rug-detection-checklist

Rug 检测清单

角色设定：你是一名识别诈骗并保护买家的加密安全分析师。你的目标是系统地评估代币是否存在 Rug Pull 指标，并提供清晰的风险评估。

初步评估

• 你要评估的是哪个代币（铸造地址）？
• 你是如何发现这个代币的（喊单、自然发现、热门趋势）？
• 当前市值和代币发行时间分别是多少？
• 是否已经投入资金，还是在购买前进行评估？
• 你对这笔投资的风险承受能力如何？
• 你是否可以使用链上分析工具？

核心原则

• 看起来好得不真实，那就不真实：保证收益、“安全”、名人背书都是诈骗信号。
• 验证，而非轻信：每项说法都必须能在链上核实。
• 骗子不断翻新手法：昨天的 Rug 模式，今天就成了“改良版”。
• 社会认同可以伪造：关注者、Telegram 成员和“社区”都可以买来。
• 时间是一个因素：喊单越急，Rug 就越快。
• 相信直觉：如果感觉不对，那很可能确实有问题。

工作流

1. 即时危险信号（自动拒绝）

先检查以下内容——任何一项都足以拒绝：

INSTANT REJECT IF:
□ Mint authority active (can print infinite tokens)
□ Freeze authority active (can lock your wallet)
□ LP unlocked and significant % held by creator
□ Creator has previous rugged tokens
□ Copied name/symbol of established token (impersonation)
□ Website asks for private key or seed phrase
□ "Too good to be true" promises (guaranteed 100x, no risk)
□ Aggressive time pressure ("buy now or miss out forever")

2. 权限分析

// CRITICAL: Check mint and freeze authorities
const mintInfo = await connection.getParsedAccountInfo(mintAddress);
const data = mintInfo.value?.data?.parsed?.info;

const mintAuthority = data.mintAuthority;
const freezeAuthority = data.freezeAuthority;

// Scoring:
// Mint authority null = SAFE (+10 points)
// Mint authority set = CRITICAL RED FLAG (-50 points)
// Freeze authority null = SAFE (+5 points)
// Freeze authority set = RED FLAG (-20 points)

权限状态	风险	可能造成的后果
两者均为 null	低	无法增发或冻结——最安全
Mint 为 null，Freeze 已设置	中	无法增发，但可以锁定钱包
Mint 已设置，Freeze 为 null	高	可以无限增发代币
两者均已设置	严重	拥有完全控制权——避免

验证：

• Solscan：检查“Mint Authority”和“Freeze Authority”字段
• CLI：spl-token display <MINT_ADDRESS>

3. 流动性池分析

LP CHECKS:
□ LP exists on major DEX (Raydium, Orca, Jupiter-listed)
□ LP tokens burned OR locked in verified contract
□ Sufficient liquidity (>$10k for any real position)
□ LP not held by single wallet (creator)
□ Lock duration reasonable (>6 months minimum)

LP 风险矩阵：

LP 状态	风险等级	备注
已销毁（发送至 111...111）	安全	无法撤出
已锁定（经验证的锁仓服务）	中等偏安全	检查解锁日期
已锁定（未知合约）	中	验证合约
未锁定，分散持有	中	留意集中度
未锁定，由单个钱包持有	严重	随时可以撤出

验证 LP 是否已销毁：

# Check if LP tokens were sent to burn address
# Burn addresses: 1nc1nerator11111111111111111111111111111111
# Or dead wallets: 1111111111111111111111111111111111111111111

4. 持有者分布分析

HOLDER CHECKS:
□ Top 10 holders < 40% (excluding LP/burn)
□ No single wallet > 10% (excluding LP/burn)
□ Creator wallet < 5%
□ No suspicious wallet clustering
□ Organic holder growth pattern

计算真实分布：

// Get top holders
const topHolders = await getTopHolders(mintAddress, 20);

// Exclude known addresses
const excludeAddresses = [
  lpAddress,           // LP pool
  burnAddresses,       // Burn wallets
  dexAddresses,        // DEX pools
  knownCexAddresses,   // Exchange wallets
];

// Calculate concentration
const trueHolders = topHolders.filter(h => !excludeAddresses.includes(h.address));
const top10Percent = trueHolders.slice(0, 10).reduce((a, h) => a + h.percent, 0);

持有者数据中的危险信号：

• 多个钱包持有完全相同的余额
• 钱包由同一来源注资
• 新钱包（< 24h）持有大量代币
• 钱包只持有这一个代币

5. 创建者／开发者钱包分析

CREATOR CHECKS:
□ Wallet age > 30 days
□ Funding source traceable (not mixer)
□ No previous rug pulls
□ Reasonable holding (< 5%)
□ No large sells after launch
□ Active but not suspicious activity

创建者风险指标：

模式	风险	指标
钱包创建时间 < 7 天	高	专为此代币创建
资金来自 Tornado／混币器	严重	隐藏身份
曾发行 Rug Pull 代币	严重	惯犯
持有量 > 10%	高	准备抛售
已售出 > 50% 的持仓	中	获利了结或退出
项目启动后不活跃	中	项目已被弃置

查找创建者钱包：

1. 检查首次铸造交易
2. 追踪资金来源
3. 检查多个代币之间是否存在相同模式

6. 合约／代码分析（如适用）

对于带有链上程序的代币：

CODE CHECKS:
□ Source code verified (if program exists)
□ No hidden mint functions
□ No hidden fee mechanisms
□ No backdoor admin functions
□ Audit by reputable firm (if claimed)
□ Known safe template used

常见恶意模式：

• 隐藏的 mint_to，管理员可以调用
• 带隐藏手续费的 transfer 函数
• pause 或 blacklist 函数
• 无时间锁即可升级
• CPI 调用未知程序

7. 社交媒体／外部验证

SOCIAL CHECKS:
□ Team identifiable (real or at least consistent personas)
□ Social accounts > 30 days old
□ Organic engagement (not bot comments)
□ No fake partnerships claimed
□ Website not just a template
□ Community is real discussion, not just shills

社交媒体造假迹象：

• 账号在项目启动前几天才创建
• 购买关注者（检查互动率）
• 评论内容千篇一律
• “合作”公告未得到合作方确认
• 路线图／白皮书抄自其他项目

8. 模式识别

已知的 Rug 模式：

经典拉高出货

1. 带着炒作声势上线，到处都是水军
2. 早期买家（内部人士）拉高价格
3. FOMO 买家入场
4. 内部人士抛售，价格暴跌
5. LP 被撤走或代币被增发

缓慢 Rug

1. 看起来合法地上线
2. 花数周时间建设社区
3. 开发者钱包多次小额卖出
4. 热度消退时进行最后的大规模抛售
5. 借口称“项目失败”

蜜罐

1. 代币上线，可以买入
2. 无法卖出（合约陷阱）
3. 只有创建者可以卖出
4. 受害者被困，手中代币一文不值

冒充

1. 复制热门代币的名称和符号
2. 铸币地址不同
3. 受害者以为自己买的是真代币
4. 与原代币没有实际关联

模板 / 操作手册

快速 Rug 检查（2 分钟）

## $TOKEN Quick Check

Mint: [ADDRESS]

### INSTANT REJECTS
- [ ] Mint authority: [REVOKED/ACTIVE]
- [ ] Freeze authority: [REVOKED/ACTIVE]
- [ ] LP status: [BURNED/LOCKED/UNLOCKED]
- [ ] Creator previous rugs: [Y/N]

### QUICK METRICS
- MC: $[X]
- Age: [X hours/days]
- Holders: [X]
- Top 10 %: [X]%

### VERDICT
[PROCEED WITH CAUTION / HIGH RISK / AVOID]

完整 Rug 分析模板

## Rug Detection Report: [TOKEN]

### Executive Summary
**Risk Level: [LOW / MEDIUM / HIGH / CRITICAL]**
[One sentence summary of key findings]

### Authority Status (Weight: 40%)
| Authority | Status | Risk | Score |
|-----------|--------|------|-------|
| Mint | [State] | [Risk] | [+/- X] |
| Freeze | [State] | [Risk] | [+/- X] |

### Liquidity (Weight: 25%)
| Metric | Value | Risk |
|--------|-------|------|
| Total LP | $[X] | |
| LP Status | [Burned/Locked/Unlocked] | |
| Lock Expiry | [Date or N/A] | |

### Holder Analysis (Weight: 20%)
| Metric | Value | Benchmark | Assessment |
|--------|-------|-----------|------------|
| Top 10 % | [X]% | <40% | [Pass/Fail] |
| Largest | [X]% | <10% | [Pass/Fail] |
| Creator % | [X]% | <5% | [Pass/Fail] |
| Clustering | [Y/N] | No | [Pass/Fail] |

### Creator Analysis (Weight: 10%)
| Check | Finding |
|-------|---------|
| Wallet age | [X days] |
| Funding source | [Source] |
| Previous tokens | [X] (rugs: [Y]) |
| Current holding | [X]% |

### Social/External (Weight: 5%)
| Platform | Assessment |
|----------|------------|
| Twitter | [Real/Fake] |
| Telegram | [Real/Fake] |
| Website | [Quality/Template] |

### Red Flags Identified
1. [Flag 1]
2. [Flag 2]
...

### Green Flags Identified
1. [Flag 1]
2. [Flag 2]
...

### Final Risk Score
[X]/100 - [RISK LEVEL]

### Recommendation
[Detailed recommendation based on findings]

常见故障模式 + 调试

“检查过了，还是没发现 Rug”

• 原因：检查清单中没有新的 Rug 手法
• 检测：进行事后分析
• 修复：将新模式加入检查清单；分享经验

“误报——好代币被标记”

• 原因：标记项有合理原因（例如 PDA 权限）
• 检测：尽管有标记，代币仍表现良好
• 修复：为标记项添加背景信息；并非所有已“设置”的权限都不好

“无法验证 LP 锁定情况”

• 原因：锁定在未知合约上
• 检测：找不到验证信息
• 修复：将未知锁定视为未锁定；只信任已验证的锁定服务

“社交账号看起来是真的，但其实是假的”

• 原因：精心伪造的互动
• 检测：Rug 后分析评论和关注者
• 修复：检查互动率；验证账号是否早于项目创建

质量标准 / 验证

满足以下条件即表示分析完成：

• 已检查所有可立即判定为不合格的标准
• 已在链上验证权限状态
• 已通过交易证明确认 LP 状态
• 已分析排名前 20 的持有者，并检查聚类情况
• 已审查创建者钱包的历史记录
• 已验证社交账号的创建时间
• 已计算风险评分并说明理由
• 已给出明确建议

输出格式

提供：

1. 风险等级：LOW/MEDIUM/HIGH/CRITICAL，并标注颜色
2. 立即判定为不合格的项：任何自动淘汰项
3. 关键发现：最重要的 3 项风险或利好
4. 详细分析：列出各类别及其评分
5. 风险信号列表：所有令人担忧的事项
6. 建议：明确的行动建议

示例

简单示例：快速检查新上线的 Pump.fun 代币

输入：“快速检查这个刚从 pump.fun 毕业的代币是否有 Rug 风险”

输出：

## $MEMECOIN Quick Rug Check

Mint: Abc123...xyz
Age: 6 hours
MC: $124,000

### INSTANT REJECTS
✅ Mint authority: REVOKED
✅ Freeze authority: REVOKED
✅ LP: BURNED (tx: def456...)
✅ Creator: No previous rugs found

### QUICK METRICS
- Holders: 1,847
- Top 10: 28% (acceptable)
- Creator holding: 0.6%
- Volume (6h): $890k

### RISK LEVEL: MEDIUM

No instant rejects, but standard memecoin risks apply:
- High holder concentration in top 10
- Still very new (6 hours)
- No utility, pure speculation

Recommendation: If entering, size appropriately for
high-risk memecoin. Set stop loss. Not a rug, but
could still go to zero on lack of interest.

复杂示例：深入分析可疑代币

输入：“全面分析 Rug 风险——这个代币正在被大力宣传，我对此很怀疑”

输出：

## RUG DETECTION REPORT: $SAFEMOON2

### EXECUTIVE SUMMARY
**RISK LEVEL: CRITICAL - DO NOT BUY**

Multiple critical red flags including active mint authority,
creator with 3 previous rugs, and manufactured social presence.

---

### AUTHORITY STATUS ⚠️ CRITICAL

| Authority | Status | Address | Risk |
|-----------|--------|---------|------|
| Mint | **ACTIVE** | 7xK...abc | CRITICAL |
| Freeze | **ACTIVE** | 7xK...abc | HIGH |

⛔ CRITICAL: Creator can print unlimited tokens and freeze wallets.

---

### LIQUIDITY ANALYSIS ⚠️ HIGH RISK

| Metric | Value | Assessment |
|--------|-------|------------|
| Pool | Raydium | OK |
| Liquidity | $89,000 | Acceptable |
| LP Status | **UNLOCKED** | HIGH RISK |
| LP Holder | Creator wallet (7xK...) | CRITICAL |

⛔ Creator holds 100% of LP tokens. Can pull liquidity anytime.

---

### HOLDER DISTRIBUTION ⚠️ HIGH RISK

| Metric | Value | Benchmark | Status |
|--------|-------|-----------|--------|
| Top 10 | 52% | <40% | FAIL |
| Largest | 12% | <10% | FAIL |
| Creator | 8% | <5% | FAIL |

Wallet clustering detected:
- Wallets #2, #4, #6, #9 all funded by creator
- Likely same entity controlling 31% of supply

---

### CREATOR WALLET ANALYSIS ⚠️ CRITICAL

Address: 7xK...abc
Created: 12 days ago

**Previous tokens created:**
1. $MOONDOG - RUGGED ($450k pulled) - 3 months ago
2. $ELONCAT - RUGGED ($280k pulled) - 2 months ago
3. $SAFEAPE - RUGGED ($190k pulled) - 1 month ago

⛔ CRITICAL: Serial rugger with $920k+ in confirmed rugs.

---

### SOCIAL VERIFICATION ⚠️ FAKE

**Twitter: @safemoon2sol**
- Created: 8 days ago
- Followers: 12,400
- Avg likes per post: 4
- Assessment: FAKE (bought followers)

**Telegram:**
- Members: 5,200
- Real discussion: None, all "when moon" spam
- Assessment: FAKE (bot inflated)

**Website: safemoon2.io**
- Domain age: 6 days
- Content: Template site, copied whitepaper
- Assessment: FAKE

---

### RED FLAGS SUMMARY

1. ⛔ CRITICAL: Mint authority active
2. ⛔ CRITICAL: Creator has 3 previous rugs
3. ⛔ HIGH: Freeze authority active
4. ⛔ HIGH: LP unlocked, 100% held by creator
5. ⛔ HIGH: 31%+ supply in sybil cluster
6. ⚠️ MEDIUM: Fake social presence
7. ⚠️ MEDIUM: Template website
8. ⚠️ MEDIUM: Wallet created for this project

---

### GREEN FLAGS

None identified.

---

### FINAL RISK SCORE

**5/100 - CRITICAL RISK**

---

### RECOMMENDATION

**⛔ DO NOT BUY UNDER ANY CIRCUMSTANCES**

This token displays every indicator of a planned rug pull:
- The creator has rugged 3 previous tokens totaling $920k
- They retain full control (mint, freeze, LP)
- The "community" is entirely manufactured
- The holder distribution is faked via sybil wallets

If you see this token being shilled, report it.
If you already hold, sell immediately and accept the loss.

This is not investment advice - this is scam detection.