Key Takeaways
The three tools cover different layers. RugCheck reads Solana token structure, GoPlus reads smart contract permissions across many chains, and Bubblemaps shows how the supply is distributed and which wallets are connected to each other.
A clean report is a minimum standard, not proof of safety. All three tools measure on-chain structure, not intent. None of them evaluate the team, the product, the marketing claims, or what happens after you buy.
Most of the value comes from the sequence. Verify the contract address first, then check who controls the contract, then check who controls the supply. Skipping step one makes the other two meaningless.
Why a Repeatable Check Matters
Thousands of new tokens are deployed every day across Solana, Ethereum, BNB Chain, Base and other networks. Anyone can create one in minutes, and most of the risk in a brand new token is structural rather than financial. Structural risk means the token is built in a way that lets someone else change the rules after you are already holding it.
Price charts cannot show you this. A chart will not tell you whether the issuer can still mint unlimited new supply, whether the contract can block you from selling, or whether forty wallets that look independent were all funded by the same address an hour before launch. That information lives on-chain, and free tools already read it for you.
The routine below takes roughly five minutes. It will not identify every scam, and it is not investment advice. It is a filter that removes the most obvious structural traps so that whatever you look at next is at least worth the time.
The Three Tools at a Glance
Tool | Main coverage | What it answers | Main limitation |
|---|---|---|---|
RugCheck (rugcheck.xyz) | Solana, plus Fogo | Are mint, freeze and metadata authorities revoked? Is liquidity burned or locked? How concentrated are the top holders? Were there snipers or bundled buys at launch? | Solana-focused. Reads structure only, so a token can pass and still fail for off-chain reasons. |
GoPlus Security (gopluslabs.io) | Many EVM chains and a growing list of others | Can the token actually be sold? What are the buy and sell taxes, and can they be changed? Is there a hidden owner, a blacklist, a pause function, or an upgradeable proxy? | Coverage and data depth vary by chain. Some non-EVM tokens return limited or unknown fields. |
Bubblemaps (bubblemaps.io) | More than ten chains including Ethereum, Solana, BNB Chain and Base | Who holds the supply, and are those holders connected to each other? Did concentration build up gradually or exist from day one? | Shows relationships, not motives. Exchange and custodial wallets can look like clusters when they are not. |
Minute 1: Verify the Contract Address
This is the step people skip, and it is the one that causes the most avoidable losses. Every safety check you run is a check on one specific contract address. If the address is wrong, a perfect report tells you nothing, because you scanned a different token.
Copycat tokens are common. Attackers deploy a contract with the same name, the same symbol and the same logo, then push it through search results, paid promotion, comment replies and fake accounts.
Safer ways to source an address:
Take it from the project's own site or official social account, then confirm it on a block explorer such as Etherscan, BscScan or Solscan.
Cross-check it against a data aggregator listing for the same token, such as CoinGecko or CoinMarketCap.
Compare the first and last six characters carefully. Address-poisoning attacks rely on lookalike endings.
Treat addresses received through direct messages, replies or airdrop notifications as untrusted by default.
Minute 2: RugCheck for Solana Token Structure
RugCheck launched in 2023 and became the most widely used token scanner in Solana trading communities. It is free, requires no account and no wallet connection, and returns a structured report from a pasted mint address. In 2025 it extended coverage to Fogo, an SVM-compatible network, and it exposes a public API that other platforms embed in their own interfaces.
The report groups more than twenty individual checks. Read the individual flags rather than fixating on the headline number, because different platforms that embed RugCheck data present and scale that number differently.
What to look at first
Signal | What it means | What you generally want to see |
|---|---|---|
Mint authority | Whether the issuer can still create new supply out of nothing | Revoked |
Freeze authority | Whether the issuer can lock individual token accounts so they cannot transfer | Revoked |
Metadata mutability | Whether the name, symbol or image can be changed after launch | Immutable, or a clear reason why not |
Liquidity status | Whether pool tokens are burned, locked with an unlock date, or freely withdrawable | Burned or locked, with the lock verifiable |
Top holder concentration | How much of the supply sits in a small number of wallets | Lower concentration, excluding known pool and burn addresses |
Creator holdings | How much the deploying wallet kept | A modest, explained allocation |
Snipers and bundlers | Wallets that bought in the first blocks, or bundled buys that inflate apparent demand | Few or none |
RugCheck also offers an Insider Networks feature that maps transaction flows as a graph to surface coordinated wallet groups, and a wallet risk profile that scores an individual address. Both are useful context, and both are best read as leads to investigate rather than verdicts.
Minute 3: GoPlus for Contract Permissions and Sell-Ability
GoPlus Security runs a free token security detection service that covers more than thirty checks across contract code, transaction behaviour and token information. Its data is embedded across wallets, aggregators and exchanges, so you may already have seen its flags without knowing the source.
Where RugCheck answers "who controls the supply on Solana", GoPlus answers a different and equally important question on EVM chains: "if I buy this, can I sell it, and at what cost?"
Flags worth understanding
Flag | Why it matters |
|---|---|
Honeypot | The contract allows buying but blocks or effectively prevents selling. This is a hard stop, not a caution. |
Buy tax and sell tax | Transfer fees written into the contract. Some projects use modest fees openly. Very high fees can make exiting impractical. |
Modifiable tax or slippage | The owner can raise fees after launch. A token you enter at a low fee can become unsellable in practice if the fee is pushed high enough. |
Mint function | New supply can still be created, diluting existing holders. |
Blacklist or whitelist | Specific addresses can be blocked from trading. Holders have found their own wallets blacklisted after buying. |
Transfer pausable | All transfers can be halted by the owner. |
Hidden owner | Ownership appears renounced, but control is retained through another mechanism. |
Can take back ownership | Renounced ownership can be reclaimed later. |
Proxy contract | The logic can be upgraded after deployment, meaning today's behaviour is not guaranteed tomorrow. |
Unverified source code | The contract cannot be read or independently reviewed. |
Anti-whale or cooldown limits | Caps on transaction and wallet size. Sometimes protective, sometimes used to throttle sellers. |
One nuance worth internalising: renounced ownership does not always mean no control. If the token sits behind an upgradeable proxy, or if a privileged role still exists, behaviour can change after you buy. Check upgradeability alongside ownership, not instead of it.
Minute 4: Bubblemaps for Holder Distribution
The first two tools tell you what the contract permits. Bubblemaps tells you who is actually holding it. Founded in 2021 and now covering more than ten chains, it renders holder data as an interactive graph. Each bubble is a wallet, sized by holding, and lines show transfers between them.
A block explorer shows each wallet as an independent row. It gives no indication that rows three, forty-one and one hundred twelve were funded by the same parent address shortly before launch. Bubblemaps makes that relationship the primary visual, so coordination becomes visible instead of buried.
The two features that do the heavy lifting
Magic Nodes. By default the map links top holders directly. But many connections run through intermediaries that hold zero tokens themselves, such as a shared gas-funding wallet or a common deposit address. Because those addresses are not holders, no line appears. Magic Nodes adds them to the map, and clusters that were invisible a moment earlier snap into view.
Time Travel. This replays how the distribution looked at earlier points in the token's history. Concentration that builds gradually is one of the strongest structural warning signs in token analysis, and it is essentially invisible without a time axis. Time Travel also exposes early allocations to insiders or market makers that have since been moved.
A related feature, Time Nodes, splits a shared counterparty such as an exchange into separate nodes by time window, so wallets are only linked if they interacted during the same window. That distinguishes genuine coordinated funding from the coincidence of many unrelated people using the same exchange.
Reading a map without over-reading it
Scattered, unconnected bubbles suggest organic and independent holders.
Dense interconnected clusters holding a large share of supply suggest coordination, insider allocation or concentrated control.
Not every cluster is malicious. Exchange hot wallets, bridges, vesting contracts, treasuries and market makers all create legitimate hubs. Label the big nodes before drawing conclusions.
Clusters are evidence of a relationship, not proof of intent. They tell you where to look next, not what someone plans to do.
Minute 5: Make the Call
Put the three outputs side by side. The point is not to reach a score. The point is to notice whether anything you found is a hard stop, and whether the things that are merely questionable have a plausible explanation.
Category | Typical hard stops | Typical questions to resolve |
|---|---|---|
Control | Honeypot flag, hidden owner, ability to reclaim ownership | Active mint authority, upgradeable proxy, unverified source |
Exit | Sell blocked, extreme or freely modifiable sell tax | Transfer pause function, tight wallet or transaction caps |
Liquidity | Liquidity fully unlocked and withdrawable at will | Short lock period, very thin pool depth |
Distribution | A single connected cluster controlling a majority of supply | Unlabelled large holders, heavy sniper activity at launch |
If a token clears all three tools, you have established that its structure is not obviously rigged. That is a useful floor. It is not a conclusion about the project, the people behind it, or whether interacting with it is a sensible thing to do.
What This Check Cannot Do
Being honest about the limits is what makes the routine worth running.
It does not assess the team, the product, the roadmap or the accuracy of marketing claims.
It does not detect social engineering, which sits entirely outside the smart contract. Fake teams, spoofed influencers and copycat websites will not show up in any scan.
It does not prevent a slow exit. An issuer can revoke authorities, pass every check, then sell into holders over weeks.
False positives happen. A legitimate new token with thin liquidity or an unconventional structure can score poorly for structural reasons alone.
Detection methods and evasion methods both evolve. A flag set that catches today's pattern may miss next quarter's.
Use the tools as a first filter and combine them with your own research. Nothing here is financial advice, and no scanner can make an interaction safe.
Frequently Asked Questions
Do I need all three tools, or is one enough?
They cover different layers and different chains. For a Solana token, RugCheck plus Bubblemaps covers most structural ground. For an EVM token, GoPlus plus Bubblemaps is the usual pairing. Using a contract scanner without a distribution view leaves the biggest question unanswered: who actually holds this.
Are these tools free?
The core functionality of all three is free to use. RugCheck requires no account or wallet connection. GoPlus offers free detection and a free API. Bubblemaps has a free tier that includes the full map, Magic Nodes and Time Travel, with some advanced features tied to holdings of its BMT token. Terms change over time, so check the current pages.
What is the difference between a honeypot and a rug pull?
A honeypot blocks the exit. The contract permits buying but prevents or effectively blocks selling. A rug pull removes the liquidity, leaving holders with a token that has no meaningful market to sell into. Both trap holders, but they use different mechanisms and are detected differently.
If ownership is renounced, is the token safe?
Not necessarily. Ownership can be renounced on the token contract while control persists through a proxy admin, a privileged role or a multisig. Check whether the contract is upgradeable and who controls upgrades, alongside the ownership status.
Does a clean RugCheck report guarantee anything?
No. It establishes a structural baseline. A bad actor can revoke authorities after positioning insiders and still produce a clean report. It is best understood as necessary but not sufficient.
Why does a token show a big cluster on Bubblemaps if it is legitimate?
Exchange hot wallets, bridge contracts, staking pools, treasuries and vesting contracts all concentrate supply and connect to many addresses by design. Check the labels on large nodes before treating a cluster as suspicious.
How much liquidity is enough?
There is no universal threshold. Thin pools are easier to manipulate and produce heavier slippage, and the same absolute figure means different things on different chains and at different market sizes. Treat any specific number you see quoted online as a rough convention rather than a standard.
Can I automate this?
Yes. RugCheck, GoPlus and Bubblemaps all expose APIs, and several trading interfaces and wallets embed their data directly. Automating the check speeds it up but does not change what the underlying signals can and cannot tell you.
Related Terms
Term | Definition |
|---|---|
The permission that allows new units of a token to be created. When it is revoked, the supply cannot be increased. | |
An arrangement where liquidity pool tokens are burned or held in a time-locked contract so they cannot be withdrawn at will. | |
A token whose contract allows purchases but blocks or effectively prevents sales, trapping holders. | |
The share of total supply held by the largest wallets. High concentration means a small group can move the market. | |
Sniper wallet | A wallet that buys within the first blocks after a token becomes tradable, often indicating advance knowledge or automation. |
Sources
All tool descriptions reflect publicly documented functionality as of August 2026. Features, coverage and pricing tiers change, so verify current behaviour on each official page before relying on it.
RugCheck official site and API documentation, rugcheck.xyz and api.rugcheck.xyz
Solana Compass, RugCheck project profile, solanacompass.com/projects/rugcheck
GoPlus Labs, Token Security Detection and Token Security API, gopluslabs.io/token-security and gopluslabs.io/en/token-security-api
GoPlus Security engineering and research posts on honeypots, hidden owners and modifiable taxes, goplussecurity.medium.com
Bubblemaps Wiki, How does it work, Magic Nodes and Time Nodes, wiki.bubblemaps.io
Bubblemaps official blog and product pages, bubblemaps.io and blog.bubblemaps.io
CoinDesk Research, protocol research profile of GoPlus Security
CoinGecko Learn, overview of Bubblemaps and the Intel Desk
Educational content only. This article does not contain financial advice, investment recommendations or price predictions. No tool described here can guarantee that a token is safe.
Best RugCheck Alternatives Every Beginner Trader Needs
Best Robinhood Chain Trading Platforms in 2026: FOMO, GMGN, Uniswap and OpenSea Compared
RugCheck vs GoPlus: Which Token Security Tool Is Better?
What is Bubblemaps? How to Detect Token Manipulation Before It Costs You
