Ethereum Meme Coin Risk Checklist

Meme coins are the most adversarial corner of the crypto market: thousands launch every week, most go to zero, and a meaningful fraction are engineered scams rather than failed jokes. This checklist turns the known attack patterns — documented by security researchers and blockchain forensics firms — into concrete checks you can run in minutes before ever touching a token.

Why Meme Coins Need a Different Due-Diligence Process

A meme coin has no cash flows, no protocol revenue, and usually no product. Its price is a pure function of attention and supply mechanics, which means the entire risk analysis collapses into three questions: Can the contract cheat you? Can the liquidity disappear? Can a small group dump on you? Everything in this guide is one of those three questions in disguise.

The scale of the problem is well documented. Chainalysis measured total crypto scam revenue at $7.7 billion in 2021, with rug pulls accounting for $2.8 billion — 37% of scam revenue, up from just 1% the year before. Academic work has found the same pattern at the long tail: a 2023 study of "trapdoor" tokens on Uniswap built a dataset of roughly 30,000 tokens and concluded that malicious tokens which let users buy but prevent selling cost investors billions of dollars between 2020 and 2023. And the numbers have kept growing: Chainalysis's 2026 Crypto Crime Report puts losses to crypto scams and fraud at about $17 billion in 2025, as covered by CoinDesk, with impersonation scams up roughly 1,400% year over year. This is not an edge case; it is the environment. You can watch the sector's volatility in aggregate on our meme coins dashboard.

1. Contract Risks

The token contract is law. Whatever it permits, someone will eventually do. Security scanners such as GoPlus — whose token security API runs more than 30 checks across contract, trading, and information security — automate most of this section, but you should understand what each flag means.

Verified source code

On Etherscan, a verified contract shows human-readable source under the Contract tab. Unverified bytecode is an immediate disqualifier for a new meme coin: there is no legitimate reason to hide the code of a joke token, and you cannot check any of the items below without it.

Ownership and renouncement

Most token contracts have an owner address with privileged functions. If ownership is renounced (transferred to the zero address), those privileges are gone forever — the owner can no longer change taxes, pause trading, or edit blacklists. That is genuinely protective, but narrow: renouncement does nothing about tokens the deployer already holds, liquidity that is not locked, or malicious logic that runs without owner input. Beware also of hidden ownership, a pattern GoPlus explicitly screens for, where control is retained through a secondary address after a public "renounce."

Mint functions

If the contract can create new tokens after launch, the supply cap is fiction. A deployer with a mint function can inflate supply at will and sell it into the pool, draining value from every holder. The trapdoor-token study lists unauthorized minting among the standard fraud mechanisms. Check the source for mint capability and whether it is owner-gated, and prefer tokens where minting is impossible.

Fee and tax functions

Many meme contracts tax buys and sells. Two things matter: the current rate, and whether it can change. A modest fixed tax is a (questionable) design choice; a modifiable tax is a loaded gun — an owner who can raise the sell tax to 100% has built a switchable honeypot. GoPlus reports both "buy/sell tax" and "tax can be modified" as distinct flags for exactly this reason.

Honeypot patterns

A honeypot lets you buy but not sell. The documented mechanisms, per the Uniswap trapdoor research, include blacklist functions that block selected addresses from transferring, fake balance manipulation (your balance displays but cannot move), hidden fees that consume the proceeds of any sale, and transfer conditions only the owner can satisfy. Warning signs visible from outside the code: a chart with many buys and almost no sells, and only a handful of wallets — typically the deployer's cluster — ever successfully selling, a red flag also highlighted in Trust Wallet's honeypot guide.

Proxy upgradability

A proxy contract delegates its logic to an implementation contract that can be swapped. For a DeFi protocol, upgradability can be legitimate engineering; for a meme coin it means the code you audited today can be replaced tomorrow — a benign token can become a honeypot after you buy. GoPlus flags proxy status as a contract-security item. Treat an upgradable meme coin as unreviewable.

Pausable trading and other owner switches

Functions that let the owner pause trading, set maximum transaction sizes, or toggle whitelists give insiders unilateral control over who can exit and when. "Suspension of trading" is another standard scanner flag. Any switch that can stop you from selling should be assumed to eventually be used that way.

2. Liquidity Risks

Meme coins trade on automated market makers (Uniswap and its descendants), where a pool holds both the token and ETH (or a stablecoin). Whoever deposits that liquidity receives LP tokens — claim checks that can withdraw the pool's contents. If you are new to how pools and slippage work, read Token Liquidity Explained first; the mechanics below assume it.

How a rug actually works

The classic hard rug is mechanically simple: the deployer provides initial liquidity, keeps the LP tokens, waits for buyers to swap ETH into the pool, then redeems the LP tokens — withdrawing both sides of the pool, including everyone else's ETH. The token still exists, but with no pool there is no price and no exit. Chainalysis's analysis of 2021's rug pulls notes the telltale precondition: the deployer address "was already in possession of the vast majority of the liquidity provider tokens for that pool." Variants include the soft rug (insiders slowly sell a huge allocation into the pool rather than removing it) and the tax-switch rug (liquidity stays, but the exit door is taxed shut).

Locked and burned liquidity

The defense is making LP withdrawal impossible or delayed:

• Burned LP: LP tokens sent to a burn address can never be redeemed — the liquidity is permanent. This is the strongest configuration.
• Locked LP: LP tokens deposited in a third-party time-lock contract cannot be withdrawn until an unlock date. Protection is real but temporary — check how much of the LP is locked (95% locked with 5% free still allows meaningful extraction) and until when.

Verify rather than trust: on the pool's LP token page on Etherscan, the Holders tab shows exactly who holds the LP supply — a burn address, a recognizable locker contract, or the deployer's wallet. Scanners like GoPlus report "liquidity lock situation" and "primary LP token holders" automatically. A short lock expiring soon functions as a countdown to a possible rug: unlock dates are events you must diary, not footnotes.

Liquidity depth

Even honestly locked liquidity can simply be too thin. A token with a large market cap resting on a small pool collapses on any real sell pressure, and thin pools are where the worst slippage and sandwich-attack losses happen. Compare the pool size to the market cap before assuming you can exit at anything near the quoted price.

3. Holder Distribution

Concentration is the dump risk. On the token's Etherscan Holders tab — ranked by quantity and percentage, as described in Etherscan's documentation — work through:

• Top-10 share, correctly computed. Exclude the liquidity pool, burn addresses, and locker contracts, then ask what share of the remaining supply the top ten private wallets control. For a meme coin, a double-digit percentage in a few discretionary wallets means a small group decides the chart.
• Sniper and bundler clusters. Inspect the first minutes of the Transfers tab. Wallets that bought in the launch block or the first few blocks — especially many fresh wallets funded from one source just before launch — are a coordinated cluster holding cheap supply. Launches where insiders bundle their own buys into the deployment itself concentrate enormous sell pressure behind a distributed-looking holder list.
• Team allocations and deployer balance. How much supply did the deployer keep or distribute to associated wallets? Is anything vested or time-locked, or is it all liquid? An unlocked 20% "marketing wallet" is a dump waiting for a candle.
• Deployer history. Click through the deployer address: serial deployers with a trail of dead tokens are running a production line, not a community. This is the same wallet-forensics skill covered in our whale tracking guide, pointed at insiders instead of investors.

4. Verification Tools

Run every candidate token through several independent checkers — they catch different things, and all are free:

• Etherscan contract verification: confirm source is verified, read the code (or search it for mint, blacklist, pause, setTax function names), and use the Holders tabs of both the token and its LP token as described above.
• honeypot.is: simulates an actual buy and sell of the token (Ethereum, BSC, Base) and reports whether the sell succeeds plus effective taxes. Heed its own disclaimer: "Just because it's not a honeypot now, does not mean it won't change!" — a modifiable contract can turn hostile after the check.
• Token Sniffer: automated audit that scores tokens 0–100 by testing code and on-chain behavior against a large database of known scam patterns, covering mints, transfer restrictions, holder concentration, and liquidity status.
• GoPlus: the token security API behind many interfaces' warning badges; its 30+ checks span contract security (unverified source, proxy, mint, ownership), trading security (honeypot, taxes, tax mutability, blacklists, trading suspension), and info security (holder and LP concentration, lock status, token authenticity).
• DEX Screener / DEXTools: chart and pair explorers that surface the market-structure view — pool size and age, buy/sell transaction balance, unique makers, and integrated security flags. A chart with hundreds of buys and near-zero sells is a honeypot signature visible without reading any code.

Order of operations: any hard fail (honeypot result, unverified code, unlocked LP held by deployer) ends the analysis immediately. Soft warnings accumulate — two or three yellow flags on a token with no track record is a pass in practice.

How the scanners compare

No single tool covers everything, which is why the workflow above runs several. This table summarizes what each one actually does and where it stops:

5. Social Red Flags

The off-chain layer scams the same way the contract does, just with people instead of code:

• Guaranteed-gain language. Unrealistic promises of high returns with minimal risk are the most consistent scam marker across every security writeup, including Trust Wallet's.
• Fake endorsements and paid shills. Celebrity "backing" that exists only in the project's own graphics, or waves of identical influencer posts appearing simultaneously.
• Manufactured urgency. Countdown mechanics, "last chance before CEX listing," presale FOMO — pressure to skip exactly the checks on this page.
• Closed or censored channels. Telegram groups with comments disabled or where questions about liquidity locks get users banned.
• Anonymous serial teams. Anonymity alone is normal in crypto; anonymity plus a fresh domain, stock-art site, and a deployer wallet full of dead launches is a pattern. Chainalysis's baseline advice applies: be skeptical of projects lacking a real website or documentation, and of pseudonymous developers with no history.
• Name hijacking. Scam tokens impersonate trending names — verify the exact contract address from multiple independent sources rather than searching by ticker (GoPlus calls this check "token authenticity").

6. Documented Scam Patterns

The patterns above combine into a few recurring playbooks, all documented in the sources for this article:

• The hard liquidity rug. Hype, inflow, LP withdrawal, exit. The 2021 case of AnubisDAO — raised roughly $60 million and emptied within about 20 hours of launch, per Chainalysis — shows the timescale: hours, not weeks.
• The honeypot / trapdoor. Buys work, sells revert or are taxed away; the chart only rises because no one can sell. The arXiv study found this class industrialized across Uniswap, with detection tools playing catch-up against novel code patterns.
• The tax switch. Launches clean, passes scanners, then the owner raises the sell tax or flips a blacklist once volume peaks. Enabled entirely by non-renounced ownership plus modifiable-fee code.
• The slow rug. Nothing dramatic on-chain — insiders holding a dominant allocation simply sell into every rally until the pool is drained. Only holder-distribution analysis catches this in advance.
• The relaunch mill. The same deployer cluster ships token after token, extracting from each briefly before abandoning it. Deployer history is the tell.

Note what is absent from this list: none of these require hacking anything. They are all features of the contract or the distribution, visible in advance to anyone who checks. That asymmetry — the trap must be built before it springs — is why a checklist works at all. It is also why the broader market context matters: a token pumping on our live bubble map tells you about attention, not integrity — momentum is not a safety signal, and scam tokens frequently have spectacular short-term charts precisely because sells are suppressed.

The 2026 Landscape: Launchpads and Industrial-Scale Fraud

The biggest structural change of the past two years is that meme coin creation became a factory process. Bonding-curve launchpads — Pump.fun on Solana, and EVM equivalents such as Clanker on Base, surveyed in Coin Bureau's 2026 launchpad overview — let anyone deploy a tradeable token in under a minute for a few dollars. Price starts on an automated bonding curve (each purchase pushes the price up mechanically), and if the token attracts enough buying it "graduates" to a real DEX pool that the platform creates and locks automatically.

The output is staggering, and so is the failure rate. Solidus Labs counted more than 7 million tokens deployed on Pump.fun with at least five trades between January 2024 and March 2025 — of which only about 97,000, under 1.5%, still held more than $1,000 of liquidity, a finding The Defiant summarized as roughly 99% of launches ending as pump-and-dumps or rugs. The same report found about 93% of examined Raydium liquidity pools showed rug pull or pump-and-dump characteristics, with a median rug value of only $2,832 — fraud has shifted from occasional big heists to millions of tiny, automated extractions.

Honeypots industrialized in parallel. In a single quarter (Q4 2024), GoPlus detected 67,241 honeypot tokens across Ethereum, BNB Chain, and Base — about 54,000 of them on Base, the low-fee Ethereum L2 where deployment costs cents — while rug pull incidents on Ethereum and BSC caused roughly $45 million in losses over the same period (about $44 million of it on Ethereum). Meanwhile the social layer got harder to read: Chainalysis's 2026 report documents a ~1,400% rise in impersonation scams and finds AI-enabled scams about 4.5x more profitable than traditional ones — meaning polished websites, fluent communities, and "verified" personalities are now cheap to fake at scale.

What does this change for the checklist? On a launchpad token, the liquidity items (8–9) often pass automatically because the platform contract creates and locks the pool. That makes the distribution items decisive: sniper and bundler clusters in the first blocks, common funding sources behind the top wallets, and the deployer's history across previous launches. The trap moved from the pool to the holder list — check accordingly.

Case Studies from the 2025 Cycle

LIBRA: the $251 million endorsement rug (February 2025)

LIBRA launched on February 14, 2025 and was promoted within hours by Argentine President Javier Milei as a project to fund small businesses. It touched a multi-billion-dollar valuation almost immediately — DL News's timeline traces a peak around $4.5 billion — before insider wallets, which had sniped enormous supply at launch, pulled liquidity and dumped. Roughly $251 million was lost across about 114,000 wallets. Investigations continued into 2026: CoinDesk reported in April 2026 that call logs from the federal probe link Milei to a key figure behind the launch on the night it happened. Every red flag in this article was present and visible on-chain before the collapse: fresh insider wallets holding dominant supply, launch-block sniping, and manufactured urgency driven by a single endorsement.

TRUMP: concentration without a rug (January 2025)

The TRUMP token, launched days before the January 2025 US presidential inauguration, is the instructive opposite: not a technical rug — liquidity stayed — but a masterclass in why holder distribution is a risk of its own. 80% of supply was allocated to insider entities under vesting schedules, with insiders later agreeing to extend their lockups, per CNBC. By May 2025, chain data reported by CNBC showed 58 large wallets had made millions each while roughly 764,000 mostly small wallets had lost money, and creator-linked wallets had collected over $320 million in trading fees. The token later fell more than 90% from its January peak. Checklist lesson: items 11 and 15 (concentration and social conduct) can fail catastrophically even when items 1–10 all pass.

Both cases happened to launch on Solana, but nothing about them is chain-specific — the identical mechanics run daily on Ethereum mainnet and Base, just usually with smaller numbers. The playbooks travel; so does the checklist.

Where the Risk Concentrates: Mainnet vs Base vs Everywhere Else

The checklist is chain-agnostic, but the threat mix is not. On Ethereum mainnet, deployment and trading cost real gas, which filters out the microcap spam flood; mainnet meme coins skew older and larger, and the characteristic risks shift toward the slow rug, the tax switch, and unlock-date events on tokens that have been around long enough to build trust. On Base and other low-fee L2s, deploying costs cents — which is exactly why GoPlus found roughly 54,000 of its 67,241 Q4 2024 honeypot detections there. Cheap blockspace makes the relaunch mill economical: the same operator can ship dozens of trap contracts a day and profit even if each one catches only a handful of buyers. On launchpad-dominated chains the liquidity rug is largely engineered away and the risk concentrates almost entirely in sniping, bundling, and coordinated dumping.

Practical implication: weight your ten minutes differently per venue. On mainnet, spend longest on holder distribution and unlock calendars; on Base, treat the honeypot simulation as the single most important check and re-run it before any additional buy; on launchpad tokens, go straight to the first-block buyer list. Same checklist, different emphasis.

After the Buy: Approvals and Wallet Hygiene

The checklist protects the purchase decision, but meme coin communities are also where wallet-level attacks concentrate, and those bypass token diligence entirely. Two habits close most of the gap:

• Audit your token approvals. Swapping on a DEX requires granting a contract permission to spend your tokens, and interfaces historically requested unlimited allowances. A malicious or later-compromised contract with a standing approval can drain that token without any further signature from you. Periodically review and revoke allowances with a checker such as Etherscan's Token Approval Checker, especially approvals granted to obscure routers during a meme-coin session.
• Assume the community channels are hostile. Chainalysis's finding that impersonation scams grew ~1,400% into 2025 lands hardest here: fake "support" accounts, fake claim sites, and drainer links dressed as airdrops swarm every trending token's replies and Telegram. No legitimate project asks for your seed phrase or needs you to "validate" your wallet. The token can pass every check on this page while its comment section robs you.

Keep meme-coin activity in a separate hot wallet holding only what that activity needs. Then a mistake — a bad approval, a signed drainer transaction — costs a compartment, not a portfolio.

How Meme Coin Scams Evolved: 2021 to 2026

Stepping back, the sources in this article sketch a clear five-year arc. What changed in each era was the distribution machinery — how tokens reach victims — while the underlying traps stayed remarkably constant:

Two lessons fall out of the table. First, every era's "innovation" is marketing and logistics; the traps themselves — pull the pool, block the sell, dump the allocation — are the same three moves this article opened with, which is why a checklist written around those moves keeps working. Second, the direction of travel is more tokens, smaller extractions, better production values. The median scam of 2026 is not a $60 million heist; it is a $3,000 rug repeated thousands of times a week, wrapped in AI-written community management that would have passed for a well-run project in 2021. Volume and polish are precisely the two things a mechanical checklist is immune to.

The Checklist

Every check, in one table. "Where to look" assumes Etherscan plus the scanners from section 4.

One hard fail on items 1–8 should end the analysis. Multiple soft warnings elsewhere should too. And a perfect score still leaves you holding an asset whose only fundamentals are attention — for the broader mechanics of how DEX trading and pools work under all of this, see Ethereum DeFi Explained.

A Ten-Minute Walkthrough

The table looks long, but in practice the whole audit runs in about ten minutes once the tools are bookmarked. Here is the sequence, with a time budget for each stage:

1. Minute 0–1: pin down the address. Get the contract address from at least two independent sources (the project's own site plus a listing site or DEX pair page) and confirm they match. If you cannot establish a single canonical address, stop — ticker-impersonation is exactly how wrong-token buys happen.
2. Minutes 1–3: batch the scanners. Paste the address into honeypot.is and Token Sniffer, and check the GoPlus flags surfaced on your DEX screener of choice. Any hard fail — sell simulation fails, unverified source, honeypot flag — ends the audit at minute three. Most candidates die here, which is the point: the scanners exist to spend seconds, not minutes, per token.
3. Minutes 3–5: read the contract page. On Etherscan: source verified? Ownership renounced or active? Search the source text for mint, blacklist, pause, and tax-setting function names. Note whether the contract sits behind a proxy.
4. Minutes 5–7: audit the liquidity. Open the LP token's Holders tab: what share is burned or in a recognizable locker, and when does the lock expire? Cross-check pool depth against market cap on the pair page — write the unlock date down if you go any further.
5. Minutes 7–9: audit the holders. Token Holders tab: recompute top-10 concentration excluding the pool, burns, and lockers. Skim the earliest Transfers entries for launch-block sniper clusters, then click through the deployer's address history for previous launches.
6. Minutes 9–10: the social pass. Site, X, Telegram: guaranteed-return language, fake endorsements, countdown pressure? Ask one concrete question in the community channel — "what share of LP is locked and until when?" — and treat deletion or a ban as the answer.

If a token survives all ten minutes, what you have earned is the right to think about it further — position-sized for total loss, with the unlock dates in your calendar — not a green light. The discipline that actually protects you is refusing to skip stages under time pressure, because manufactured urgency (the countdown, the "CEX listing in one hour") is itself the most reliable red flag on the entire list.

Related Guides

• Token Liquidity Explained — the pool and LP-token mechanics every rug exploits.
• How to Track Ethereum Whales — the holder-forensics skills used in sections 3 and 5.
• Ethereum DeFi Explained — how AMMs, swaps, and DEX trading actually work.
• How ETH Bubbles Scores Momentum — why a green bubble is an attention signal, never a safety signal.

Frequently Asked Questions

Sources & Further Reading

• Chainalysis — Crypto Scam Revenues 2021 (rug pull statistics, AnubisDAO case, LP-token concentration warning)
• arXiv — "From Programming Bugs to Multimillion-Dollar Scams: An Analysis of Trapdoor Tokens on Uniswap" (honeypot mechanisms and scale, ~30,000-token dataset)
• honeypot.is (buy/sell simulation checker and its limitations disclaimer)
• GoPlus — Token Security API (30+ detection items across contract, trading, and info security)
• Token Sniffer (automated 0–100 token audit scores)
• Trust Wallet — How to Spot Honeypot Token Scams (behavioral and social red flags, tool list)
• Etherscan Information Center — Understanding the Token Page (Holders, Transfers, and Contract tabs used throughout this checklist)
• Chainalysis — 2026 Crypto Crime Report Introduction (2025 illicit-activity totals, including ~$17B lost to scams and fraud)
• CoinDesk — Chainalysis: Impersonation and AI Crypto Scams Surpass Cyberattacks (impersonation-scam growth, AI-scam profitability)
• Solidus Labs — Solana Rug Pulls & Pump-and-Dumps Report (Pump.fun and Raydium launch-failure and rug statistics)
• The Defiant — 99% of Memecoin Launches on Pump.fun Are Pump-and-Dumps or Rug Pulls (summary of the Solidus Labs findings)
• GoPlus — Major Chains Detected 67,000 Honeypot Tokens in Q4 (honeypot counts by chain and quarterly rug pull losses)
• DL News — Javier Milei's Libra Memecoin Scandal: A Timeline (LIBRA launch, peak valuation, and collapse)
• CoinDesk — Milei's Call Logs Link Him to Libra Probe (April 2026) (state of the LIBRA investigation)
• CNBC — 58 Wallets Made Millions on Trump's Meme Coin; 764,000 Lost Money (TRUMP winner/loser distribution and creator fees)
• CNBC — Trump Meme Coin Insiders Extend Lockup (insider allocation and vesting structure)
• Coin Bureau — Best Memecoin Launchpads in 2026 (launchpad landscape and bonding-curve mechanics)
• Etherscan — Token Approval Checker (reviewing and revoking standing token allowances)

Disclaimer: Meme coins carry extreme risk of total capital loss, and no checklist can detect every scam. This content describes defensive research techniques for informational purposes only and is emphatically NOT financial advice.