How to Check if a Crypto Token Is Safe: The Complete Security Checklist

July 20, 2026 · Security · Beginner · 8 min read

How to Check if a Crypto Token Is Safe: The Complete Security Checklist

A safe crypto token is one whose contract cannot trap your funds, whose supply cannot be secretly inflated, and whose liquidity cannot be pulled out from under you. Checking for these three things takes under a minute with the right tool — this guide walks through exactly what to check, why each check matters, gives a concrete example of what it looks like when the check fails, and is honest about what no automated scanner can tell you.

In this guide

The 60-second version

Paste the token's contract address into the free RugShield scanner. It runs every check below automatically against live on-chain data and returns a trust score. Read on to understand what that score is actually measuring — a passing scan is a strong signal, not a guarantee, and the second half of this guide covers exactly what it can't see.

Contract risks: can the code itself hurt you?

These are checks against the deployed bytecode itself — the same rules apply no matter how the token is being marketed.

Can the contract trap your money? This is the single most important check: can you sell what you buy? A honeypot token allows buying but blocks selling through hidden logic in the sell function — by the time a buyer notices, their funds are stuck with no way out. In practice this shows up as a token that charts beautifully on the buy side, with a thin but steady stream of new buyers, and zero successful sell transactions in the on-chain history — a pattern a live scan catches instantly but a glance at the price chart never will.

Are buy and sell taxes doing the same job legally? Even a token that technically lets you sell can tax you on the way out. Legitimate projects use modest, fixed buy/sell taxes — often 3-5% — to fund liquidity or development. The red flag version keeps the tax function modifiable after launch: the contract looks fine at deployment, then the deployer raises the sell tax to 90%+ right as volume picks up, which functions exactly like a honeypot without technically being one.

Can the supply be secretly inflated? If the deployer retains an active mint function, they can create new tokens at will and dump them on the open market, collapsing the price for everyone already holding. A real example of this pattern: a token pumps 40x in a week on thin liquidity, then a single mint transaction doubles the circulating supply and the price is cut in half within minutes — visible on-chain the entire time to anyone who checked the mint function first.

Does "renounced" actually mean what it says? The standard fix a legitimate project makes is renouncing ownership — but renounced ownership isn't automatically safe. Some contracts renounce the "owner" role cosmetically while routing the same privileged functions through a second, unrenounced address, or a role the renounce call never touched. Always check what specific capability was actually given up, not just that a renounce transaction happened.

Can the contract freeze you out, or rewrite its own rules? Two related risks worth checking alongside mint authority: whether the contract has a pause or blacklist function that can freeze specific wallets from transferring at all, and whether it's built as a proxy contract — meaning the logic behind the address can be swapped out after launch, silently changing the rules holders agreed to when they bought in. Neither is automatically malicious (upgradeable contracts have legitimate uses), but both mean the token you're buying today isn't necessarily the token you'll be holding tomorrow.

Liquidity risks: can you actually cash out?

A contract can pass every check above and still be un-sellable in practice if there's nothing to sell into.

Is the liquidity actually locked? Liquidity is what lets anyone sell tokens for real money. Check whether it's genuinely locked in a time-locked contract — and for how long — versus sitting in a regular wallet the deployer can drain at any moment. A locked-for-30-days pool and an unlocked pool can look identical on a price chart right up until day 31, or right up until the deployer decides to move first.

What does liquidity removal actually look like? Liquidity removal is the single most common rug-pull mechanic: the price chart looks completely healthy — steady volume, normal-looking candles — right up until the pool is emptied in one transaction, and the price effectively goes to zero in seconds. This is the exact failure mode liquidity locks exist to prevent, and it's the reason "the chart looked fine yesterday" is not a security check.

Wallet and holder risks: who really controls the supply?

Even a perfectly clean, fully-locked contract can be dangerous if a small number of wallets can move the market unilaterally.

Is ownership concentrated in a few wallets? If a handful of wallets hold most of the supply, they can crash the price the moment they decide to sell — regardless of how clean the contract code is. Learning to read holder concentration tells you how exposed the token is to a small group of early holders acting in their own interest, and how to actually read a holder distribution table correctly (top-10%, not just holder count) is a separate skill from just glancing at a number.

Can that concentration hide behind a decentralized-looking number? Wallet clustering and bundled wallets let a single actor split holdings across dozens of addresses at launch, so the "top holder" number looks reassuring while the same entity effectively controls a much larger share. This is one of the harder risks to self-check, since the top-10-holders percentage can be technically accurate and still misleading about who's actually behind it.

Has this deployer done this before? Deployer wallet analysis — checking what else the token's creator wallet has launched — is one of the fastest ways to spot a serial rug-puller before they repeat the pattern. A wallet that deployed and then rug-pulled three tokens in the past month is a different risk category than a wallet with no prior history, even if the current contract itself looks clean.

Trading manipulation: risks a clean contract won't show

These don't show up as a single yes/no flag in on-chain contract data — they require reading trading behavior, not just the code.

Is the volume even real? Wash trading inflates volume by having related wallets trade back and forth with each other, making a dead or thinly-traded token look active and liquid. A token showing $2M in daily volume against $15,000 of real liquidity is a mismatch worth investigating before treating that volume figure as a sign of genuine interest.

Are you trading against bots on every transaction? Sniper bots buy a token in the very first block after launch, then dump on the retail buyers who follow. MEV bots go further, actively reordering or sandwiching individual transactions to extract value from ordinary trades. Neither shows up as a contract security flag, but both directly cost money on every trade they touch.

Platform-specific risks

Some risks are specific to how and where a token launched, not the contract itself.

Launchpad tokens carry their own base rate of failure. pump.fun-style bonding-curve launches make it trivial to deploy a token in seconds, which means the overwhelming majority of tokens launched this way are abandoned or drained within hours — worth knowing before treating "it launched on a popular launchpad" as any kind of signal on its own.

Solana tokens use a different authority model entirely. Freeze and mint authority on Solana (SPL) tokens work differently from EVM ownership — a live freeze authority can block a specific wallet from transferring the token at all, separate from mint authority controlling supply. Checking "is ownership renounced" on an EVM token and checking authorities on an SPL token are related questions with different mechanics underneath.

Is the source code even verifiable?

One check underlies almost everything above: an unverified contract means nobody outside the deployer can confirm what the code actually does, because the human-readable source was never published to match the deployed bytecode. This alone doesn't prove malicious intent — some legitimate projects are simply careless about verification — but it removes your ability to independently check any of the other risks on this list. Treat an unverified contract as a reason to be more cautious about everything else, not as a standalone dealbreaker.

The verdict is the worse of the two

A token that passes every contract check above can still be a bad trade. Contract security and speculative market risk are separate questions that both need honest answers — see the full methodology for how RugShield keeps them separate, and why the honest overall verdict is always the worse of the two, never an average of the two.

Every guide in this checklist

Each risk above has its own dedicated guide with worked examples and what to look for on-chain.

Contract risks: Honeypot tokens · Buy/sell taxes · Active mint function · Renounced ownership · Blacklist functions · Proxy contracts · Unverified source code

Liquidity risks: Liquidity locks · Liquidity removal / rug pulls · How rug pulls work

Wallet and holder risks: Holder concentration · Reading holder distribution · Wallet clustering · Bundled wallets · Deployer wallet analysis

Trading manipulation: Wash trading · Sniper bots · MEV bots and sandwich attacks

Platform-specific: pump.fun and bonding-curve launches · Solana freeze and mint authority

Off-chain and phishing risks: Wallet drainer scams

More resources: Crypto scam glossary · How to choose a token security scanner

Run it now

Paste any EVM or Solana contract address into the free RugShield scanner — no wallet connection required, results in seconds.

Frequently Asked Questions

How do I check if a token is a scam before buying?
Run its contract address through a free scanner like RugShield to check for honeypot behavior, active mint functions, unlocked liquidity, and holder concentration — the checks covered in this guide. A clean result is a strong signal, but also check trading volume for wash-trading patterns manually, since no scanner can catch every manipulation tactic.
What is the biggest red flag when checking a new token?
A honeypot signal — where the contract allows buying but blocks selling — is the single most damaging risk, since it can trap 100% of your funds instantly. An active mint function and fully unlocked liquidity are the next most serious, since both let the deployer damage the token's value at will.
Is a token safe just because ownership is renounced?
Not automatically. Renouncing ownership should remove the deployer's ability to mint, freeze, or edit taxes, but some contracts renounce cosmetically while retaining those powers through other functions. Always verify what renouncing actually disabled, not just that it happened.
Can a token be safe on paper but still lose money?
Yes. A token can pass every contract security check and still be a bad trade due to thin liquidity, concentrated holders, or being a purely speculative new launch. Contract security and market risk are separate questions — a real answer needs both, not just one.