Before buying any token promoted on social media, run through these checks: verify the contract on a scanner (Token Sniffer, honeypot.is), check holder concentration (top wallet should not hold more than 10%), confirm liquidity is locked and for how long, look for verified source code on Etherscan, and search for the team with verifiable identities. If more than two of these fail, walk away.
How to Spot a Pump-and-Dump (Detection Checklist)
4 min read
The short version
This is the five-minute checklist that could save your entire investment. Every pump-and-dump follows the same pattern: manufactured hype, concentrated ownership, and liquidity that can disappear at any moment. Running these checks takes less time than reading the marketing material, and it catches the vast majority of scams before you send a single dollar.
How It Works
The checklist in order of importance: (1) Contract scanner check: paste the contract address into tokensniffer.com or honeypot.is. If the tool flags sell restrictions, hidden minting functions, or honeypot behavior, do not buy under any circumstances. (2) Holder distribution: check Etherscan holders tab. If the top wallet (excluding known exchange or contract addresses) holds more than 10% of supply, that entity can crash the price at will. (3) Liquidity lock: check if LP tokens are locked (team.finance, Unicrypt, or a timelock contract). If liquidity is unlocked, the deployer can pull it at any moment, taking all paired ETH/USDC and leaving token holders with zero value. Even locked liquidity matters: locked for 7 days is meaningless; locked for 6-12 months minimum provides some assurance. (4) Source code verification: is the contract source published on Etherscan? Unverified source means you cannot read what the contract actually does. Never interact with unverified contracts for trading purposes. (5) Team identity: are the people behind this verifiable? Do they have LinkedIn profiles, GitHub histories, or previous projects you can confirm? Anonymous teams are not inherently scams, but combined with other red flags they dramatically increase risk. (6) Marketing vs. product: is there an actual working product, or just a website and Telegram group making promises? Legitimate projects ship code before marketing heavily. Pump-and-dumps do the opposite.
Running the checklist on a trending token
A token called MOONX is trending on Twitter with influencer posts claiming 100x potential. You run the checklist: (1) Token Sniffer: flags a modifiable tax function in the contract (the deployer can set sell tax to 99% at any time). FAIL. You could stop here, but let us continue. (2) Holders: top wallet holds 42% of supply. FAIL. (3) Liquidity: LP tokens are unlocked, sitting in the deployer wallet. FAIL. (4) Source: contract is verified but contains suspicious functions. PARTIAL. (5) Team: anonymous, Twitter account created 3 weeks ago. FAIL. (6) Product: no working product, just a website with a roadmap. FAIL. Result: 5 out of 6 checks failed. This is textbook pump-and-dump setup. You do not buy. Three days later, the deployer sets sell tax to 99%, drains liquidity, and the token goes to zero. Everyone who bought based on influencer hype lost everything.
What People Get Wrong
If it passed one check, it is probably safe
You need ALL checks to pass, not just one. A token with locked liquidity but a hidden mint function can still rug you (they mint new tokens and sell them). Locked liquidity with concentrated ownership still means the whale can dump. Every check addresses a different attack vector.
Popular tokens on DEXScreener are vetted
DEXScreener, DexTools, and similar sites display any token with trading activity. Being trending means people are buying, which is exactly what the pump-and-dump deployer wants. Trending status is a popularity metric, not a safety endorsement.
This checklist catches everything
Sophisticated scammers can pass most surface-level checks and still rug through more complex mechanisms (upgradeable proxies, delayed malicious upgrades, insider coordination). The checklist catches 80-90% of scams. For the remaining edge cases, additional due diligence (reading the actual Solidity code, checking deployment patterns) is needed.
Keep Reading
Sources & Further Reading
- Token Sniffer
Paste any contract address to check for scam patterns, hidden functions, and honeypot behavior
- Honeypot.is
Simulates buy and sell to detect if a token blocks selling
- RugDoc
Community risk assessments and contract reviews for new DeFi projects
- Etherscan Token Tracker
Check holder distribution, verify source code, and read contract functions
Questions People Also Ask
- How long does this checklist take?
- Under 5 minutes for all six checks. Token Sniffer gives results in seconds. Etherscan holder distribution takes one click. Liquidity lock verification takes 30 seconds on the LP token page. The entire process is faster than reading one promotional tweet thread.
- What if the token passes all checks but I am still unsure?
- If all six checks pass, the token is less likely to be an outright scam, but that does not make it a good investment. It could still be overvalued, have poor tokenomics, or face competition that destroys its value. Passing the scam checklist is the minimum bar, not a buy signal.
- Should I use these tools for every token I buy?
- For any token not listed on major centralized exchanges (Coinbase, Kraken, Binance), absolutely yes. Tokens on DEXs only have zero vetting. Major exchange listings provide some filtering (they check contracts before listing), though even listed tokens can have poor fundamentals. The checklist is most critical for DEX-only tokens promoted on social media.