Ethereum risk signals

Signaux de risque Ethereum

RektRadar's analyzers raise 115 distinct flags on any Ethereum token. Each one targets a specific scam, soft-rug, or operational red flag. Click through for the full explanation: what the flag means, why it puts funds at risk, and how it is detected on-chain.

What is a honeypot in crypto?

A honeypot is a token you can buy but cannot sell. The contract looks normal on Etherscan, the pool has liquidity, the buy transaction goes through - then the sell silently fails. Your ETH stays in the pool, the tokens stay in your wallet, and the deployer drains the liquidity hours later.

How RektRadar detects honeypots

RektRadar simulates the full buy + sell round-trip on Uniswap V2/V3 and SushiSwap with three different amounts (0.01, 0.05, 0.5 ETH) before any real interaction. If either side fails, the contract is flagged before you spend a single wei. The eight analyzers below run in parallel on every new ERC-20 - honeypot simulation, bytecode, source code, liquidity, holder distribution, deployer history, on-chain graph, and swap activity - and feed a weighted risk score.

Honeypot Simulation (6)

Honeypot Danger
The token can be bought but cannot be sold - funds are trapped on-chain.
20,440 detected
Buy Failed Warning
Even buying the token fails in simulation - likely paused or pre-launch.
16,357 detected
Sell Failed Danger
Buy succeeds but sell reverts - classic honeypot signature.
17,496 detected
Buy-Only Pattern Danger
On-chain history shows hundreds of buys and zero sells - telltale honeypot trace.
2,366 detected
Amount-Dependent Sell Danger
Selling small amounts works, large amounts fail - partial honeypot.
240 detected
Maximum Transaction Cap Warning
All transfers above a per-tx limit revert - common anti-whale + soft-rug pattern.
660 detected

Composite Verdicts (7)

Multi-Flag Rug Setup Danger
Three or more independent rug-pull ingredients fired on the same token at once.
13,071 detected
Multi-Flag Confirmed Scam Danger
Both rug-setup and malicious-contract evidence are present - a near-certain scam.
4,677 detected
Multi-Flag Malicious Contract Danger
Two or more distinct malicious code patterns were found in the contract source or bytecode.
1,225 detected
Multi-Flag Suspicious Profile Warning
Three or more soft red flags stack up into a profile worth avoiding even without a hard exploit.
3,893 detected
Selfdestruct + CREATE2 Combo Danger
The contract can both self-destruct and redeploy to the same address - a metamorphic rug primitive.
596 detected
Possible Simulation Detection Warning
The contract reads block/miner fields that scams use to behave differently inside a simulator.
8,815 detected
Insufficient Data Info
We could not gather enough on-chain data to judge this token - a low score here is 'unknown', not 'safe'.
1,521 detected

Source-Code Analysis (44)

Blacklist Mapping Danger
The contract can blacklist any address from selling - a kill-list with no notice period.
1 detected
Owner Not Renounced Warning
The contract still has an owner - nothing prevents a future privileged change.
17,166 detected
Upgradeable Proxy Warning
The contract is a proxy - its logic can be swapped without users' consent.
37 detected
Beacon Proxy Warning
Multiple contracts share a single upgradeable implementation - one switch rugs all of them.
37 detected
Mimics a Known Token Danger
The name or symbol matches a popular token, but the contract address is different.
5,847 detected
Impersonates a Major Token Danger
The contract spoofs the name or symbol of USDT, USDC, WETH or another major token at a fake address.
889 detected
Hidden Owner Danger
The source keeps an owner address in a private variable - control survives a fake ownership renounce.
15,813 detected
Unrestricted Mint Danger
A public mint() with no access guard - the supply can be inflated at will.
13,939 detected
Blacklist Function Warning
The contract ships a function to ban specific addresses from trading.
6,208 detected
Blacklist Mapping Warning
A blacklist/banned/isBlacklisted mapping sits in the contract's storage.
289 detected
Modifiable Fee Warning
The owner can change buy/sell taxes after launch via setFee/setTax functions.
409 detected
Modifiable Limits Info
Max-transaction / max-wallet limits can be changed by the owner after launch.
73 detected
Trading Control Info
The contract has an on/off switch for trading (enableTrading / openTrading).
3,212 detected
Pausable Info
The contract implements pause/unpause - all transfers can be frozen.
6,564 detected
Commented Renounce Danger
The renounceOwnership function is commented out in the source - renouncing was never an option.
1 detected
Self Destruct Danger
The contract can selfdestruct - the token code can be erased from the chain.
384 detected
Reentrancy Risk Danger
External value calls happen before balance updates - the classic reentrancy shape.
6 detected
Suspicious Assembly Warning
Inline assembly manipulates storage directly (sstore/delegatecall/create2).
14,684 detected
Conditional Transfer Warning
The transfer path branches on block.number, block.timestamp or tx.gasprice.
3,294 detected
Block-Dependent Logic Warning
Behavior changes past a block number or timestamp comparison.
8,391 detected
Dynamic Fee By Block Danger
Fees are computed from block.number or block.timestamp - taxes change on their own.
119 detected
Cooldown Mechanism Info
Per-address cooldowns restrict how often a wallet can trade.
275 detected
Whitelist Only Warning
Transfers require the address to be whitelisted.
36 detected
Owner-Exempt Limits Info
Excluded addresses bypass the fees and limits everyone else pays.
100 detected
Modifiable Anti-Whale Info
Anti-whale caps (max hold) can be changed by the owner after launch.
9 detected
External Call In Transfer Warning
The transfer path calls out to another contract.
389 detected
Flash Loan Callback Warning
The contract implements flash-loan/swap callbacks (uniswapV2Call, onFlashLoan...).
504 detected
Approve With Transfer Danger
The approve function also moves tokens - approvals should never transfer.
11,486 detected
Permit Abuse Danger
The permit() implementation transfers tokens instead of just approving.
4,094 detected
Balance Manipulation Danger
The owner can directly rewrite arbitrary balances (setBalance-style functions).
94 detected
Balance Zeroing Function Danger
A public function writes zero (or subtracts) directly into holder balances.
251 detected
Misspelled Drain Function Danger
A typo-named clone of approve/transfer (approvve, tranfer...) touches balances.
1,507 detected
Hardcoded Address Blacklist Danger
The transfer path reverts for specific addresses baked into the code.
2,257 detected
Mass Hardcoded Blacklist Danger
The transfer path embeds many literal addresses followed by a revert - a baked-in ban list.
2,250 detected
Router-Gated Balance Access Danger
Balance accounting branches on the router/pair address - sells behave differently than buys.
1,550 detected
Rebase Token Warning
Supply rebases - balances change without transfers.
52 detected
Reflection Token Warning
Reflection/RFI mechanics: fee redistribution through dual-balance accounting.
2,414 detected
Hardcoded Tax Fee Info
The contract hardcodes a non-zero tax/fee rate in the source.
43 detected
Upgradeable Proxy Warning
The contract can delegate or upgrade its logic (delegatecall / upgradeTo).
9,637 detected
Name Contains a URL Danger
The token's on-chain name or symbol carries a website, domain or claim-channel link - a phishing-bait token.
134 detected
Scam-Factory Contract Name Danger
The contract's internal name matches a template churned out by a known scam factory.
10,452 detected
gasleft() Anti-Simulation Check Warning
The contract inspects remaining gas, a trick to behave differently under simulation.
4,809 detected
tx.origin Check Warning
The contract branches on tx.origin, often to gate trading to specific callers.
4,130 detected
tx.origin == msg.sender Check Danger
The contract explicitly blocks contract callers by requiring tx.origin to equal msg.sender.
5 detected

Bytecode Patterns (11)

Suspicious Function Selectors Warning
The bytecode exposes function selectors known to enable rugs (sweepETH, removeLiquidityNoFee, etc.).
3,834 detected
Source Unverified Info
No verified source on Etherscan - analysis falls back to bytecode-only signals.
36,866 detected
Very Small Contract Warning
The bytecode is too small to be a real ERC-20 - likely a proxy front for malicious logic.
10,500 detected
Known Scam-Factory Bytecode Danger
The contract's bytecode is byte-identical to a confirmed mass-scam factory we have already flagged thousands of times.
2,060 detected
DELEGATECALL Opcode Warning
The contract can execute external code in its own context - the basis of upgradeable/proxy logic.
11,253 detected
GASPRICE Opcode Info
The contract reads the transaction gas price, sometimes used for anti-bot or anti-simulation logic.
6,282 detected
COINBASE Opcode Info
The contract reads the block miner/validator address, an uncommon and sometimes evasive pattern.
3,809 detected
CREATE2 Opcode Warning
The contract can deploy code to a precomputed address - the basis of metamorphic redeployment.
3,313 detected
SELFDESTRUCT Opcode Danger
The contract can destroy itself, wiping its code and (with CREATE2) reincarnating as something else.
2,632 detected
On-Chain Proxy Info
The contract delegatecalls into a separate implementation resolved on-chain from its proxy slots.
19 detected
Mutable Proxy (Active Admin) Warning
The proxy's EIP-1967 admin slot is set - the implementation (the logic) can be swapped at any time.
8 detected

Liquidity Analysis (8)

Low Liquidity Warning
The pool holds very little WETH - slippage explodes on any non-trivial trade.
15,271 detected
Liquidity Added at Creation Warning
The deployer provided the initial liquidity in the same transaction as the deployment.
10,718 detected
Creator Holds All LP Danger
The deployer wallet still owns 95%+ of the LP tokens - a one-tx rug is one click away.
9,993 detected
LP Tokens Burned Good
LP tokens were sent to a burn address - liquidity is locked forever, no rug from here.
698 detected
LP Tokens Locked Good
LP tokens are held in a recognized lock contract for a fixed duration.
174 detected
No DEX Pair Warning
The token has no liquidity pool - it cannot be traded on any DEX.
66,422 detected
LP Not Locked Warning
Nothing protects the liquidity: the LP is neither burned nor held by a known locker contract.
3,122 detected
LP in Pullable Custody Warning
The LP sits in a contract that looks like a lock but can release it on demand - a fake lock, not protection.
1,086 detected

Distribution Analysis (7)

Single Mint, Concentrated Danger
All tokens were minted in one transaction to a single wallet - no fair launch.
5,435 detected
Very Few Holders Warning
The token has fewer than 5 unique holders - almost no real distribution yet.
2,572 detected
One-Sided Trading Warning
The pair has buys but no sells - either honeypot or pre-launch silence.
871 detected
Single Holder Above 70% Warning
One wallet (excluding the pair) holds more than 70% of the supply.
1,309 detected
Single Holder Above 90% Danger
One wallet holds over 90% of the supply - total control of the float.
6,392 detected
Top 3 Hold 95% Warning
The three largest wallets control more than 95% of the supply.
8,392 detected
Sybil-Funded Holders Danger
Multiple top holders were funded by the same non-exchange wallet - fake demand, not real holders.
656 detected

Deployer Profiling (9)

New Wallet Warning
The deployer's wallet is less than 7 days old - disposable identity.
12,387 detected
Young Wallet Info
The deployer's wallet is 7-30 days old - softer version of `new_wallet`.
2,906 detected
Previous Scam Tokens Danger
The deployer has previously deployed tokens that RektRadar flagged as scams.
70 detected
Previous Risky Tokens Warning
The deployer has previously deployed tokens scored 50-70 - risky but not confirmed scams.
2 detected
Prolific Deployer Warning
The wallet has deployed 50+ contracts - likely a token factory operator.
4,019 detected
Mass Deployer Danger
The wallet has deployed 200+ contracts - almost certainly an automated scam factory.
8,589 detected
Mostly Deploys Contracts Warning
Over 80% of this wallet's transactions are contract deployments - no real on-chain life.
286 detected
Serial Scammer Danger
The deployer has multiple confirmed scam deploys - a known bad actor.
1,465 detected
Disposable Wallet Warning
The deployer wallet was emptied shortly after the deploy - built to be abandoned.
4 detected

Network Graph (10)

Mass Deployer Network Warning
The deployer's funding chain leads to a known mass-deployer wallet - same operator, different identity.
650 detected
Serial Scammer Network Danger
The deployer is funded by, or funds, a known serial scammer - guilt by graph association.
19 detected
Funded by Scam Factory Danger
The funder has previously bankrolled multiple scam deploys - it's a scam-factory bank.
2,007 detected
No Graph Data Info
The deployer has no funding-graph history - the wallet's origins cannot be traced.
42,108 detected
Mass-Funding Wallet Warning
The wallet that funded this deployer has bankrolled many other deployers - a scam-funding hub.
12,786 detected
Large Deployer Cluster Warning
The deployer belongs to a tightly connected cluster of many addresses acting as one operator.
3,243 detected
Blacklisted Cluster Danger
The deployer's cluster has already been flagged for producing confirmed scams.
621 detected
Deploys Scam Bytecode Danger
The deployer has a history of shipping contracts whose bytecode matches confirmed scams.
3,663 detected
Synchronized Deployer Activity Warning
Multiple cluster wallets act in the same blocks, betraying a single coordinated operator.
764 detected
Zero-Balance Deployer Info
The deploying wallet holds no ETH - a disposable, single-use address.
1,415 detected

Swap Activity (6)

High Buy Ratio Warning
Buys outnumber sells by 10x or more - abnormal trading distribution.
576 detected
Elevated Sell Fee Info
Sells incur a 5-15% fee - high but not yet rug territory.
90 detected
Moderate Sell Fee Warning
Sell fee in the 15-30% range - punitive enough to discourage exits.
71 detected
High Sell Fee Danger
Sell fee in the 30-50% range - soft rug, exits are economically unviable.
134 detected
Extreme Sell Fee Danger
Sell fee above 50% - borderline honeypot, the contract drains exits.
2,943 detected
Normal Fees Info
Fees are within normal Uniswap range - neutral signal, no specific risk.
7,759 detected

Post-Launch Monitoring (7)

Liquidity Decreased Danger
More than 80% of the pair's WETH liquidity has been pulled since the initial analysis.
325 detected
Risk Changed Post-Analysis Warning
Something material changed after the initial verdict - the score was recomputed from live monitoring.
404 detected
Ownership Reclaimed Danger
Ownership was renounced... then transferred back to a live address.
Fee Changed Post-Launch Danger
Fee-update events fired after the initial analysis - launch taxes were a costume.
1 detected
Trading Paused Post-Launch Danger
The contract reports paused = true after launch - all exits are currently frozen.
8 detected
Supply Inflated Danger
totalSupply grew more than 10% since the analysis - someone is minting.
33 detected
Slow Rug Detected Danger
Liquidity has been drained gradually - over half the peak WETH reserve is gone.
259 detected

Signals on the roadmap (16)

These detections are documented but not yet emitted by the live pipeline - the analyzer or data source is still being wired up. They are listed for transparency and are not counted in the active signal totals above.

Sell Explicitly Blocked Roadmap
Sells revert with an explicit guard - not a slippage issue, an intent.
Maximum Sell Limit Roadmap
Sells above a threshold are blocked - exit caps drag liquidity providers underwater.
Anti-Bot Cooldown Roadmap
Mandatory delay between transfers - slows down sells, helps the operator front-run.
Trading Not Enabled Roadmap
The contract has a `tradingEnabled` switch and it is currently off.
Proxy Admin Role Roadmap
An admin role exists and can change the proxy's implementation contract.
UUPS Proxy Roadmap
The implementation contract holds its own upgrade logic - accidental brick risk plus rug risk.
LP Not Burned Roadmap
LP tokens are still held by an EOA - neither burned nor locked.
Mixer-Funded Roadmap
The deployer's ETH was sourced from Tornado Cash or another mixer.
Fresh Deployer Funded by Fresh Wallet Roadmap
Both the deployer and the funder are wallets less than a few days old.
Analyzer Panic Roadmap
An internal analyzer step crashed - the result is incomplete.
Extreme Hardcoded Sell Fee Roadmap
The verified source hardcodes a near-total sell tax (90%+), so selling burns almost the entire position.
Liquidity Removed Roadmap
Post-launch monitoring saw the pair's liquidity drop to zero - the rug has happened.
LP Lock Partial Roadmap
Only part of the liquidity is locked - the rest sits with a wallet the operator controls.
LP Lock Expiring Soon Roadmap
The liquidity lock unlocks within days - the operator can withdraw it very soon.
Proxy Points to No Code Roadmap
The proxy delegatecalls into an address that currently holds no code - a trap or a not-yet-set logic.
Proxy Implementation Is a Known Scam Roadmap
The implementation behind the proxy is byte-identical to a confirmed mass-scam factory.

FAQ

What is a honeypot token?

The name comes from the bait: the contract dangles a normal-looking, buyable token to lure ETH in, then springs the trap when you try to sell. Unlike a rug pull, where the liquidity is yanked, here the liquidity stays put - it is your ability to exit that is removed. So buys succeed and sells revert.

How do I check if a token is a honeypot?

Paste the contract address on rektradar.io - no wallet connection, no signup. You get a risk score in about two seconds, and if the honeypot check or any of the 100+ signals fired, they appear at the top of the report with a plain-English explanation of each.

How many risk signals does RektRadar track?

RektRadar tracks 100+ distinct on-chain signals across 8 analyzers: honeypot simulation, source-code analysis, bytecode patterns, liquidity analysis, holder distribution, deployer profiling, on-chain network graph, and live swap activity. Each signal is documented on this page.

Is RektRadar free?

Yes. Pasting a contract address and getting the risk score plus the list of raised signals is free, no signup required. Premium plans add bulk scanning, alerting, an API and access to deployer-graph forensics.

Does RektRadar work on chains other than Ethereum?

RektRadar focuses on Ethereum mainnet. The honeypot simulator, deployer graph and swap-activity analyzer all rely on three dedicated Ethereum nodes (Nethermind + Lighthouse) with full archive and mempool access - replicating that on another chain is on the roadmap but not live yet.

Scan a contract on RektRadar →