How Rug Pulls Work: The Mechanics, Not the Moral

Rug pulls are usually described in terms of intent, which does not help anyone decide anything. The useful description is mechanical: what the operators are able to do, and which of those abilities can be observed beforehand.

This page names no projects and makes no accusations. It describes categories of mechanism.

The Three Mechanisms

Liquidity removal. A token trades against a pool of paired assets. Whoever supplied that liquidity can withdraw it. When they do, there is nothing left to trade against, and the token cannot be sold at any meaningful value. Holders are left with a balance and no exit.

Minting. If the contract permits creating new supply, the operators can issue a large quantity and sell it into whatever liquidity exists. Existing holders are diluted and the proceeds leave with the operators.

Transfer restriction. The contract can treat buying and selling differently: a sell that reverts, a tax on selling set high enough to be prohibitive, or an allow list from which the operators are exempt. The position appears to be working until an exit is attempted.

The first is an action taken by people who supplied something. The second and third are powers written into the contract.

What Can Be Checked

The last row is the one that defeats most checklists. Every technical check establishes what is possible, not what will happen.

Verified Source and Upgradeability

If the contract source is not verified on the explorer, nothing above can be read. That alone is decisive information.

If the contract is behind an upgradeable proxy, the logic can be replaced after you have read it. A contract that is safe today and upgradeable is a contract whose behaviour tomorrow is a decision someone else will make.

Ownership renounced, meaning privileged functions can no longer be called by anyone, removes a category of risk. It also removes the ability to fix anything, which has its own consequences.

Holder Distribution

Explorers show how the supply is distributed. A small number of addresses holding most of it means those holders can move the price on their own, whatever the contract permits.

Distribution can be obscured by splitting across many addresses, so a clean-looking distribution is weaker evidence than a concentrated one. Absence of a warning sign is not a positive signal.

What a Liquidity Lock Does Not Do

A lock addresses one mechanism for one period. It does not constrain minting, does not constrain transfer restrictions, and does not stop operators selling tokens they hold.

Check the lock contract itself and the expiry. A lock with a short remaining term, or one held by a contract that permits early withdrawal, provides considerably less than the word suggests.

What an Audit Does Not Do

An audit reviews code against a defined scope at a point in time. It can find defects and it does not make a project trustworthy.

It does not prevent the operators using powers the code deliberately grants. It does not cover changes made afterwards. And the report’s existence says nothing about who commissioned it, what was excluded from scope, or whether the findings were addressed.

The Honest Position

The checks above eliminate the clumsiest cases. They cannot distinguish a project that will behave from one that has arranged itself to look identical and will not.

The only reliable protection is the size of the position. Exposure you can afford to lose entirely is the appropriate frame for any token whose operators retain the ability to remove its value.

This site does not rate, score or verify projects, and any site that offers a safety score for a token is selling a certainty that cannot exist.

What People Get Wrong About This

The first mistake is treating a liquidity lock as comprehensive. It covers one exit.

The second is treating an audit as an endorsement. It is a review of code, not of people.

A third is checking whether the contract has a mint function while ignoring whether it is upgradeable. An upgradeable contract can acquire one.

A fourth is interpreting a clean checklist as a positive signal rather than as the absence of obvious problems.

And the last is buying more because an early position rose. In the transfer restriction case, the rise is what the design produces, and the exit is what does not exist.

Related

The habits that protect against this overlap with the rest of the security cluster: read what you sign in verify before signing, understand what permissions you have granted in token approvals, and recognise the social layer in crypto phishing.