Crypto Rug Pull Prevention: Due Diligence Checklist

Meme coins:     Liquidity pull, honeypot (60% of projects rug within 30 days)
DeFi protocols: Governance attack, price manipulation (20% of unaudited protocols)
NFT projects:   Open edition rug (15% of anonymous projects)
Cross-chain:    Bridge rug (rare but catastrophic when it happens)

Week 1: Marketing blitz
  - Twitter account created 2 weeks ago
  - "Poocoin ads" and influencer paid promotions
  - Telegram with 10K+ members (mostly bots)
  - "We're building the ultimate..."
  - Lorum ipsum whitepaper

Week 2: Token launch
  - Presale on PinkSale or similar launchpad
  - 50% of presale goes to liquidity pool
  - Launch with hype

Day of rug:
  - Dev withdraws liquidity from pool
  - OR: Dev mints 100x more tokens
  - OR: Dev calls "pause trading" function
  - OR: Dev sells deployer wallet holdings
  - Token price: -99.9%
  - Total loss: $500K-$10M

□ 1. Smart contract verified on Etherscan/BscScan
□ 2. No "honeypot" functions (can't sell after buying)
□ 3. Liquidity is locked (1 year+ minimum)
□ 4. No malicious functions (pause, blacklist, unlimited mint)
□ 5. Team members doxxed (real identity, social presence)
□ 6. Audit by a reputable firm (not a $50 "audit")
□ 7. Token supply distribution is transparent
□ 8. Liquidity pool is large enough (>$100K for medium cap)
□ 9. No "owner can mint unlimited" function
□ 10. Token ownership renounced OR transferred to timelock/multisig

□ 11. Social channels are active (not just bots)
□ 12. Whitepaper/website is unique (not copied from other projects)
□ 13. GitHub has actual code (not just "private repo")
□ 14. Team has history (previous projects, reputation)
□ 15. Token distribution: top 10 wallets don't hold >50% supply
□ 16. Contract uses OpenZeppelin or similar (not custom/untested)
□ 17. Price chart isn't "only up" (sudden launches are suspicious)
□ 18. Community is critical (allows questions, not banning critics)
□ 19. DEX listing on reputable platforms (Uniswap V3, not "honeypot DEX")
□ 20. Social engagement is organic (check likes/follower ratio)

□ 21. Certik/Hacken/SlowMist audit (top-tier)
□ 22. Insurance coverage (Nexus Mutual etc.)
□ 23. Multiple audits (not just one)
□ 24. Bug bounty program (Immunefi etc.)
□ 25. Timelock on admin functions (4h+ delay)
□ 26. Multisig for treasury (4/7 signers, not 2/3)
□ 27. Public team calls (AMA, Twitter Spaces)
□ 28. Token listed on CoinGecko/CoinMarketCap (not just CMC)
□ 29. Referenced by independent research (Messari, DeFi Llama)
□ 30. You understand the tokenomics (not just "buy and hold")

Score your investment target:

30/30: Safest possible DeFi project (rare — Uniswap, Aave, Lido)
25-29: Strong project, low risk (most reputable protocols)
20-24: Decent project, normal DeFi risk
15-19: High risk, sketchy signals (most new launches here)
10-14: Very high risk, likely rug (most meme coins)
<10: Do not invest. Assume it's a rug pull.

1. Go to CoinGecko → Find the token → Look for "Contract" address
   OR: Find the token on DEX (Uniswap) → Click the token link
   OR: Ask in official community (not Telegram DM!)

2. Paste contract address into Etherscan (or BscScan, Polygonscan, etc.)

Contract tab:
  □ "✔️ Contract Source Code Verified" — must be green
  □ Compiler version is recent (0.8.0+ preferred)
  □ Optimization enabled (normal, shows competence)

If NOT verified:
  ❌ Red flag — don't invest
  ❌ Devs are hiding the code

DANGEROUS functions to look for:
  □ withdrawBalance()        → Dev can drain contract
  □ transferOwnership()      → Can change to any address
  □ blacklist() / _blacklist → Can prevent you from selling
  □ pause() / unpause()      → Can stop all trading
  □ setTaxRate()             → Can set fee to 99%
  □ mint() (public)          → Dev can mint unlimited tokens
  □ burn() (from any address)→ Dev can burn your tokens
  □ _a / _b / _c functions  → Obfuscated function names

SAFE patterns:
  □ Only OpenZeppelin standard functions
  □ noUnchecked: true
  □ Admin functions protected by timelock
  □ Pause only for emergencies, timelock protected

Read function: owner()

  □ Renounced (address(0)): ✅ Safe — no one can change contract
  □ EOA (regular wallet): ❌ DANGER — dev can rug anytime
  □ Multisig (e.g., Gnosis Safe): ✅ Good — needs multiple keys
  □ Timelock contract: ✅ Very good — changes have 4h+ delay

Use: DexCheck, RugDoc, or Unicrypt dashboard to verify LP locks.

Check:
1. % of total supply in liquidity:
   - >80% of supply in liquidity pool = healthy
   - <50% = much higher risk of price manipulation

2. LP lock duration:
   - 12+ months: ✅ Good (team is committed long-term)
   - 3-12 months: ⚠️ Moderate (check team reputation)
   - <3 months or not locked: ❌ DO NOT INVEST

3. Who locked the LP:
   - Locked to a known locker service (Unicrypt, Team Finance): ✅
   - Self-locked to a wallet: ❌ Can unlock anytime

Minimum LP size for medium-cap ($1M-$10M market cap):
  □ ETH mainnet: $500K+ LP
  □ BSC: $200K+ LP
  □ Polygon: $100K+ LP

If LP is smaller than above:
  → Dev can drain the pool easily
  → Price impact is huge (slippage nightmare)
  → DO NOT INVEST

Check: 
  - Does the LP contain ETH/BNB/MATIC (native) or another token?
  - LP with native token = more trustworthy
  - If LP is paired with an unknown token = potential honeypot

Use: Bubblemaps or Etherscan "Holders" tab

Read distribution:
  □ Top 10 wallets < 20% of supply = decentralized
  □ Top 10 wallets 20-50% = centralized (high risk)
  □ Top 10 wallets > 50% = dev controlled (extreme risk)

Look for:
  - Clustered wallets (same fund source → same owner)
  - Dev wallet with 40%+ supply → can rug at any time
  - New wallets (created same day as token) → likely dev controlled

Telegram / Discord:
  □ Member count is organic (check: active chatters vs total members)
  □ Mods are knowledgeable (not just "wen moon" spam)
  □ Criticism is allowed (not instant ban)
  □ Community has been active for 3+ months

Twitter:
  □ Account is 6+ months old
  □ Has organic engagement (likes:followers ratio > 5%)
  □ Verified (not just paid checkmark but has real followers)
  □ Posts consistent content (not just "buy now")

Red Flags:
  ❌ "50,000 members" but only 50 active chatters
  ❌ New account (created last week)
  ❌ All positive engagement, no critical questions answered
  ❌ Mods ban anyone asking "is this a rug?"
  ❌ Twitter followers are mostly bots (check with SparkToro)

Check:
1. LinkedIn/Hashnode/GitHub — does the team exist?
2. Previous projects — did they deliver? Did those projects fail?
3. Domain registration — when was the website domain created?
   (GoDaddy WHOIS lookup)
   If domain <3 months old: ❌
4. Technical capability — does the team have Solidity devs?
   Check their GitHub for code contributions
5. Legal entity — is there a registered company?
   Most legitimate protocols have:
   - Swiss foundation (most common)
   - BVI company
   - US LLC

1. Paste contract address → honeypot.is
   → If "Can Sell: NO" = DON'T INVEST

2. Paste contract address → TokenSniffer
   → Score < 70 = DON'T INVEST

3. Go to DexScreener → Check liquidity
   → If LP < $200K = DON'T INVEST

4. Go to Bubblemaps → Check holder distribution
   → If cluster holds > 30% = DON'T INVEST

5. Check team on Twitter/Discord
   → If anonymous + new account = DON'T INVEST

6. If ALL checks pass → Consider a small investment
   (Never more than 2% of your portfolio in any single new project)

1. DO NOT send more money to "recovery services"
   - 99% of rug recovery services are SCAMS
   - No one can recover on-chain funds (that's the point of crypto)

2. Document everything
   - Screenshots of the website, Twitter, Telegram
   - Transaction hashes of your purchases
   - Any communication with the team

3. Report to authorities (if >$10K loss)
   - FBI IC3 (US): ic3.gov
   - Action Fraud (UK): actionfraud.police.uk
   - Local cybercrime unit

4. Check if there's a trace
   - Dev may have used a centralized exchange (CEX) at some point
   - CEX KYC can identify dev
   - Law enforcement can subpoena CEX
   - Real world: recovery rate is <5%

□ Never invest more than you can afford to lose
□ Never invest in projects with <5 days of community activity
□ Never trust "audited by" — verify it's a real audit
□ Always check liquidity lock before buying
□ Wait 2 weeks after launch before investing (90% of rugs happen in first week)
□ If something feels wrong: it probably is