Most token scams are variations on two ideas. A honeypot lets you buy but blocks selling. A rug pull lets you buy and sell, right up until the creators remove the liquidity and there's nothing left to sell into.
Both leave evidence on-chain beforehand. None of these checks require technical skill.
1. Get the contract address from an independent source
This single habit prevents most losses. Anyone can mint a token called "USDC" or "Arbitrum" — copies exist specifically to catch people searching by name. Always take the address from the project's official site or an established data source, then paste it in. Swap by address, never by ticker.
2. Check that liquidity is real
Look at the actual size of the pool, not the advertised market cap. Market cap is just supply multiplied by an easily manipulated price. A token claiming a $40m valuation with a $9,000 pool cannot pay out anything close to that. If liquidity is thin, you cannot exit at any size regardless of intentions.
3. Check whether liquidity is locked
If the creators still hold the LP tokens, they can withdraw the pool at any moment. That is a rug pull, and it takes one transaction. Look for liquidity locked for a meaningful period, or burned outright. "Locked for 30 days" tells you exactly how long you have.
4. Look at holder concentration
Open the token on a block explorer and read the top holders. If a handful of wallets control most of the supply, that supply is an overhang — those holders can exit into your liquidity whenever they choose. Watch for many wallets funded by the same source, which is one entity pretending to be several.
5. Run it through more than one scanner
Tools like Honeypot.is, Token Sniffer, RugCheck and GoPlus simulate a buy and a sell and report what the contract permits. They are genuinely useful and they are not infallible — sophisticated contracts can behave differently for a simulator than for you. Use two, and treat a clean result as "no red flags found", not "safe".
6. Read what the contract can still do
Scanners surface these; they're the ones that matter most:
- Mint — can new supply be created at will, diluting you?
- Blacklist — can specific wallets be blocked from selling? This is how targeted honeypots work.
- Pause — can trading be frozen entirely?
- Modifiable fees — can the sell tax be raised to 99% after you buy?
Any of these means someone can change the rules while you're holding.
7. Look at the sell side of the chart
On a chart of recent trades, healthy activity shows buys and sells. A long run of buys with almost no sells is a classic honeypot signature — people aren't holding out of conviction, they're unable to exit.
8. Be suspicious of the quoted price impact
If swapping a modest amount shows an enormous price impact, or the interface demands 15% slippage to route at all, that's information. It usually means there isn't enough liquidity for you to get back out.
9. Check whether the contract is verified
Verified source code on the block explorer means anyone can read what it does. Unverified means you're trusting a black box. Verification alone doesn't make a token safe — plenty of verified contracts are hostile — but the absence of it removes any possibility of scrutiny.
10. Weigh the pressure to hurry
Not on-chain, but reliable. Countdown timers, "last chance", a stranger in your DMs, a giveaway that needs you to connect first. Urgency exists to stop you running the other nine checks. A real project is still there tomorrow.
If a token cannot survive five minutes of scrutiny, it will not survive your money.
The two-minute version
When you're short on time, these three catch most of it:
- Verified contract address from an independent source.
- Real, locked liquidity — enough to exit, and not withdrawable.
- Two scanners agreeing that a sell simulates successfully.
A note on what a DEX can and can't do
Because non-custodial trading means no gatekeeper holds your funds, it also means no gatekeeper vets the tokens. That's the trade: full control, full responsibility. The checks above are how you exercise the second half of that.
And when you're finished experimenting, revoke the approvals you granted along the way.
Trade the tokens you've checked
Kryllex routes across 100+ DEXs on 16 chains and shows expected output and price impact before you sign — your keys, your crypto.
Launch Kryllex →Keep reading: Token approvals explained · What is MEV?