Honeypot & Rug Pull Checker: token risk scanner for Ethereum, BSC, Base and Solana

Is this token a scam? Paste one or more token addresses or links (Etherscan, BscScan, Solscan, DEX Screener, pump.fun…) and get a 0–100 token risk score with a plain-English summary for each token: a quick token safety check and smart contract risk check. It works as a honeypot checker, a rug pull checker and a scam token checker for Ethereum, BNB Chain, Base, Arbitrum, Polygon, Optimism and Solana. You don't need coding, a wallet or an API key: paste, click Start, download Excel.

⚠️ Heuristic risk indicator only. Not financial advice and not a guarantee. A low score does not mean a token is safe, and a high score does not prove fraud. Always do your own research.

How to use it (no code needed): check a token in 4 steps

1. Fill in the form: paste token addresses or links into Tokens to check, one per line. The chain is detected automatically. The form is already filled in with a working example (PEPE on Ethereum, USDT on BNB Chain, BONK on Solana).
2. Click Start. Each token takes about 2–30 seconds. Note: Start with the pre-filled example is a small paid run: 3 tokens × $0.0075 = $0.0225.
3. Download the results: open the Output tab; the Risk overview shows score, level and summary. Click Export to download Excel, CSV or JSON.
4. Optional: schedule it (see below) to re-check your tokens every hour or every morning.

If none of your entries is a valid address, the run stops with a plain message and nothing is charged.

What you get

Token	Chain	Risk score	Level	Summary	Flags
PEPE	ethereum	0	low	Low risk (0/100) for PEPE on ethereum. Official contract of a well-known token.	–
USDT	bsc	15	low	Low risk (15/100) for USDT on bsc. Official contract of a well-known token.	MINTABLE, OWNER_NOT_RENOUNCED
Bonk	solana	3	low	Low risk (3/100) for Bonk on solana. Official contract of a well-known token.	HOLDER_DATA_UNKNOWN, METADATA_MUTABLE

(These are real rows from a test run with the pre-filled example on 23 Oct 2026, 04:12 Vienna time.) A risky token looks very different. For example, the FNV token on BNB Chain scored 100 / critical with HONEYPOT, UPGRADEABLE_PROXY, UNVERIFIED_SOURCE, NO_LIQUIDITY (the simulated sell reverted). Each row also contains every flag with its severity, points and explanation, plus taxes, liquidity, LP lock, holder concentration, token age, an explorer link and a timestamp (All details view).

Levels: critical ≥ 80, high ≥ 50, medium ≥ 20, low < 20.

Schedule it: automatic rug pull checks

Schedule it daily: save your token list as a task and click Schedule. You can run it every hour or every morning, because contracts can be upgraded and liquidity can be removed after you bought. Connect Telegram, Slack, email or a webhook under Integrations. Or call the Actor from a Telegram/Discord bot for every contract address that gets posted.

Typical uses

• Before you buy: screen a new token (e.g. a pump.fun launch) in seconds
• Communities and bots: check every contract address posted in a group via the Apify API
• Wallets, trackers and newsletters: add a risk column to token lists
• Research: batch-check hundreds of tokens and export them to Excel or Google Sheets

What the token scanner checks (honeypot, rug pull and scam signs)

Check	EVM	Solana
Honeypot: simulated buy → transfer → sell through the main DEX router (Uniswap V2, PancakeSwap V2, QuickSwap and other V2 routers)	✅	–
Buy / sell / transfer tax measured from the simulation	✅	Token-2022 transfer fee
Mintable, pausable, blacklist, fee-changeable, trading toggle, max-tx changeable (bytecode function scan)	✅	mint authority
Freeze authority, permanent delegate, transfer hook, non-transferable/default-frozen	–	✅
Upgradeable proxy (EIP-1967, beacon, legacy OpenZeppelin slot, minimal proxy), owner / proxy admin	✅	metadata mutability
Owner not renounced	✅	update authority
Unverified source code (Sourcify; Blockscout with a key)	✅	–
Liquidity in V2/V3 pools in USD, LP burned / locked (dead address + known lockers)	✅	–
Top-10 holder concentration and largest single holder (pools, bonding curves and burn excluded)	with Blockscout key / Ethereum	✅ smaller tokens on free RPC; all tokens with your own RPC (see below)
Token age	✅	✅ quieter tokens (very active tokens are marked "very active", age not determined)
Impersonation: same ticker/name as a major token but a different address	✅	✅ (top 150 Solana tokens; Jupiter-verified tokens are never flagged)
Launchpad status (still on the pump.fun / LaunchLab / Moonshot / Meteora bonding curve)	–	✅

Official contracts of major tokens (from the Uniswap and PancakeSwap default token lists and the Jupiter verified list) are recognised. Their issuer controls (USDC can be paused, for example) are listed, but the score is capped at low with an explanation.

Token risk score: how it is calculated

Every token gets a token risk score from 0 to 100. Each warning sign found by the checks above adds fixed points, and the score is the sum, capped at 100. Examples: a failed sell in the honeypot simulation (EVM) adds 100, impersonating a major token 50, a sell tax of 50% or more 60 (10% or more: 25), an upgradeable proxy 15, a mint function with an active owner 15, a blacklist function 12, LP tokens not locked 15, top-10 holders owning 80% or more 25, and an active Solana freeze authority 25. Pure information (for example "holder data unknown") adds 0 points. Levels: critical ≥ 80, high ≥ 50, medium ≥ 20, low < 20. For official contracts of major tokens the score is capped at 15 (low); the uncapped value is kept in riskScoreBeforeOfficialAdjustment. Every flag is listed with its code, severity, points and explanation (flags, flagCodes), so you can see why a token scores high. It is a quick token safety check, not a guarantee.

Solana token checker: what you get and how holder data works

Per mint the Actor reads mint and freeze authority, Token-2022 extensions (permanent delegate, transfer hook, transfer fee, default-frozen, pausable), metadata mutability, top holders grouped by owner, holder count (smaller tokens), token age and launchpad status.

Holder data on Solana needs heavy RPC queries that free public endpoints often refuse. The Actor tries the free endpoints and, if they refuse, reports holderDataStatus: "unknown" with an explanation and the flag HOLDER_DATA_UNKNOWN (0 points). It never guesses a value. This is typical for large tokens such as USDC or BONK. For reliable Solana holder data, add your own RPC: in Private RPC URLs (recommended, stored encrypted), add a line such as solana: https://mainnet.helius-rpc.com/?api-key=YOUR_FREE_KEY (Helius and Alchemy have free tiers). The URL is stored encrypted, and only its host name ever appears in the log, status or results. (For a Solana RPC without a key you can also use RPC URLs, not encrypted (optional).) The free Solana Foundation endpoint used as a fallback is not meant for production traffic, so results without your own RPC are best-effort.

Example (fake "PayPal USD" token on Solana, shortened):

{"chain": "solana", "symbol": "PYUSD", "name": "PayPal USD", "riskScore": 100, "riskLevel": "critical",
 "flagCodes": ["HOLDER_CONCENTRATION_EXTREME", "IMPERSONATION", "FREEZE_AUTHORITY"],
 "impersonates": "PYUSD", "holderDataStatus": "ok", "top10HolderPctExclPools": 99.85, "holderCount": 125}

Input fields in plain words

Form field	What it does	Default / example
Tokens to check	One per line. 0x… addresses, Solana mint addresses, bsc:0x…, or explorer/DEX links that contain the address. Extra spaces are removed.	3 example tokens / https://bscscan.com/token/0x0E09…
Chain	Detect automatically (default) or pick a chain. If the token isn't on the chosen chain, the other chains are tried; the row's chainNote column and the run status then say where it was found.	Detect automatically
Max tokens (cost limit)	The run stops here, so you never pay more than you expect.	50 (max. $0.375)
Advanced (optional): Search by name or ticker	Checks the top matches for a name, which helps you spot fake copies of a ticker. This works without a key on Ethereum; other chains need a free Blockscout key.	empty / pepe
Advanced (optional): Max tokens per search term	How many search results to check per name.	5
Advanced (optional): Test a buy and a sell (honeypot and tax test)	Honeypot and tax test with a read-only simulation. No wallet and no gas are needed.	on
Advanced (optional): How far back to look for token age	How far back to look for the token's creation on EVM chains.	3 days
Advanced (optional): Blockscout API key (optional, free)	Optional and free. It adds the exact creation date, holder concentration and verification on all EVM chains. Stored encrypted.	empty
Advanced (optional): Private RPC URLs (recommended, stored encrypted)	Your own RPC with an API key, one per line as chain: URL (ethereum, bsc, base, arbitrum, polygon, optimism, solana), or a bare URL whose address names the chain. Recommended for big batches and for Solana holder data. Stored encrypted; only the host name is ever shown. Lines with an unclear chain are skipped with a note.	empty / solana: https://…?api-key=…
Advanced (optional): RPC URLs, not encrypted (optional)	Same format, stored as plain text. Only for RPCs without a key.	empty / ethereum: https://ethereum-rpc.publicnode.com

Pricing

Pay per result: $0.0075 per token checked, which is $7.50 per 1,000 tokens. On Apify's Scale plan it is 10 % lower ($0.00675 per token, $6.75 per 1,000), on Business and higher plans 20 % lower ($0.006 per token, $6.00 per 1,000). There is no start fee. Failed checks are free: an invalid address, an address with no contract, or an RPC error. If none of your entries is a valid address, the run stops with a plain-English message and nothing is charged.

These are launch prices while the Actor builds its first user base. If prices change, Apify notifies existing users in advance, as its rules require. Platform usage is included in the price.

FAQ and common mistakes

How do I check if a token is a honeypot? Paste its address or explorer link and click Start. On EVM chains the Actor simulates a buy, a transfer and a sell. If the sell fails, the token is flagged HONEYPOT and the summary says so. Buy and sell taxes are measured too.

Is this a rug pull checker for Solana and pump.fun tokens? Yes. On Solana it checks mint and freeze authority, Token-2022 traps, metadata mutability, holder concentration, token age and whether the token is still on a launchpad bonding curve (pump.fun and others). Liquidity and the sell simulation are not assessed on Solana yet.

I pasted an address and got "not a valid address". Copy the full address (42 characters starting with 0x, or a 32–44 character Solana mint). Links from Etherscan, BscScan, Solscan, DEX Screener or pump.fun also work. Invalid entries are free.

I picked the wrong chain. No problem: if there is no token on that chain, the other chains are tried automatically. The chainNote column (e.g. No token contract on ethereum; found and checked on bsc instead.), the summary and the run status say where it was found.

Is a low score a guarantee that a token is safe? No. The score is a risk indicator from on-chain checks at the time of the run. It is not financial advice.

Does the honeypot test cost gas or need a wallet? No. The buy and sell are simulated in a read-only eth_call. Nothing is broadcast.

Why is USDC "low" despite mint/pause/blacklist flags? Official stablecoins have issuer controls by design. The flags stay visible, but the official contract is recognised and the score is capped.

How fast is it? About 2–5 seconds per EVM token and 5–30 seconds per Solana token (the age lookup pages through history). Checks run in parallel, three at a time.

Why is holder data "unknown" for a Solana token? The free public RPCs refused the holder query (common for tokens with many holders). Add your own Solana RPC to get it: a line solana: https://… in Private RPC URLs (recommended, stored encrypted) (privateRpcUrls), or in RPC URLs, not encrypted (optional) (rpcUrls) for an RPC without a key. The check is still charged as a normal check because all other fields are returned; RPC failures that return no result are free.

Which chains? Ethereum, BNB Chain, Base, Arbitrum, Polygon, Optimism and Solana.

Is this a smart contract audit? No. It is an automated smart contract risk check based on public on-chain and API data. It finds common honeypot and rug pull patterns quickly, but it does not replace a manual security audit of the contract code.

Limitations

• The honeypot simulation covers V2-style pools on the main DEX of each chain. Tokens that trade only on V3 or other DEXs show simulated: false.
• Vault, receipt and LP tokens (ERC-4626 and similar) have no DEX pool, so they score high on liquidity flags. That is expected.
• Scam contracts can whitelist simulators, delay a trap, or be upgraded later. Treat the result as a snapshot.
• Solana: liquidity, LP lock/burn and sell simulation are not assessed yet. Holder concentration can be unknown without your own RPC (see above). Token age is not determined for very active tokens.
• Rug pulls that already happened (liquidity removed, price crashed) are not detected as such: the Actor checks contract permissions and holder structure, not price history.
• Impersonation detection compares against a list of major tokens. A copy of a small token is not recognised.
• The score is a heuristic: weights are fixed rules, not a trained model or an audit.
• Holder and wallet addresses are never output, only percentages.

Data sources and terms

• Blockchain data via public JSON-RPC nodes (official chain RPCs first, then PublicNode; on Solana PublicNode and the Solana Foundation public RPC), or your own RPC. On-chain data is public.
• Sourcify (open) for source verification.
• Blockscout (optional, with your own key) for age, holders and verification.
• Token lists: Uniswap default list, PancakeSwap extended list, Jupiter verified list (snapshots, used only to recognise official addresses).

Commercial "token security" APIs (GoPlus, honeypot.is, GeckoTerminal free tier) are not used, because their terms do not allow resale. Each row lists its dataSources.

Related tools from Alpine Data Labs

• Crypto Arbitrage Scanner: price gaps for the same coin across 20 exchanges, with the estimated net spread after fees, as Excel.
• Zefix Scraper: Swiss Company Register: Swiss company lists with UID, legal form and address (Handelsregister Schweiz).
• TED Tenders Scraper: EU public procurement notices and daily tender alerts as Excel.
• Career Page Job Scraper: every open job from Greenhouse, Lever, Workday, Ashby and Personio, plus hiring signals.
• All tools from Alpine Data Labs: no-code data tools for public data, business research and monitoring.

Support

Found a bug, need a field or another chain? Open an issue in the Issues tab of this Actor page. Alpine Data Labs answers there, usually within one working day.

For developers: API, webhooks, Make/Zapier/n8n

You don't need this section to use the Actor. The form and the API take the same input: every form field has a JSON name (for example tokens = Tokens to check, chain = Chain, maxTokens = Max tokens (cost limit), privateRpcUrls = Private RPC URLs), and a JSON input sent via the API, a webhook, a schedule, a saved task or Make/Zapier/n8n gives exactly the same result as the form. Field names, output fields and file names stay stable, so existing workflows and websites that call the Actor keep working. Bots (Telegram, Discord) can call the API for every contract address that gets posted.

Minimal input:

{"tokens": ["0x6982508145454Ce325dDbE47a25d4ec3d2311933"]}

cURL (start a run and get the results in one call; replace <YOUR_APIFY_TOKEN> with your token from Apify Console → Settings → API & Integrations):

curl -X POST "https://api.apify.com/v2/acts/alpine-data~token-risk-scanner/run-sync-get-dataset-items" \
  -H "Authorization: Bearer <YOUR_APIFY_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"tokens": ["0x6982508145454Ce325dDbE47a25d4ec3d2311933"]}'

JavaScript (npm install apify-client):

import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: '<YOUR_APIFY_TOKEN>' });
const run = await client.actor('alpine-data/token-risk-scanner').call({"tokens": ["0x6982508145454Ce325dDbE47a25d4ec3d2311933"]});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Python (pip install apify-client):

from apify_client import ApifyClient
client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("alpine-data/token-risk-scanner").call(run_input={"tokens": ["0x6982508145454Ce325dDbE47a25d4ec3d2311933"]})
print(client.dataset(run["defaultDatasetId"]).list_items().items)

Integrations: Schedules run a saved task automatically (e.g. every morning). Webhooks (Integrations tab → "Run succeeded") send the finished run to your own URL. Ready-made Make, Zapier and n8n modules start the Actor and read its results. AI agents can use it as a tool through the Apify MCP server (mcp.apify.com).

Full example input

{
  "tokens": [
    "0x6982508145454Ce325dDbE47a25d4ec3d2311933",
    "bsc:0x55d398326f99059fF775485246999027B3197955",
    "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263"
  ],
  "chain": "auto",
  "maxTokens": 50
}

The API is forgiving too. "address": "0x…", "network": "BNB Chain", explorer links and "maxItems": 10 all work. An empty input checks the 3 demo tokens (paid like any check: 3 × $0.0075 = $0.0225).

Own RPC URLs in JSON (all three keep working):

• "privateRpcUrls": "solana: https://…?api-key=…\nethereum: https://…" (one string, one URL per line; recommended, encrypted when set in the form or a saved task);
• "rpcUrls": ["solana: https://…"] (list, plain text);
• "customRpcUrls": {"solana": "https://…"} (older object form: one key per chain, aliases such as eth or bnb, a URL or a list of URLs).

If several are given, privateRpcUrls is tried first, then rpcUrls, then customRpcUrls, then the public RPCs. RPC URLs never appear in the log, status message, dataset or key-value store; only the host name is shown (e.g. in error messages).

Built and maintained by Alpine Data Labs. Not affiliated with any blockchain, explorer or launchpad; names are used only to describe supported links and chains.