Meme Coin Rug Pull Checker: How to Check an ETH Token Before You Buy

By Merunas Grincalaitis, founder of MEV DAO and a developer who builds MEV, sniping and trading bots on Ethereum. Last updated: Oct 30, 2026.

TL;DR: No rug pull checker can tell you a meme coin is safe. What a checker can do is show you the ways the deployer could still take your money. On Ethereum I look at five things before buying: whether the liquidity is locked or burned, what the owner can still do (mint, pause, blacklist, change taxes), whether a test sell works, how concentrated the holders are, and how the deployer wallet behaved on earlier tokens. Free tools like GoPlus, honeypot.is and Token Sniffer cover most of this in a minute, and Etherscan covers the rest.

I build sniper bots, so I see a lot of brand-new tokens in their first blocks. Most of them never become anything, and a meaningful share were built to take money from the people who buy them. Researchers who studied Uniswap V2 in 2020 flagged more than 10,000 scam tokens, roughly half of all tokens listed there in their dataset, and found that 37% of the scam pools had their liquidity pulled within an hour. That's the environment a meme coin buyer is walking into.

What is a rug pull on a meme coin?

A rug pull is when the people behind a token take the money buyers put in and leave the token worthless. Chainalysis counted more than $2.8 billion taken in rug pulls in 2021, although about $2 billion of that was one centralized exchange (Thodex), not a meme coin.

On a decentralized exchange like Uniswap, a meme coin trades against a liquidity pool: a smart contract holding the token on one side and ETH (WETH) on the other. When you buy, your ETH goes into that pool. Whoever controls the pool's liquidity, or controls the token contract, can get that ETH out. There are three common ways:

Rug type	What happens	What a checker looks for
Liquidity pull	The deployer removes the liquidity and walks away with the ETH side of the pool	Who holds the LP tokens or LP NFT, and whether they're locked or burned
Contract backdoor	The owner mints new tokens, changes balances, raises the sell tax or pauses trading, then sells or traps you	Mint function, owner powers, modifiable tax, pause, blacklist, proxy
Dev or insider dump	Insiders hold a large share of supply and sell into the buyers	Top holders, deployer and team wallets, fresh wallets funded by the deployer

A honeypot, a token you can buy but can't sell, is a cousin of the rug pull. I covered it separately in how to spot a honeypot token before you buy.

How do you check if a meme coin is a rug pull?

Run the token address through two automated checkers, then confirm the liquidity and the owner yourself on Etherscan. The automated part takes a minute. Here are the steps I follow, in order.

Get the real contract address. Copy it from the project's own channel or a pool page, never from a reply or a DM. Fake copies with the same name and symbol are everywhere.
Run an automated scan. Paste the address into GoPlus (or a wallet or bot that uses its API), honeypot.is and Token Sniffer. Note any red flags.
Check the liquidity. Find the pool on DEXTools or Dexscreener, then look at who holds the LP position (details below).
Check the owner. On Etherscan, open the contract's "Read Contract" tab and look at owner(). Then read the verified source for functions only the owner can call.
Check holders. Open the token's "Holders" tab. Look at the top 10 and exclude the pool and known burn addresses.
Check the deployer. Click the contract creator address and see what else it deployed and what happened to those tokens.
Decide on size. If anything is unclear, either skip it or treat the buy as money you are ready to lose.

Is the liquidity locked or burned?

Liquidity that is burned can't be removed by anyone. Liquidity that is locked can't be removed until the lock ends. Liquidity held by a normal wallet can be removed at any time. That one fact decides whether a liquidity pull is possible.

How you check it depends on the pool type:

Uniswap V2-style pools: adding liquidity mints ERC-20 LP tokens, and burning them returns your share of the pool (Uniswap V2 docs). Open the pool address on Etherscan, then the LP token's holders. If nearly all of it sits at the zero address or 0x...dEaD, it's burned. If it sits in a locker contract such as Team Finance or UNCX, check the unlock date on the locker's own page.
Uniswap V3 and V4 pools: positions are NFTs, not ERC-20 tokens (NonfungiblePositionManager docs). You need to find who owns the position NFT. GoPlus returns this for V3 pools in its lp_holders field, with an NFT_list for each holder (GoPlus response docs).

A lock that ends next week is barely a lock. And a burned LP doesn't protect you from the contract: an owner who can mint can sell new tokens into the pool and drain the ETH without touching the liquidity.

What can the token owner still do?

Check what the owner can change after launch, because every owner power is a way to take your money later. GoPlus documents the ones that matter, and they line up with what I look for when I read a contract:

Owner power	GoPlus field	Why it matters
Mint new tokens	`is_mintable`	Owner can create supply and dump it into the pool
Change balances	`owner_change_balance`	Owner can set your balance to zero
Change taxes	`slippage_modifiable`	Sell tax can go to 100% after you buy
Pause transfers	`transfer_pausable`	Owner can stop everyone except themselves from selling
Blacklist	`is_blacklisted`	Owner can block your address from trading
Reclaim ownership	`can_take_back_ownership`	"Renounced" ownership can come back
Hidden owner	`hidden_owner`	Someone keeps control after "renouncing"
Proxy contract	`is_proxy`	The code can be swapped for a new version

"Ownership renounced" means owner() returns the zero address. It's a good sign, but only if the contract has no hidden owner, no reclaim function and isn't a proxy. GoPlus explains that with no owner, owner-only functions such as minting usually can no longer be called, which is why renouncing matters at all.

Also check whether the source is verified. GoPlus warns that closed-source contracts can hide unknown mechanisms and treats them as high risk, and most of its other checks return nothing for them. I don't buy unverified contracts, full stop.

Anti-bot features like trading delays and launch taxes aren't automatically scams; I explained them in anti-snipe token launches: taxes, blacklists and trading delays. The question is whether the owner can turn them back on after launch.

Who holds the supply?

If a few wallets you can't explain hold a large share of the supply, they can crash the price whenever they want. On the Holders tab, ignore the pool address, burn addresses and known lockers. Then look at what's left.

The pattern I watch for is a cluster of fresh wallets that each hold a similar share, all funded with ETH from the same source shortly before launch. That's usually one person spreading supply to make the holder list look healthy. The Uniswap study found the same thing at scale: in 93% of the scam pools it examined, the creator or wallets working with them traded the token to pump the price before pulling out.

How do you check the deployer wallet?

Look at what the deployer did before, because many scammers repeat themselves. On the token's Etherscan page, click the creator address and look at its earlier contract creations. If it deployed ten tokens last month and each one had its liquidity removed within a day, you have your answer.

The researchers used this same link between creators and their earlier tokens to find more scams, and you can do a small version of it in two minutes. Also check where the deployer got its ETH. Funding from a mixer minutes before deployment isn't proof of a scam, but it's a warning.

Which rug pull checkers are worth using?

Use at least two, because each one misses things the others catch. Here's how the free ones compare for Ethereum tokens:

Tool	What it does well	Limits
GoPlus Security	Detailed contract and LP data, also available as an API that many wallets and bots use	Returns little for closed-source or proxy contracts
honeypot.is	Simulates a buy and a sell to show real taxes	A test sell can pass while the owner can still change taxes later
Token Sniffer	Quick score plus a list of contract issues and similar-contract matches	A score is a summary, not a verdict
De.Fi Scanner	Contract risk scan across many chains	Same blind spots as other static scanners
DEXTools / Dexscreener	Pool age, liquidity, trades and lock info in one place	Shows market data, doesn't read the contract deeply
Etherscan	The source of truth: code, owner, holders, deployer history	Manual, so you need to know what to look for

A clean score from any checker means "nothing obvious was found," not "safe." Checkers read the code at one moment. They don't know the team's intentions, and they can't see a dev who simply sells a big unlocked wallet.

How does a sniper bot check for rug pulls automatically?

A good sniper bot simulates the buy and a sell against the latest block before it sends anything, and refuses the trade if the numbers look wrong. In my own bots, every snipe first runs on a local fork: buy, then sell, then compare the ETH that comes back against the expected taxes. If the sell reverts or the tax is above a limit, the bot skips the token. I described that setup in Ethereum sniper bots with Flashbots and in anti-snipe token tax and blacklist detection for snipers.

Simulation catches honeypots and hidden taxes when you buy, but not an owner who mints or pulls unlocked liquidity an hour later.

Frequently asked questions

Is there a free rug pull checker for Ethereum?

Yes. GoPlus, honeypot.is, Token Sniffer and De.Fi Scanner all have free web checks for Ethereum tokens. Use at least two and confirm the liquidity and owner on Etherscan yourself.

Does locked liquidity mean a token can't rug pull?

No. Locked liquidity stops a liquidity pull until the lock ends, but the owner can still mint and dump, raise the sell tax or pause trading if the contract allows it. Check the contract's owner powers as well as the lock.

What does "LP burned" mean?

It means the LP tokens were sent to an address nobody controls, like the zero address or 0x...dEaD, so the liquidity can never be withdrawn. On Uniswap V3 and V4 the position is an NFT, so check who owns that NFT instead.

Is renounced ownership safe?

It's a good sign only if the contract has no hidden owner, no function to reclaim ownership and isn't an upgradeable proxy. Check those three things before you trust it.

Can you get your money back after a rug pull?

Usually not. The funds are on-chain and can be traced, but recovery needs law enforcement or an exchange freezing the funds. Be very careful with anyone who offers to recover it for a fee, since recovery scams target rug pull victims.

Most rug pulls I see aren't clever; they rely on people buying in the first minutes without looking. At MEV DAO, these checks run inside the sniper before every buy, and I share what I find with members of the group. If you'd like more guides like this one, you can subscribe here.