meme-coin-audit

Check the mint authority, freeze authority, and update authority on-chain using solana account or spl-token display; all should be null. Then verify LP is burned or locked in a verified contract and that top 10 holders control under 30% of supply excluding pools.

Simulate a buy, a transfer to a second wallet, and a sell; if buy succeeds but transfer or sell fails, it is a honeypot. In source, grep for blacklist mappings, maxTxAmount limits, tradingEnabled flags, and Solana freeze authority or transfer hooks.

A Token-2022 transfer hook with a non-null authority lets that key pause, blacklist, or fee arbitrary addresses after launch. A permanent delegate extension is worse: the delegate can move any holder's tokens at any time, which is effectively built-in confiscation.

Yes, on-chain checks cover the main risks: mint and freeze authority status, LP burn or lock state, holder distribution via Birdeye or Solscan, program upgradeability, and Token-2022 extensions. Source review is still needed for fee logic and hidden functions.

Badges are not verified on-chain; the lock contract may allow the owner to shorten the lock, be a 1-day lock renewed weekly, or be a forked locker with backdoors. Always read the actual lock contract on the explorer for unlock date, owner, and extension permissions.

Regex-based scanners catch source patterns like mint functions and blacklist mappings but cannot check on-chain authority state, holder distribution, LP lock status, or deployer wallet history. Those require manual verification via explorers and tools like rugcheck or honeypot.is.