How we score rug risk on new Solana tokens

Most new Solana meme coins die within hours. Some of them die because nobody bought. Others die because the people who launched them built the exit in from the start. You can't fully tell those two cases apart on-chain, but you can check for the most common rug setups in a few seconds. Here's the checklist we use, why each check matters, and where each one falls short.

1. Mint authority

An SPL token's mint authority can create new supply at any time. If it hasn't been revoked (set to null), the deployer can mint billions of tokens and dump them into the pool.

Check: read the mint account (getAccountInfo on the mint, or getMint in @solana/spl-token). The mintAuthority field should be null.

2. Freeze authority

If a freeze authority exists, it can freeze any holder's token account, so you can buy but never sell. This is the classic honeypot.

Check: the same mint account. freezeAuthority should be null.

3. Holder concentration (done right)

"Top 10 holders own 60%" sounds bad, but on Solana the biggest "holder" is often the AMM pool or the pump.fun bonding curve. Those accounts aren't people. Leave pools, bonding curves and known program-owned accounts out before you measure concentration, or the number means nothing.

Check: getTokenLargestAccounts, resolve each account's owner, drop pool and curve accounts, then add up what's left. A handful of fresh wallets holding a big share is a red flag, especially if they were all funded from the same source.

4. LP burned or locked

If the deployer still holds the LP tokens, they can pull the liquidity whenever they like. Burned LP (sent to an unspendable address, or the supply destroyed) or LP held in a time-locked program removes that option.

Check: find the pool's LP mint and see who holds the supply. Note that some newer pool types don't use classic LP tokens, so the check depends on which AMM the pool runs on.

5. Liquidity depth

Thin liquidity means a single wallet can move the price wildly, and your exit costs you a lot of slippage. Shallow pools relative to market cap are a warning sign even when everything else looks clean.

Check: pool reserves in SOL/USDC terms, compared with FDV.

6. Token age

Most rugs happen early. A coin that has existed for 20 minutes simply has less history to judge. Age doesn't make anything safe, but it's useful context alongside the other checks.

7. Deployer / dev wallet behaviour (general practice)

Many traders also trace the deployer: how it was funded, whether it launched and abandoned other tokens, and whether it's quietly selling. It's worth doing by hand. It's also the noisiest signal, because wallets are cheap to rotate.

Combining signals

No single check is decisive. A reasonable approach is to weight each finding, add in third-party scanners (RugCheck, for example), and output one 0–100 number where higher = more risk signals found. Be clear about what the number means: a low score means fewer known red flags, not "safe". Coordinated insiders, social-engineering dumps and brand-new attack patterns won't show up in any of these checks.

What we built

Disclosure: I work on Varra (https://varra.trade), a non-custodial Solana meme coin terminal. Its published methodology combines mint authority, freeze authority, top-10 holder concentration excluding pools and bonding curves, LP burned/locked, pool liquidity and token age with RugCheck findings into a 0–100 score shown on every coin, including coins still on the pump.fun curve. You swap from your own wallet. Trades carry a 1% fee (0.75% on Pro). The method is described at https://varra.trade. None of this is financial advice.