Token safety scanners, what they catch and what they miss
How RugCheck and similar scanners work, which risks they genuinely detect, why a green score proves less than people think, and what to check.
Scanners like RugCheck give a coin a score in about 2 seconds, and plenty of buyers treat that score as the whole diligence process.
Worth knowing what those checks actually cover, because the gap between "passed the scan" and "safe" is where most money disappears.
What they check
Roughly three categories.
Contract properties. Can new tokens be minted? Can the creator freeze accounts? Is there a transfer tax, and can it be changed? Are authorities revoked or still held by somebody?
Liquidity. Is it locked or burned, and if locked, for how long? Can whoever controls it withdraw?
Holder distribution. How concentrated is supply? What share sits in the top 10? Is the creator wallet among them?
All three read directly from the chain, and all three are genuinely useful. A coin that fails them is telling you something real.
What they miss
Everything about intent, which is most of what matters.
A scanner can't see that the creator plans to dump at 80k. It can't see that the 40 holders are one person with 40 wallets, unless the funding pattern happens to be obvious. It can't tell whether the concept is real or whether the team abandons this next Tuesday.
So a green score means the mechanical traps aren't present. It doesn't mean the human is trustworthy, and the human is the risk in the overwhelming majority of cases. What is a rug pull covers the forms that pass every automated check.
Why Pump.fun coins score similarly
Something creators find confusing: nearly every Pump.fun mint gets a similar mechanical score.
That's expected. These coins share standard mechanics, so mint authority, freeze authority and transfer tax are the same across all of them. Scanners have almost nothing to differentiate on at the contract level.
Which means for Pump.fun specifically, the contract section is close to noise. The holder section is where the real information is, and it's the section people skim past because the big green tick at the top already told them what they wanted to hear.
What to actually look at
Skip to concentration, every time.
What share do the top 10 hold? Is one wallet above 10%? Does the creator wallet appear? Are the top holders connected to each other?
That last question is the one scanners handle worst and clustering tools handle well, which is why Bubblemaps and holder analysis is worth 2 minutes alongside any scan.
The false confidence problem
Here's the failure mode worth naming.
Somebody scans a coin, sees green, and treats that as diligence completed. They skip the holder list, skip the creator wallet history, skip checking whether sells actually execute. Then when it goes wrong they conclude the scanner lied, when the scanner reported accurately on the narrow thing it measures.
Automated checks are a filter, not a verdict. They remove obviously broken coins from consideration quickly, which is valuable and is all they claim to do.
For creators
Two practical points if you're launching rather than buying.
Scan your own coin before anybody else does, and look at what a buyer would see. If your holder concentration reads badly, that's information you want on day 1 rather than after somebody posts a screenshot.
And understand that a good score buys you nothing. It's the absence of a red flag, not the presence of a reason. People don't buy coins because they scanned clean; they buy because they found the coin and something about it interested them, which is a completely separate problem covered in the launch checklist.
The 3-minute routine
- Run the scan and glance at the contract section, expecting it to pass
- Go straight to holder concentration and read the top 10
- Check whether those holders are connected to each other
- Open the creator wallet and look at what it has done before
- Confirm sells execute, since a honeypot passes plenty of other checks
If your own coin passes all five and still isn't moving, safety was never the constraint. The console prices sustained activity against a specific window with the full cost shown before anything is signed.
Frequently asked
It means the automated checks passed. Scanners read contract properties and holder data, so they catch mechanical traps and miss everything about intent, which is where most losses come from.
Less than tokens with custom contracts, since Pump.fun mints share standard mechanics. What still varies enormously is holder concentration and creator behaviour, and those are worth checking every time.
The mechanical checks mostly pass automatically on a standard mint. Holder concentration is the part you influence, and you influence it at launch rather than afterwards.
Everything in this guide describes mechanics that settle on Solana mainnet, so you can check any of it yourself. Mint addresses, swap signatures, curve progress and wallet counts are all public, and an explorer will disagree with us if we are wrong.
Curvegrad sells a volume service, and guides that touch on what a campaign does say so in the text rather than in a footnote.
- Solana mainnet transaction history, read through the standard RPC methods
- Pump.fun bonding curve and PumpSwap pool accounts as they appear on-chain
- Public block explorers, where every claim here can be verified against a real mint
- Campaigns run through our own engine, which is where the operational detail comes from