Rugpull Detection

This guide helps you identify and avoid scam tokens and rugpull schemes.

What is a Rugpull?

A rugpull occurs when developers abandon a project and run away with investor funds. Common methods include:

Liquidity removal - Developers remove liquidity from DEX
Minting - Developers mint unlimited tokens and sell
Honeypot - Token can be bought but not sold
Hidden functions - Contract has malicious backdoors

Token Analysis

Quick Check

import { analyzeToken } from '@universal-crypto-mcp/security';

const result = await analyzeToken({
  address: '0xTokenAddress',
  chainId: 1,
});

console.log('=== Token Analysis ===');
console.log(`Name: ${result.name} (${result.symbol})`);
console.log(`Verified: ${result.isVerified ? '✅' : '❌'}`);
console.log(`Honeypot: ${result.isHoneypot ? '🚨 YES' : '✅ No'}`);
console.log(`Risk Score: ${result.riskScore}/100`);

Detailed Analysis

const analysis = await analyzeToken({
  address: '0xTokenAddress',
  chainId: 1,
  detailed: true,
});

// Contract Analysis
console.log('Contract:');
console.log(`  Verified: ${analysis.contract.isVerified}`);
console.log(`  Proxy: ${analysis.contract.isProxy}`);
console.log(`  Age: ${analysis.contract.ageDays} days`);

// Ownership Analysis
console.log('Ownership:');
console.log(`  Renounced: ${analysis.ownership.renounced}`);
console.log(`  Owner balance: ${analysis.ownership.ownerBalance}%`);
console.log(`  Top 10 holders: ${analysis.ownership.top10Percentage}%`);

// Function Analysis
console.log('Functions:');
console.log(`  Can mint: ${analysis.functions.canMint}`);
console.log(`  Can pause: ${analysis.functions.canPause}`);
console.log(`  Can blacklist: ${analysis.functions.canBlacklist}`);
console.log(`  Hidden owner: ${analysis.functions.hiddenOwner}`);

// Trading Analysis
console.log('Trading:');
console.log(`  Buy tax: ${analysis.trading.buyTax}%`);
console.log(`  Sell tax: ${analysis.trading.sellTax}%`);
console.log(`  Max transaction: ${analysis.trading.maxTransaction}`);
console.log(`  Honeypot: ${analysis.trading.isHoneypot}`);

// Liquidity Analysis
console.log('Liquidity:');
console.log(`  Total: $${analysis.liquidity.totalUSD}`);
console.log(`  Locked: ${analysis.liquidity.lockedPercentage}%`);
console.log(`  Lock duration: ${analysis.liquidity.lockDays} days`);

Risk Factors

🔴 Critical (Don't Trade)

Factor	Description
Honeypot	Cannot sell tokens
Unverified contract	Source code not public
Hidden mint function	Owner can create infinite tokens
100% tax on sell	All proceeds go to owner

🟠 High Risk

Factor	Description
Unlocked liquidity	Can rugpull at any time
Owner not renounced	Owner has control
Can blacklist addresses	Owner can prevent selling
Can pause trading	Owner can freeze token

🟡 Medium Risk

Factor	Description
High tax (>10%)	Significant trading fee
Low liquidity (<$10k)	High slippage, easy to manipulate
New contract (<7 days)	Limited track record
Top holder >20%	Concentrated ownership

🟢 Good Signs

Factor	Description
Verified contract	Code is public and audited
Ownership renounced	No centralized control
Liquidity locked (>1 year)	Cannot remove liquidity
Fair distribution	No whale dominance
Established (>30 days)	Track record exists

Automated Checks

Before Trading

import { shouldTrade } from '@universal-crypto-mcp/security';

const decision = await shouldTrade({
  token: '0xTokenAddress',
  chainId: 1,
  maxRiskScore: 50, // Don't trade if risk > 50
});

if (!decision.safe) {
  console.error('⚠️ Token failed safety checks:');
  for (const reason of decision.reasons) {
    console.error(`  - ${reason}`);
  }
  return;
}

// Safe to trade
await swap({ ... });

Continuous Monitoring

import { monitorToken } from '@universal-crypto-mcp/security';

const monitor = monitorToken({
  address: '0xTokenAddress',
  chainId: 1,
  onRiskChange: (newRisk, oldRisk, reason) => {
    if (newRisk > oldRisk) {
      console.warn(`⚠️ Risk increased: ${reason}`);
      // Consider selling
    }
  },
  onLiquidityChange: (change) => {
    if (change.type === 'removal' && change.percentage > 10) {
      console.error('🚨 Large liquidity removal detected!');
      // Emergency sell
    }
  },
});

Common Scam Patterns

1. Fake Token Copies

Scammers create tokens with similar names to popular projects.

// Check if token is legitimate
const isOfficial = await verifyOfficialToken({
  address: '0xTokenAddress',
  expectedName: 'Shiba Inu',
  expectedSymbol: 'SHIB',
});

if (!isOfficial) {
  console.error('⚠️ This is not the official token!');
}

2. Airdrop Scams

Free tokens that steal approvals when you try to sell.

// Never approve or interact with unknown airdropped tokens
const airdrops = await getUnknownTokens('0xYourAddress');

for (const token of airdrops) {
  console.warn(`⚠️ Unknown token: ${token.symbol}`);
  console.warn('  Do NOT approve or try to sell this token');
}

3. Fake LP Lock

Scammers show "locked liquidity" but retain unlock keys.

const lockInfo = await verifyLiquidityLock({
  lpToken: '0xLPAddress',
  locker: '0xLockerContract',
});

if (!lockInfo.verified) {
  console.error('⚠️ Liquidity lock not verified');
  console.error(`  Reason: ${lockInfo.issue}`);
}

Data Sources

We aggregate data from multiple sources:

Contract verification: Etherscan, Sourcify
Token analysis: GoPlus, Honeypot.is, TokenSniffer
Liquidity locks: Unicrypt, Team.Finance, PinkSale
On-chain data: Direct contract analysis