
Open the token on Etherscan and answer the 11 questions in Step 2: Contract tab (verified?), Holders tab (who holds supply?), token transfers (are ordinary wallets selling?).
Read the combined score with its reasons. Anything High or Severe: walk away, or at most risk an amount you would not miss. Never approve unlimited spending for a token you are unsure about. See how to review and revoke token approvals.

What a rug pull is, in one paragraph

A rug pull is when the people behind a token or project take investors’ money and leave them holding something that can’t be sold or is worth almost nothing. The SEC describes the DeFi version as a holder of liquidity-provider (LP) tokens withdrawing a pool’s liquidity and selling into it. Chainalysis counted more than $2.8 billion taken in rug pulls in 2021, 37% of all crypto-scam revenue that year (about 90% of that from one exchange, Thodex). The step-by-step red flags and real cases are in our guide how to spot a crypto rug pull.

What each on-chain check reads, and why it matters

Check	How it is read	Why it matters
Contract code	eth_getCode	Wallets and 7702-delegated accounts are not tokens. Catches pasted wallet addresses.
Upgradeable proxy	EIP-1967 / beacon / legacy OpenZeppelin slots, EIP-1167 clone pattern	The admin can swap the token’s logic at the same address.
Owner	owner() or getOwner()	An active owner controls every owner-only function; zero address means renounced.
Mint	mint(…) / issue(…) selectors	New supply can be printed and sold into the pool.
Blacklist / bots	blacklist, addBots, setBots, freeze… selectors	Chosen wallets can be stopped from selling: the honeypot pattern.
Pause	pause() / unpause()	All transfers, including sells, can be frozen.
Fee setters	setFee, setTaxes, updateSellFees… selectors	Sell tax can be raised after you buy.
Trading switch / limits	enableTrading, setMaxTxAmount, setMaxWalletSize…	Sells can be throttled or switched off.
Liquidity custody	Uniswap v2 getPair → LP totalSupply, LP balance of 0x0 / 0x…dEaD / owner	Unburned LP in a wallet can be redeemed for the pool’s ETH.
Pool depth	getReserves() WETH side	Thin pools crash on one sale and are cheap to drain.
Owner supply	balanceOf(owner) / totalSupply	A large owner bag can be dumped on buyers.

Limits you should know about

Selector scan is a heuristic. It finds well-known function names compiled into the bytecode. A function can be renamed, live in a separate contract, or be missing from a token that hard-codes the same rule into transfer(). A selector can also appear because the contract calls that function on another contract.
Liquidity check covers one pool. Only the Uniswap v2 TOKEN/WETH pair is read. Uniswap v3/v4 positions, other DEXs, stablecoin pairs and centralized exchanges are not. Lock contracts (lockers) are not recognised, so locked LP shows as “not burned”: check the locker yourself.
No sell simulation. We do not simulate trades, so we cannot promise you will be able to sell. Watching real, unrelated wallets sell is better evidence.
Snapshot in time. Owners, fees, implementations and pools can change after you check. Upgradeable tokens can change completely.
Control is not intent. USDC and USDT score high on control because their issuers can mint, pause and freeze. That is disclosed and regulated; the same powers in an anonymous team’s hands are a different risk.

If you already bought or approved a risky token

Revoke any approval you gave its contracts (check yours with our token approval checker; disconnecting a site does not cancel an allowance), keep the contract address and transaction hashes, and report fraud to the FTC (ReportFraud.ftc.gov), the FBI’s IC3 (ic3.gov) or your national regulator. Anyone who contacts you offering to recover the money for an upfront fee is very likely running a second scam. Read our Scam Watch, Telegram signal scam playbook and fake exchange support scams guides.

Rug pull checker FAQ

How do I check if a crypto token is a rug pull?

Start with the contract: confirm the exact address, then check whether it is an upgradeable proxy, who the owner is, whether the owner can mint, blacklist, pause or change fees, and who holds the liquidity-pool tokens. Then check what the chain cannot show: whether ordinary wallets can sell, whether liquidity is locked in a contract you verified, holder concentration, audit scope, and how the token is being promoted. This page does the first part automatically for Ethereum mainnet tokens and scores the second part from your answers.

Can this rug pull checker prove a token is safe?

No. It reads public contract data and looks for common warning signs. Malicious logic can be renamed, hidden in another contract, added later through an upgrade, or written into the transfer function itself. A low score means these checks found fewer red flags, not that the token is safe. Treat any new token as money you can afford to lose entirely.

What does the on-chain check actually read?

Through public Ethereum JSON-RPC nodes it reads: whether the address has contract code; EIP-1967, beacon, legacy OpenZeppelin and EIP-1167 proxy slots; ERC-20 name, symbol, decimals and totalSupply; owner() or getOwner(); function selectors for common mint, blacklist, pause, fee, trading-switch and role functions in the bytecode (including the implementation behind a proxy); the Uniswap v2 TOKEN/WETH pool, its WETH reserve, the share of LP tokens burned or held by the owner; and the owner’s share of supply.

What is a honeypot token, and can this tool detect one?

A honeypot lets anyone buy but blocks or heavily taxes selling, usually through a blacklist, a trading switch, a max-transaction rule or a fee the owner can raise. The checker flags the functions that make honeypots possible, but it cannot prove you will be able to sell, because the rule can depend on the wallet, the amount or a later change. Checking that many unrelated wallets have actually sold is the stronger test, and it is question 2 in the checklist.

Why do USDC and USDT get a high contract-control score?

Because they really are centrally controlled: their issuers can mint, pause and freeze addresses, and USDC sits behind an upgradeable proxy. That is a disclosed feature of a regulated stablecoin, not a rug pull. The control score measures how much power the controller has, not their intentions. For an anonymous new token, the same powers in unknown hands are a serious risk.

If ownership is renounced, is the token safe?

Not necessarily. Renouncing owner() only disables functions protected by that owner. Separate roles, a proxy admin, an external controller contract, or rules already coded into transfers can remain, and liquidity can still be pulled if the LP tokens are in a wallet. The checker treats a renounced owner as one piece of evidence, not a pass.

Does it work on Base, Arbitrum, BNB Chain or Solana?

No. The on-chain check reads Ethereum mainnet only. On other chains the same address can belong to a different contract or none at all. You can still use the 11-question checklist for a token on any chain.

Do I need to connect my wallet? Is my data stored?

No wallet connection, no signature, no account. The contract address you paste goes from your browser straight to public Ethereum RPC nodes (PublicNode, dRPC or 1RPC) to read public data; GrowYourEthereum does not receive or store it. Your checklist answers stay in your browser tab.

Sources checked October 16, 2026

Sources and standards

How to spot a rug pull Token approvals Token approval checker Ethereum address checker Scam Watch Telegram signal scams Fake CEX support scams Is ETH a safe investment?Gas tracker

Educational security tool only, not financial, legal or investment advice, and not an endorsement or accusation about any token. Results come from public blockchain data at the moment you check and can change. A low score does not mean a token is safe.