{"id":"how-rug-pulls-actually-work","t":"How Rug Pulls Actually Work: Five Technical Patterns","c":"Security & OpSec","body":"## Pattern 1: The mint authority was never revoked\n\nEvery SPL token has a mint authority — the account allowed to create new supply. Legitimate projects revoke it after the initial mint (setting it to null) so nobody, including the team, can inflate supply later. If the mint authority is still live, the team can print unlimited new tokens and sell into the market at any time — no exploit needed, no code change, just a signed transaction.\n\nCheck it directly: `getAccountInfo` on the mint address, `jsonParsed` encoding, look at `mintAuthority` in the response. `null` or absent means revoked. Anything else is a live key that can dilute you at will.\n\n## Pattern 2: The freeze authority was never revoked\n\nSeparately from minting, SPL tokens can have a freeze authority — the account allowed to freeze any wallet's token balance so it can't be transferred. A live freeze authority means the team can lock your tokens in place while they sell, or freeze specific wallets selectively. Same check as above: `freezeAuthority` in the parsed mint account should be `null`.\n\n## Pattern 3: The honeypot — buy works, sell doesn't\n\nCommon on EVM chains, rarer but present on Solana via program-level transfer hooks. The contract's transfer or sell path contains logic that reverts, taxes at 90–100%, or routes through an allowlist that excludes ordinary holders. Price charts look normal because buys succeed and get recorded — the trap only springs when you try to exit. The only reliable check is a simulated sell (a dry-run transaction that doesn't broadcast) before you commit real funds, not just reading the contract source, which is often unverified or misleading.\n\n## Pattern 4: Liquidity that isn't actually locked\n\n\"LP locked\" is a claim, not a fact, until you verify the mechanism. A real lock burns the LP tokens (sent to an unspendable address) or time-locks them in a program the team can't call early. A fake lock sends LP tokens to a wallet the team still controls, or to a \"lock\" contract with an undisclosed early-unlock function. Either way, once liquidity is pulled, the token's price goes to zero and nobody can sell. Verify the lock destination and mechanism yourself — don't take a percentage figure at face value.\n\n## Pattern 5: A handful of wallets hold most of the supply\n\nEven with every authority revoked and liquidity genuinely locked, concentrated holdings let a small group crash the price by selling in coordination — sometimes called a \"soft rug.\" Check the top 10–20 holder percentage and look for wallets that are clearly linked (funded from the same source, created in the same block, or holding identical amounts). A team wallet holding 40% of supply doesn't need a technical exploit to hurt you; it just needs to sell.\n\n## Putting it together\n\nNo single flag proves a rug is coming, and no single clean result proves safety — these five patterns compound. A token can pass four checks and still fail on the fifth. Treat each one as a specific, falsifiable question you can answer from public data, not a vibe.","price":null,"license":"LicenseRef-Saylor-Agent-Use-1.0"}