What each risk indicator means — and what it does not mean
Risk flags are informational signals derived from observable on-chain data. They indicate the presence of specific technical conditions that are associated with higher risk in newly launched tokens. A risk flag is not proof of fraud or malicious intent — it is a data observation that warrants additional attention.
The absence of risk flags does not guarantee that a token is safe. Sophisticated actors can structure tokens to avoid triggering automated flags while still posing risks that cannot be detected from on-chain data alone.
When a token's liquidity provider (LP) tokens are not locked, the token creator or any LP holder can withdraw the liquidity from the trading pool at any time. This is the mechanism used in most rug pulls. The moment liquidity is withdrawn, the token price collapses to near zero because there is no longer a counterparty for trades.
Context: Not all unlocked LP is malicious. Some legitimate early-stage tokens have not yet locked their LP. However, unlocked LP is one of the most significant structural risks for any new token.
⚠ Unlocked LP does not prove the token is a scam. It means the creator retains the ability to remove liquidity.
Mint authority is the ability to create new tokens at will. When mint authority is enabled, a specific wallet address can mint additional tokens into circulation at any time. This can dilute existing holders' ownership percentage and devalue the token supply.
Context: Some tokens intentionally keep mint authority for legitimate purposes such as staking rewards or protocol mechanics. However, for most simple tokens, retaining mint authority without a clear and transparent reason is a notable risk indicator.
⚠ Enabled mint authority does not prove bad intent. It means the technical capability exists.
Freeze authority allows a specific wallet to freeze any token account, preventing the account holder from transferring their tokens. If a wallet holding a token is frozen, the holder cannot sell or move those tokens.
Context: Freeze authority exists in the Solana token program primarily to allow compliance with legal requirements in regulated environments. For anonymous token launches with no stated regulatory need, it is a meaningful risk indicator.
⚠ Freeze authority does not prove malicious intent. Many tokens are deployed with default settings that include freeze authority before it is explicitly disabled.
When the top 10 wallets collectively hold a very high percentage of the token supply, the price is vulnerable to significant impact from any single large holder deciding to sell. High concentration also means that a small number of wallets control most of the voting power or governance influence for tokens with those features.
Context: High concentration is almost universal for tokens in the first few minutes after launch, before distribution occurs. Concentration above 80% is more meaningful for tokens that have been live for 30+ minutes and have had time for broader distribution.
⚠ High concentration does not automatically indicate a scam. It can reflect early-stage distribution or legitimate team allocations.
Low liquidity means the trading pool has limited capital. Any trade of meaningful size will move the price significantly (high slippage). Low liquidity pools are also easier for a creator to drain, leaving the token untradeable.
Context: Low liquidity at launch is common and expected. The concern increases if liquidity remains very low after the token has attracted trading activity, or if liquidity is decreasing rather than growing.
⚠ Low liquidity is a market condition, not direct evidence of fraud.
When a token's 24-hour trading volume is many times larger than its liquidity pool, this can indicate wash trading — where the same capital is cycled through buy and sell transactions repeatedly to inflate apparent activity.
Context: A very high volume-to-liquidity ratio is not definitive proof of wash trading. Some tokens experience genuine trading frenzies that result in high turnover. However, ratios above 20× or 30× on a new token with low liquidity are worth noting.
⚠ High vol/liq ratio is one data signal. It requires context from other signals to interpret meaningfully.
RugCheck is an independent platform that aggregates multiple on-chain risk factors into a single score. A high raw risk score from RugCheck means multiple individual risk factors were detected. This platform includes RugCheck's assessment as one of six inputs into the Trust Score.
Context: New tokens frequently receive elevated RugCheck scores simply because they lack historical data and have not yet disabled default authorities. RugCheck scores improve as tokens age and as creators disable authorities or lock liquidity.
⚠ A high RugCheck score does not confirm fraud. It reflects the current state of observable on-chain indicators.
A single risk flag in isolation provides limited information. The more flags that are present simultaneously, the higher the cumulative concern. Consider:
No. The absence of detectable risk flags means the observable on-chain conditions do not show the specific patterns this system monitors. Risks that cannot be detected from on-chain data — such as insider coordination, off-chain deception, or future rug pulls — may still exist.
No. Risk flags reflect the current state of on-chain data at the time of the scan. A creator can disable mint authority, lock LP, or allow holders to diversify after launch. Flags that appear initially may no longer be present hours later.
Individual risk flags are binary observations (enabled/disabled, locked/unlocked). The Trust Score aggregates six weighted factors into a single 0–100 number. Both are derived from the same underlying data.