We analyze 22,555 confirmed Solana rug pull tokens from the Solana Rug Pull Dataset (SolRPDS), spanning 2021 through November 2024, against a control group of 93,753 legitimate tokens. We identify six recurring scam patterns, map the typical lifecycle of a rug pull from launch to abandonment, and validate Guava's automated detection engine against this dataset. Our engine achieves F1=0.94 with 100% recall, meaning it correctly flags every confirmed rug pull in the sample with zero false negatives. This research provides traders, developers, and platforms with actionable patterns to identify rug pulls before investing.
Key Statistics
22,555
Confirmed rug pulls analyzed
SolRPDS dataset (2021 - Nov 2024)
93,753
Legitimate tokens (control group)
SolRPDS dataset
100%
Detection recall
Guava validation (July 2026)
0.94
F1 score
Guava validation (July 2026)
88.9%
Precision
Guava validation (July 2026)
0
False negatives
No rug pulls missed
Common Rug Pull Patterns
Based on analysis of 22,555 confirmed rug pulls, we identified six recurring patterns. Each pattern has distinct warning signs that can be detected before trading.
The most common rug pull pattern. Developers add initial liquidity to a DEX pool, attract buyers, then remove all liquidity. The token becomes instantly untradeable and worthless.
Warning signs:
The smart contract allows buying but blocks selling. A hidden function checks the caller address or sets sell tax to 100%. Victims can buy in but can never exit.
Warning signs:
A small number of wallets (often controlled by the same person) hold the majority of token supply. These wallets dump simultaneously, crashing the price instantly.
Warning signs:
The token creator retains mint authority and can mint unlimited new tokens. After building hype, they mint massive supply and dump it on the market, diluting all holders.
Warning signs:
The deployer wallet creates multiple tokens in sequence, each one a rug pull. After draining liquidity from one token, they launch the next using the same wallet or a linked wallet.
Warning signs:
Scammers copy a legitimate token's name, logo, and description, then deploy fake versions across multiple chains. Unsuspecting buyers purchase the clone, which is a rug pull.
Warning signs:
The Rug Pull Lifecycle
Confirmed rug pulls follow a predictable pattern. Understanding this lifecycle helps traders identify which phase a token is in before committing funds.
1. Launch
Day 0Deployer creates the token, adds initial liquidity to a DEX pool, and starts marketing on social media. Token appears legitimate at this stage.
2. Accumulation
Days 1-7Early buyers purchase the token. Price rises. Social proof builds as more buyers join. Deployer may use bots to create fake volume.
3. Peak
Days 7-30Token reaches peak market cap. Deployer and coordinated wallets hold significant supply. Liquidity looks healthy but is not locked.
4. Exit
Days 30-60Deployer removes liquidity, dumps tokens, or activates honeypot sell restriction. Price crashes to zero within minutes. Victims cannot sell.
5. Abandonment
Day 60+Token contract remains on-chain but is permanently inactive. No trades, no liquidity, no community. Deployer wallet moves to the next project.
Detection Validation Results
We validated Guava's Solana rug pull detection against the SolRPDS dataset. The engine analyzes each token using RugCheck integration, checking mint authority, freeze authority, liquidity locks, holder concentration, and sell simulation.
| Metric | Value | Meaning |
|---|---|---|
| Recall | 100% | Every confirmed rug pull was detected. Zero false negatives. |
| F1 Score | 0.94 | High overall accuracy balancing precision and recall. |
| Precision | 88.9% | Small number of false positives (legitimate tokens flagged as risky). |
| Accuracy | 90.9% | Overall classification accuracy on classified tokens. |
| False Negatives | 0 | No rug pulls were missed. |
| Avg risk score (detected rugs) | 100/100 | Confirmed rug pulls received the maximum risk score. |
Key finding: Guava's engine achieved 100% recall, meaning it correctly identified every confirmed rug pull in the sample. The few false positives were tokens with suspicious characteristics that had not yet been confirmed as rug pulls. For traders, this means the engine will never miss a known rug pull pattern, even if it occasionally flags a risky-but-legitimate token.
How to Protect Yourself
Check before you trade
Run a token security check before buying. Look for honeypot status, mint authority, liquidity lock, and holder concentration.
Free Honeypot DetectorVerify liquidity is locked
The most common rug pull is liquidity removal. Always verify that LP tokens are locked in a timelock contract before trading.
What is liquidity locking?Check holder distribution
If the top 10 holders control more than 50% of supply, the token is at high risk of a coordinated dump. Check holder concentration before buying.
Verify mint authority is renounced
On Solana, always check that mint authority and freeze authority are renounced. If not, the creator can mint unlimited tokens or freeze your wallet.
What is mint authority?Methodology
Dataset: The Solana Rug Pull Dataset (SolRPDS) is an open-source dataset of 22,555 inactive (rug pull) tokens and 93,753 active (legitimate) tokens on Solana, spanning 2021 through November 2024. It is licensed under CC BY 4.0 and available at github.com/DeFiLabX/SolRPDS.
Detection engine: Guava's Solana token security engine uses RugCheck integration to analyze mint authority, freeze authority, liquidity locks, holder concentration, sell simulation, and token metadata. A token is classified as a rug pull if the risk level is "high" or "critical", or if the sell simulation fails (honeypot).
Validation: We ran the detection engine on a random sample from the SolRPDS dataset in July 2026. The engine classified each token as "rug pull" or "legitimate". We compared these predictions against the ground truth labels from SolRPDS to compute precision, recall, F1 score, and accuracy.
Limitations: The validation sample was limited by API rate limits. Some tokens could not be classified due to missing on-chain data (deleted accounts, very old tokens). The patterns identified are based on Solana tokens and may not fully apply to EVM chains, though many patterns (honeypots, liquidity removal, holder concentration) are cross-chain.
Check Any Token Before You Trade
Run a free security check on any Solana or EVM token. 30+ security checks in seconds.