How to Check If a Token Is a Scam Before You Buy (Honeypots, Mint Authority, LP Locks)

Screening a token before you buy is a fixed order of on-chain checks: verify the contract address from the project's own site, confirm ordinary wallets have completed sells so it is not a honeypot, read mint, freeze and upgrade permissions, check whether liquidity is locked or burned and how deep it is, and check holder concentration. Each result describes the contract now; upgradeable code can change it later. The WATS Hot Wallet is self-custodial across EVM chains, Solana and TON, so screening a token stays your call.

Why Token Scams Look Alike Under the Hood

A new token can look convincing from outside — website, chart, a few hundred holders — all cheap to fake or buy. The contract and its pool can be read directly, and the same patterns recur: selling is blocked, supply can be minted or seized at will, one wallet can pull liquidity, or supply sits in a few hands.

Step 1: Verify the Contract Address

Names and tickers are not unique and copycats appear in minutes, so take the address from the project's own site or verified account, paste it into a block explorer, and confirm the deployment and trading pairs match. Verified source is an EVM-specific check: a Solana SPL or Token-2022 mint is a data account with no per-token code to read. Check its owning program, mint and freeze authorities, supply and metadata update authority instead.

Treat addresses from a direct message, ad or comment reply as hostile: those channels also push fake claim pages, where signing starts a wallet drainer attack.

Step 2: Check for a Honeypot (Can You Actually Sell?)

A honeypot is a token you can buy but cannot sell. On EVM the token runs its own transfer logic, so implementations vary: a near-total sell tax, a transfer that reverts unless the sender is allowlisted, a max sell of zero.

Solana differs: as of 2026 a legacy SPL Token mint carries no custom transfer code, so the equivalents are an active freeze authority, or a Token-2022 hook or fee.

On any chain, look for completed sells by ordinary wallets in the pair's history. Scanners automate this by simulating a buy then a sell, but as of 2026 they describe behaviour right now: an upgradeable contract or owner-settable tax can change it later.

Step 3: Read the Contract Permissions

Open the verified source and see what privileged addresses may do: mint supply, pause transfers, blacklist holders, raise fees without a hard cap, or upgrade the token behind a proxy.

On Solana, start with mint and freeze authority: mint authority means supply can be inflated at will, freeze authority means your token account can be frozen, so both revoked to null is the baseline. As of 2026 that is not the whole check: Token-2022 mints can carry extensions — a permanent delegate able to move or burn tokens from any account, a transfer hook, a fee — so read the extension list too.

Renounced ownership is a signal, not a verdict: a proxy or a second un-renounced controller keeps those powers alive.

Step 4: Inspect Liquidity, LP Locks and Burned LP

A token's price comes from the pool it trades against, so whoever controls the pool controls whether an exit exists; see the mechanics of a liquidity pool. Check depth against the claimed valuation, and who controls the position.

On v2-style pools liquidity is a fungible LP token: locked means it sits in a locker until a verifiable unlock time, burned means it went to an address nobody controls. Unlocked LP held by the deployer is the classic rug setup, and an imminent unlock barely differs. Concentrated-liquidity AMMs need one more step. On Uniswap v4 as of 2026 all pool tokens sit in the singleton PoolManager, and a position is only a state entry keyed by owner, tick range and salt; that owner is always a contract, so confirm whether it is the periphery position manager, which wraps the position as an ERC-721, or another contract. A lock also says nothing about range: a narrow band away from market price gives almost no exit depth.

Step 5: Check Holder Distribution and Early Buyers

Concentration is the signal: a few wallets holding a large share of supply can overwhelm the pool in a coordinated exit. Several buying in the deployment block from one funding wallet means a bundled launch.

Strip structural addresses out first: pools, lockers, bridges and the burn address rank high without being anyone's tradable position. Of the rest, one wallet holding several percent of supply, or a top ten near a third, means a single decision moves the price.

Red Flags Checklist and What to Do If You Already Bought

On a new or anonymous launch, treat these as walk-away signals:

• Unverified source, or a needless upgradeable proxy.
• An active mint or freeze authority — though as of 2026 USDC and USDT on Solana keep both by design.
• A Token-2022 permanent delegate; hooks and transfer fees can be legitimate, so read what they do.
• Uncapped or owner-settable taxes, or a blacklist.
• Unlocked LP, an imminent unlock, or a position parked out of range.
• Pool depth trivial next to the claimed valuation.
• Supply concentrated across wallets funded by the same address.

If you already bought, stop adding. A small test sell proves an exit at that size only: caps and dynamic sell taxes pass small amounts while blocking a full exit. Then check what you approved: ERC-20 and Permit2 allowances, Solana delegates. Revoking token approvals kills the standing permission a malicious spender would keep; for Permit2, zero the ERC-20 allowance you gave that contract. Revoking does not cancel a permit signature you already made. ERC-2612 exposes no cancel function, so consume the nonce it was signed against: broadcast your own permit, a zero-value approval to a harmless spender, before that signature's deadline. Permit2's cancels are module-specific, and the wrong one leaves the signature alive: invalidateNonces cancels AllowanceTransfer permits — PermitSingle and PermitBatch — while invalidateUnorderedNonces cancels SignatureTransfer ones. Cancel the signature whatever your ERC-20 allowance to Permit2 is: the attacker can submit an unused PermitSingle later, writing an allowance record with a far-future expiration that revives the moment a future dapp has you re-approve Permit2 for that token. Once submitted, a nonce bump is too late; only lockdown, or your own zero-amount permit for that token and spender, clears that record. A fresh wallet is the fallback. Signing never exposes your private key; only entering a seed phrase or private key does, and then every derived address must be abandoned. Ignore paid recovery offers: a second scam.

Self-Custody and Single-Token Fees in WATS Wallet

The WATS Hot Wallet stays non-custodial: you hold your keys and WATS never holds a key, across EVM chains, Solana and TON. Every action is charged in one token, ATS, instead of each chain's native gas: on EVM through an ERC-4337 paymaster, on Solana and TON through an equivalent fee-payer. That does not lower network cost; it removes the need for a separate gas balance per chain. Collected ATS is burned from 100M toward a 30M floor.