Rug pulls: name the mechanism that destroys the exit

The short answer

A rug pull is a deceptive launch or project in which the people controlling a material economic lever use it to extract value and leave other holders with a severely impaired exit. On Solana, recent primary research organized verified cases around three prominent execution patterns: liquidity withdrawal, freeze authority abuse, and pump-and-dump behavior. That is a useful taxonomy, not a claim that every loss or collapse is fraudulent.

One label hides several control surfaces

• Liquidity withdrawal: whoever controls the LP tokens or concentrated-liquidity position removes reserves, leaving little or no depth for sellers.
• Concentrated selling: the operator or linked holders control a much larger share than the address list suggests and sell that inventory into later demand.
• Supply inflation: a retained mint authority creates additional tokens that can be transferred or sold, diluting existing holders.
• Account or transfer control: freeze authority, Token-2022 extensions, delegates, hooks, or a custom program can restrict or alter token movement.
• Migration and identity bait: the operator redirects holders to a replacement token or pool while extracting value from the original market.

These paths can overlap. A launch may disperse supply across linked wallets, market that distribution as broad, build visible liquidity, then dump inventory before withdrawing what remains.

Start with capabilities, then investigate who can exercise them

Solana's Token Program mint state can store mint and freeze authorities. The authority can be changed or permanently revoked by setting the role to none. Token-2022 adds more extension-specific roles. A retained authority is evidence of capability; it does not by itself prove malicious intent. A revoked authority removes that particular capability; it does not remove every other route to extraction.

Resolve the exact mint and owning token program. Record mint, freeze, metadata, extension, delegate, hook, upgrade, and pool-position authorities where they apply. Then identify whether each authority is a person-controlled wallet, multisig, program-derived address, locker, or unknown account. “Renounced” is too broad unless the specific role and transaction are visible.

Locked liquidity protects one path, for the stated terms

First identify the actual pool and the instrument representing liquidity ownership. A burned LP token, time-locked fungible LP position, and concentrated-liquidity NFT are different structures. Confirm the owner, locker program, percentage, unlock time, withdrawal conditions, and whether meaningful liquidity exists in another pool.

Even a valid lock cannot prevent concentrated holder sales, new minting, account freezes, transfer fees, a malicious hook, unfavorable migration, or ordinary price impact. Compare displayed liquidity with a live quote for your intended exit and read liquidity depth and exit capacity.

Address distribution is not economic distribution

Classify pools, lockers, burns, exchanges, programs, treasury, team, and unknown holders before calculating concentration. Then search for transfers, common funding, launch bundles, synchronized acquisition, and coordinated selling that can place many addresses under one controller. Use the insider-cluster workflow and preserve both raw and entity-adjusted supply estimates.

A large holder can be legitimate and a dispersed holder list can be controlled. The defensible conclusion is specific: which addresses are linked, through which transactions or timings, how much supply they control under each interpretation, and what competing explanation remains.

Risk scanners are triage, not a warranty

A scanner can surface authorities, extensions, holders, liquidity, lockers, and creator history quickly. It can also lag, miss unsupported programs, rely on incomplete labels, or collapse uncertainty into one score. A clean result means the modeled checks did not produce a warning under the observed state.

Open the individual findings, preserve the scan time, and reproduce the material claims in an explorer. The independent RugCheck guide explains how to use the report without turning its score into a probability of safety.

A pre-trade rug review

1. Resolve identity. Save chain, mint, token program, pool, quote asset, pair age, and the source that tied the announcement to that address.
2. Inventory control. Record token, metadata, extension, program, pool, locker, and migration capabilities with their current authorities.
3. Rebuild supply. Classify top holders and aggregate only the linked entities supported by transaction evidence, with confidence labels.
4. Verify liquidity ownership. Match the real position, owner, locked or burned share, unlock conditions, reserves, and competing pools.
5. Test the exit. Quote the intended sell size, inspect route, minimum output, fees, price impact, and any transfer or simulation failure.
6. Define invalidation. List the authority change, liquidity move, cluster sale, migration message, or quote deterioration that cancels the trade.

After a suspected rug, preserve facts before attribution

Save the earliest and latest viable quotes, pool reserve and liquidity-position changes, authority transactions, mint or freeze instructions, holder transfers, sells, funding paths, social posts, and timestamps. Distinguish your failed transaction from the mechanism that caused the market failure. Do not interact with unsolicited recovery services or sign a “refund” transaction.

What belongs in the journal

Record mint and program, pools and positions, all relevant authorities and extensions, raw and entity-adjusted holder concentration, LP owner and lock terms, live entry and exit quotes, route and minimum output, scanner fields and time, invalidation rules, and the transaction evidence behind every risk conclusion.

Primary sources