Quick answer
You cannot prove a Solana token is safe. What you can check is how easy a rug would be: whether anyone can still mint new supply, whether the liquidity can be withdrawn, how much of the supply sits in a few wallets, and what the developer has launched before. Four checks, in that order. A token that passes all four can still go to zero. It just cannot be emptied in a single transaction.
What is a rug pull?
A rug pull is when the people behind a token take the value out and leave holders with something unsellable. The word covers several different mechanics, which is why "is it a rug?" is a harder question than it sounds.
The important distinction is between a token that went to zero and a token that was taken. Most new tokens go to zero through ordinary disinterest: nobody buys, the price decays, everyone moves on. That is a bad trade, not a rug. A rug is a deliberate act, and the acts that make one possible are visible before it happens.
So the useful question is not "does this team seem trustworthy". It is what could they do to me right now if they wanted to. That question has concrete, checkable answers.
2. Can the liquidity be withdrawn?
This is the one that actually empties wallets. A token trades against a pool, usually paired with SOL. Whoever holds the LP tokens for that pool can withdraw what is in it. If that is the developer, the exit is a single transaction, needs no special permission, and leaves holders with a token that has nothing to sell into.
Two things make this harder: burning the LP tokens, which destroys the ability to withdraw permanently, or locking them with a third party until a set date. Burned is stronger than locked, because a lock is a countdown.
Check the proportion too. A locked 10% sitting beside an unlocked 90% is a locked token in name only, and that framing is used deliberately. How to check if a liquidity pool is locked or burned walks through finding the pool and reading its state.
3. Who actually holds it?
Supply concentration decides what happens when someone decides to leave. If a handful of wallets hold most of the supply, the price is at their discretion regardless of how many small holders exist.
Read a holder list carefully, because the raw ranking misleads in both directions. Some large accounts are not holders at all: liquidity pool vaults and program-owned accounts routinely appear near the top and belong to infrastructure rather than a person. And a distribution that looks wide can be one person across many wallets, which is what a bundled launch produces.
How to read a token's holder distribution covers separating real holders from infrastructure, and spotting wallets that move together.
4. What has this developer done before?
The first three checks describe the token. This one describes the person, and it is the check most people never do because it is the most laborious by hand.
Launch wallets leave a trail. The same wallet, or a wallet funded by it, often appears behind several tokens. A developer whose previous launches all ended the same way is telling you something that no amount of revoked authorities offsets. Equally, a first-time launcher is not evidence of anything either way, and treating it as a red flag is how people talk themselves out of fine trades.
This is the check RektDefender automates most aggressively, because doing it manually across several launches is an afternoon's work per token.
What none of this proves
All four checks together establish one thing: how exposed you are to a deliberate act. They say nothing about whether the token will go up.
A token can have revoked authorities, burned liquidity, a clean holder spread and an unremarkable developer, and still lose you everything, because nobody else bought it. That is not a rug. That is the normal outcome for most new tokens, and no checklist protects you from it.
Treat this as removing the avoidable losses, not as a green light. Any tool, including this one, that converts these checks into a single safety score is compressing away the part that mattered.
FAQ
Can you tell for certain if a Solana token is a rug pull?
No, and anything claiming otherwise is selling you something. A rug pull is an intention, and intentions are not recorded on-chain. What you can establish is how easy a rug would be to carry out: whether someone can still mint new supply, withdraw the liquidity, or freeze your ability to sell. A token where all three are impossible can still go to zero. It just cannot be taken from you in one transaction.
Does a revoked mint authority mean a token is safe?
It means one specific attack is off the table: nobody can print new supply to dilute you. It says nothing about liquidity, holder concentration, or the developer's history. Revoking mint authority is also trivially cheap and widely known as a trust signal, which is exactly why it is routinely done by projects that intend to rug by another route.
How long do these checks take?
Done manually across a block explorer, a DEX page and a holder list, roughly ten to twenty minutes per token, and longer if you also trace the developer's previous launches. That cost is the real reason most people skip them, and skipping them is the single most common way people get rugged.
What is the most common rug on Solana?
Liquidity removal. The developer holds the liquidity pool tokens, the price runs, and they withdraw the pooled SOL, leaving holders with a token that has nothing to sell into. It needs no special permissions and no exploit, which is why it is more common than a mint attack.
Is a token with locked liquidity safe to buy?
Safer against one attack, for as long as the lock lasts. Check the unlock date, because a lock that expires next week is a countdown rather than a guarantee. And confirm what proportion of the liquidity is actually locked: a locked 10% alongside an unlocked 90% is a locked token in name only.
Run all four checks at once
Authorities, liquidity, holder concentration and developer history on one token page, instead of four tabs and twenty minutes.
See the terminal →Sources
- Solana Docs: Tokens on Solana — the mint account model, and the fact that mint and freeze authority are optional fields which can be set to none permanently
- Solana Program Library: Token Program — the authority types an SPL token can carry, and what revoking each one removes