How to read a token risk report: mint authority, LP, honeypots and the other signals

How the “Risk report” tab is built[1][15][19]

On every token page, the “Risk report” tab collects signals from third-party providers. For Solana we use RugCheck plus a direct read of the mint account through Solana RPC. For Base and BNB Chain we use the GoPlus Token Security API. The “Market structure” section is computed from DexScreener data for the token's primary pair. No supported provider scans Robinhood Chain contracts yet, so there the report shows market structure only.

The report deliberately has no single score, even when a provider calculates one. Each row has a status, a value, a short explanation, the source name and the time of the reading. Rows sit in two groups: “Contract and holders” and “Market structure”. The headline counts how many signals need attention, for example “3 of 11 checked signals need attention”.

• “No issue”: the source checked the signal and found no problem
• “Caution”: something needs a closer look but does not settle the risk on its own
• “Risk”: a privilege or mechanism that lets someone take your tokens, block selling or pull liquidity
• “Not checked”: the provider returned no data. This is not a positive result

Solana: mint authority and freeze authority[4][5][3][1]

A mint account can carry two authorities. Mint authority can create new tokens, diluting existing holders. Freeze authority can freeze a token account. According to the Solana documentation, a frozen account cannot receive, transfer or burn tokens until it is thawed. In practice, whoever holds this authority can block you from selling.

Both authorities can be set to None, and the Solana documentation states that this removes the role permanently. That is why a “revoked” value is marked “No issue”, while “set” with the shortened holder address is marked “Risk”.

We read both authorities directly from the mint account through Solana RPC and compare them with RugCheck. The result appears as a “cross-check RugCheck” note under the row. If the sources disagree, the row is marked at least “Caution” and the explanation asks you to check the mint account in an explorer. The official Solana documentation also points to RugCheck as a tool that evaluates mint and freeze authority, among other signals.

Token-2022 extensions: fees, delegates and hooks[7][9][6][8][10]

A Solana token can run on the original Token Program or on Token-2022, which lets the mint carry extensions. The “Token-2022 extensions” row appears only for Token-2022 tokens and lists extension names as Solana RPC returns them. If none of the extensions below is present, the row is marked “No issue”.

• permanentDelegate (“Risk”): the permanent delegate can transfer and burn tokens from any account of this mint, and holders cannot revoke it
• pausable (“Risk”): the pause authority can halt transfers, minting and burning for the whole token
• nonTransferable (“Risk”): tokens from this mint cannot be transferred at all
• transferFee (“Caution”): every transfer is reduced by a fee in basis points, and a new rate takes effect two epochs after it is changed
• transferHook (“Caution”): every transfer calls an external program that can reject the transaction
• defaultAccountState (“Caution”): new token accounts can start frozen and wait for the freeze authority to thaw them

LP burned, locked or unlocked[1][13]

On Solana, the “Liquidity lock (LP)” row shows how much LP is locked or burned, based on RugCheck's lpLockedPct field. The value reads like “95.0% locked/burned”. At 90 percent or more the row is marked “No issue”, from 50 percent “Caution”, and below 50 percent “Risk”. Unlocked LP can be withdrawn from the pool, which sharply cuts the liquidity everyone else can sell into.

Burned and locked are not the same thing. Raydium describes its Burn & Earn feature as a permanent lock of the position and notes that, technically, the LP is locked rather than burned. Once locked, the deposited liquidity cannot be retrieved, although the key holder still collects trading fees. Other locks have an expiry date, and our report does not check it.

Holder concentration, insiders and bundles[1][2][14]

For Solana, the “Holder concentration” row is based on RugCheck's holder-related flags. If RugCheck flags nothing, the value reads “not flagged”. If it flags something, the value and flag name come straight from RugCheck and the status follows the flag's level.

The percentage alone can mislead. The largest accounts often do not belong to one person: an AMM pool vault, a launchpad bonding-curve account, an exchange wallet or another program account. A pool holding 20 percent of supply is not a whale about to sell. Before drawing conclusions, open the “Holders” tab and check what the largest addresses are.

Insiders and bundles are a separate issue. On Solana, Jito accepts bundles: up to five transactions executed sequentially and atomically, all or nothing. That lets several wallets buy a token in the same block in which its pool was created. If they belong to one person, supply looks dispersed in the statistics while one party controls it.

Mutable metadata and other RugCheck flags[11][12][1]

A token's name, symbol and metadata link do not have to be fixed. In the Metaplex Token Metadata standard, the update authority can change them while the Is Mutable flag is true. Once it is set to false, any further update fails. With Token-2022, metadata can also live in the mint itself, and the update authority named in the extension changes it.

Mutable metadata takes nothing by itself, but it allows the name, logo or links to be swapped later, for example so the token imitates another project. Our report has no separate row for it. Every RugCheck flag other than mint authority, freeze authority and holders appears as its own row with RugCheck's English name, value and description. A “danger” level is marked “Risk”, any other level “Caution”.

EVM: honeypots, sell tax and trading restrictions[15]

For Base and BNB Chain, the report relies on the GoPlus Token Security API. The “Honeypot” row says whether, according to GoPlus, the token may be impossible to sell. It is a simulation result: “not detected” means a sell went through at test time, not that the owner cannot change the rules later.

“Buy tax” and “Sell tax” are the fee the contract takes on every trade. Above 10 percent the row is marked “Risk”, and any tax above zero is marked “Caution”. If the owner can change the rate for everyone or for chosen addresses, the row is marked at least “Caution” with the note “The owner can change the tax rate”. GoPlus notes that a 100 percent sell tax effectively means the token cannot be sold, and that anti-bot and cooldown mechanisms can distort the simulation.

The “Trading restrictions” row combines five flags. cannot_sell_all (you cannot sell your full balance) and cannot_buy are marked “Risk”. transfer_pausable (the owner can halt trading), trading_cooldown (an enforced gap between trades) and blacklist (the contract has a blacklist function, and a listed address cannot trade) are marked “Caution”.

EVM: owner, proxy and verified source[15][16][17]

Many EVM tokens have an owner, an address with access to administrative functions. In OpenZeppelin's widely used Ownable pattern, the owner can renounce the role, after which functions guarded by onlyOwner can no longer be called. GoPlus warns, however, that a hidden owner is sometimes used to keep control despite an apparent renouncement.

The “Owner privileges” row is marked “Risk” when GoPlus detects hidden_owner, can_take_back_ownership (ownership can be reclaimed) or selfdestruct (the contract can be destroyed). Separate rows are “Owner can mint”, marked “Caution”, and “Owner can modify balances”, marked “Risk”, because such an owner can change any holder's balance.

“Proxy contract” means the token address forwards calls to a separate logic contract, and the proxy admin can swap that logic without changing the address. A clean result today may not hold tomorrow, so the row is marked “Caution”. “Verified source” with the value “no” is marked “Risk”, because without published code hidden functions cannot be checked.

EVM: holders and LP according to GoPlus[15][18]

On Base and BNB Chain we compute concentration from the GoPlus holder list: we add up the share of the ten largest addresses, leaving out locked accounts and burn addresses. The value reads like “top 10: 42.0%”. From 30 percent the row is marked “Caution”, from 50 percent “Risk”. The list can include liquidity pools and exchange contracts, which inflates the figure. GoPlus returns a tag and a contract flag for each holder, which makes it easier to work out whose accounts they are.

We estimate the LP lock from the list of the ten largest LP holders that GoPlus returns, adding up the locked and burned share. The thresholds match Solana. GoPlus recognises only the lockers on its own list, and positions in Uniswap V3-style pools are ERC-721 NFTs rather than ordinary LP tokens, so they may not be fully covered.

Market structure: liquidity, valuation and pair age[19][20]

The three rows in “Market structure” are computed from DexScreener data for the token's primary pair. They work the same way on every supported network, Robinhood Chain included.

Read pair age with care. The report measures it from the creation of the primary pair, not of the token. A token that moved to a new pool will show a young pair, and an old pair does not protect against liquidity being pulled.

• “Primary pair liquidity”: below $25K it is marked “Caution”. Above that it is “No issue”, but liquidity can still be pulled quickly if LP is not locked
• “Valuation to liquidity”: market cap, or FDV when market cap is missing, divided by pair liquidity. Above 100x it is marked “Caution”
• “Pair age”: a pair younger than 7 days is marked “Caution”, and one created the same day reads “created today”

What a clean report does not prove

A report with only green rows says just one thing: at the time of the reading, the chosen sources did not find the chosen problems. Under every report we remind readers that signals can be wrong, incomplete or outdated, and that the absence of warnings is not a guarantee.

• It does not confirm you have the right token. A copycat of a famous ticker can have a spotless report
• It does not rule out rule changes after the reading by a proxy admin, the contract owner or an update authority
• It does not say who controls the wallets. Insiders spread across many addresses need not cross any concentration threshold
• It does not guarantee that an LP lock will not expire, because we do not check the lock's expiry
• It does not judge the team or demand. A token with a clean contract can lose all its value when buyers leave
• It does not replace your own check in an explorer

Step by step: a risk report in five minutes

We follow this order for every new token. If any step ends with “Risk” or cannot be checked, do not buy until you have an explanation.

• Open the token page by its full address and confirm the network
• Check the badge next to the tab (“Live” or “Stale”) and the times in the source list
• Read the headline: how many signals need attention and how many were not checked
• Solana: mint authority and freeze authority read “revoked”, and the RugCheck cross-check agrees
• Solana: for Token-2022, review the extension list, especially permanentDelegate, pausable and transferFee
• EVM: Honeypot “not detected”, taxes known and low, no trading restrictions or suspicious owner privileges
• Treat a proxy or unverified source as a reason for a longer look
• LP: check the locked/burned percentage and find out whether the lock is permanent
• Holders: in the “Holders” tab, separate pools, exchanges and programs from ordinary wallets
• Market structure: liquidity, valuation to liquidity and pair age, then a sell quote for your amount
• Only commit an amount you can afford to lose entirely