RugScan
TRANSPARENCY

Method and limits

The only thing that makes a risk score worth anything is being able to see how it was produced. This page sets out what the score is made of, what data it rests on, and what it cannot catch.

HOW THE ARITHMETIC WORKS

Starts at 100

Every token enters with 100 points. Each risk signal found subtracts from it; nothing adds back.

A veto zeroes it

For a token that cannot be sold, the other findings are meaningless. If a honeypot is found the score is zero outright.

Unknown is not clean

An item with no data costs half its weight. Missing information is not read in the token's favour.

PENALTY TABLE
FINDINGMAX PENALTY
Honeypot, cannot sell, or transfer lock
The score is zeroed outright. If the exit is closed the other findings stop meaning anything.
VETO
Mint authority is open
The developer can mint unlimited tokens and dump them.
−25
Owner privileges, or freeze authority on Solana
Reclaim ownership, hidden owner, pause transfers, blacklist.
−20
Liquidity is not locked or burned
An unlocked pool can be pulled at any moment; that is the classic rug.
−20
Top 10 wallets hold more than 50% of supply
The joint decision of a few people sets the price.
−20
A single wallet holds more than 10%
One hand selling is enough to topple the price.
−20
Bundle buy trace
A cluster of 5+ wallets whose balances sit within 15% of each other.
−20
Creator wallet holds a large share
The deploying wallet is sitting on a position convenient for an exit.
−15
Buy or sell tax
Tax above 50% is selling being blocked in practice.
−15
Liquidity under $10,000
A few thousand dollars of selling craters the price.
−15
Collapsed token
Market cap has fallen under $10,000 while many times that traded and the price collapsed. The score is also capped at 20.
−25
24-hour price collapse
A drop over 70% is not volatility, it is a collapse that already happened. Over 85% the score is capped at 30.
−20
Market cap below liquidity
In a healthy token this ratio never drops below 1.
−15
Abnormal volume to liquidity ratio
Volume more than 25× liquidity is usually inflated by bots.
−10
Fewer than 100 holders
With few participants the price moves on one person's decision.
−10
Creator holds no tokens
On a young token, a near-zero creator share means they either never took one or sold it. Only asked on non-established tokens.
−10
Contract unverified, or no site / socials
Anonymity is not a crime on its own, but it compounds with the other signals.
−5
Pool is under 24 hours old
Most rugs happen within the first day.
−5
BANDS
Relatively safe70 – 100

No known critical risk signal. This is not a guarantee, only the absence of the risks that can be measured.

Be careful35 – 69

More than one warning. Read which findings cost points before you go in.

High risk0 – 34

Serious risk signals, or a veto finding outright.

THE ESTABLISHED-TOKEN EXCEPTION

The penalty table was designed for newly launched tokens. An open mint authority and unrenounced ownership on a new token is a serious risk. But the same privileges belong to the MakerDAO protocol in DAI and to Paxos in BUSD; they have sat open for years without being abused. Concentration in the top 10 wallets at that scale is mostly exchange and protocol contracts.

So for tokens that clear measurable thresholds on age, liquidity and holder count, some penalties are reduced. Reduced — not removed. The privilege is still there; it is simply weighted against its history. Every reduction is written out finding by finding in the audit report.

Blue-chip token

All three measures must pass:

pool age ≥ 365 daysliquidity ≥ $1000Kholders ≥ 100K

Established token

All three measures must pass:

pool age ≥ 180 daysliquidity ≥ $250Kholders ≥ 10K
HOW FAR EACH PENALTY DROPSFULL · ESTABLISHED · BLUE-CHIP
Mint authority−25−15−10
Owner privileges−20−12−8
Share held by the top 10−20−14−10
Largest single wallet−20−14−10
Bundle buy trace−20−10—
Liquidity lock−20−14−10

The values are the maximum penalty for that finding; if the finding is merely suspicious (amber), 60% of that figure is deducted instead.

Never softened, at any age
  • The honeypot veto — a token that cannot be sold cannot be sold at any age.
  • Buy and sell tax — a real cost you pay today, which no history softens.
  • Identity and transparency, volume-to-liquidity ratio, pool age, holder count.
HOW BUNDLE DETECTION WORKS

In a bundled buy, one person buys the same amount at the same moment through many wallets. The result is that those wallets end up holding almost exactly equal balances. In organic buying that coincidence does not happen: everyone buys at a different time, in a different amount.

RugScan filters locked pools, exchange and contract wallets out of the holder list, then looks among the remaining personal wallets for the largest cluster whose balances sit within 15% of each other.

3–4 wallets · warning5+ wallets · full penalty (−20)
DATA SOURCES

GeckoTerminal

go to source

The new-pool feed for every chain, with token images. This is what the radar runs on.

DEX Screener

go to source

Price, liquidity, volume, trade counts, pool age, linked site and social accounts.

GoPlus Security

go to source

Honeypot and sell simulation, buy/sell tax, mint and ownership privileges, freeze, blacklist, hidden owner, LP lock, holder distribution.

Etherscan & Helius

go to source

The developer record: who deployed the contract and what that wallet has launched before.

Bubblemaps

go to source

A visual map of money flow between wallets. RugScan links to it directly for every token.

All queries are made from the RugScan server; your browser never connects to these services directly and no API key ever reaches the client.

THE LIMITS, STATED HONESTLY

RugScan does not remove risk, it changes the odds. It never says «this token is safe»; it uses the language of known risk signals.

The developer who sells later

A token with a clean contract, locked liquidity and reasonable distribution can still collapse the day its developer sells. There is no on-chain sign of that beforehand.

The score is a snapshot

If ownership has not been renounced, the rules can change five minutes from now. It shows the state at the moment you ran the scan, not afterwards.

The professional with a fresh wallet

A token launched from a brand-new wallet with no history looks clean in the record. That is why a separate «wallet is two days old, no history» warning exists.

The bonding curve phase

On platforms like pump.fun there is no classic LP pool until the token migrates, so the liquidity lock check gives no meaningful result there.

Ready to audit a token?

Back to the audit desk