Token anatomy, rug pulls and honeypots

Wonder

1. What specific on-chain authority allows a creator to create infinite tokens after launch?
2. How does the freeze mechanism transform a standard asset into an inescapable honeypot?
3. Why can a token’s name and image change after you buy it?

Explore

Part IToken anatomy: supply, liquidity, mint and freeze authority

1. Every SPL token on Solana initializes via an `InitializeMint` instruction, which defines the decimals and assigns a `mint_authority`. While pump.fun tokens standardize on six decimals, other issuers choose different precisions. If this authority remains bound to a specific wallet address rather than being set to null, that holder retains the power to create new tokens at any time. This structural feature distinguishes a fixed-supply asset from one subject to unlimited, discretionary inflation.
2. The `freeze_authority` parameter introduces an administrative capability with severe implications for liquidity. If enabled, the authority holder can freeze any user’s token account, rendering their balance unspendable and effectively preventing sales. While this serves compliance functions in regulated environments, it poses a critical risk for decentralized assets held by anonymous teams. A frozen wallet cannot transfer tokens to an exchange or another user, turning the asset into a honeypot where entry is possible but exit is blocked.
3. Liquidity determines whether tokens are sellable at all. On platforms like pump.fun, launched in January 2024 on Solana, tokens begin trading on a bonding curve before migrating to an automated market maker pool when the curve completes. The liquidity provided by the creator or initial buyers forms the mechanism that allows other participants to exit. If this liquidity is not burned or locked, the team retains control of the liquidity provider tokens and can withdraw all paired assets from the pool.
4. A ‘rug pull’ typically involves draining this liquidity or exploiting mint authority. One variant eliminates exit capability entirely by removing the SOL from the pool; another dilutes the asset by inflating supply after attracting buyers. Both mechanisms rely on the retention of administrative keys that a team can give up. The trade-off is clear: retaining these powers allows for future adjustments but exposes holders to unilateral value destruction, while burning them ensures fixed rules but removes all recourse if errors occur.
5. Holder distribution reveals concentration risk independent of contract authority. A token held mostly by the top ten wallets presents a different exit dynamic than one spread across thousands of addresses. Wallets linked to the creator or early insiders can move large positions with significant price impact, especially in thin pools. Scanners analyze this data alongside metadata update authority, which controls whether the name, symbol, and image can be altered post-launch. Mutable metadata lets a token be renamed or rebranded after people have bought it.
6. Verification is a manual process available to anyone with internet access. Open a Solana explorer such as Solscan or Solana Explorer and look up any token’s mint address. Record the `mint_authority` and `freeze_authority` (empty means revoked), the current liquidity in the pool, and the percentage of supply held by the top ten wallets. Tools like RugCheck automate these checks, but understanding the underlying fields lets anyone check what a scanner reports.

Part IIRug pulls and honeypots

7. Liquidity removal is the most direct form of extraction. In an automated market maker, trading occurs against a pool of paired assets held in a smart contract. If the creator retains ownership of that contract or the underlying liquidity provider tokens, they can withdraw the entire pair. Once removed, no counterparty exists for other holders to trade against. The tokens stay in their wallets, but their price becomes undefined because no market mechanism connects buyers and sellers.
8. Mint abuse exploits the authority to create new supply. Many token standards include a mint authority that can issue additional units indefinitely. If this authority is not revoked after launch, the creator can print massive quantities of tokens at zero cost. Selling these newly minted units into an existing pool dilutes the value of every held unit and drains liquidity. This mechanism allows a single entity to control supply expansion, effectively taxing all other holders through inflation.
9. Honeypots trap capital by asymmetrically restricting transfers. On Solana, this is typically achieved through an active freeze authority used after buyers arrive, or a transfer hook that can reject sales. On EVM chains, it often involves sell taxes set to 100% for non-whitelisted addresses or code that reverts sells. Buyers can enter the position, but the exit path is programmatically severed. The developer retains access to their own holdings, which remain unfrozen.
10. The Squid Game token (November 2021, BNB Smart Chain), named after the hit series, exemplified this pattern: its contract let anyone buy but stopped ordinary holders from selling. As buyers piled in and the price soared, the creators cashed out, about $3 million by contemporary estimates, and the price fell to almost zero within minutes. The mechanism was not a bug in the chain’s consensus but intentional logic within the token’s transfer rules.
11. Slow rugs differ from immediate exits by timing. Developers may hold large allocations and sell them gradually over weeks or months, preventing sudden price crashes that would alert others. Alternatively, they may abandon project development entirely while retaining their initial stake. The absence of active maintenance signals disengagement, but the primary risk remains the eventual liquidation of insider holdings against retail liquidity.
12. Careful traders verify several on-chain conditions before interacting with a new token. They check if mint and freeze authorities are revoked or nulled. They confirm whether liquidity is burned (sent to an address without private keys) or locked in a time-lock contract. They analyze holder concentration to ensure no single entity controls excessive supply. Finally, many make a small test sell to see that selling works at all, knowing that a contract whose owner can still change taxes or permissions can block sales later.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• SPL Token Documentation: InitializeMint Instruction
• pump.fun Technical Documentation: Bonding Curve Mechanics
• RugCheck Documentation: Solana Token Safety Metrics
• Chainalysis, Crypto Crime Report (2024)
• Solana Program Library, SPL Token documentation
• Contemporary reporting on the Squid Game token collapse (November 2021)