How to Check if a Token Is a Honeypot Before You Buy

Video transcript

A honeypot token lets you buy and stops you selling. These checks take minutes. None of them is a guarantee on its own, so use several.

The unofficial Squid Game token climbed while some buyers said they could not sell. Then its developers sold for 11.9 million dollars, and the price collapsed.

Most honeypots hide in powers the owner keeps. Look for blacklists, adjustable taxes, trading switches, mint functions and upgradeable proxies.

First, read the contract. Confirm the source is verified, read the transfer logic, list the owner-only setters, look for fee caps, and check for a proxy.

Next, simulate a sell before you commit real money. Use a simulator, run your own fork with Foundry's Anvil, and check whether real holders have sold.

A pass is not a clearance. An owner can set an outrageous tax for one assigned address, so a fresh test wallet passes while real buyers stay trapped.

Then check liquidity, because a sellable token can still empty out. See who holds the LP tokens, read any locker's unlock date, and look for large top holders.

Scanners are fast, but each documents its limits. Honeypot dot is calls its own check not a foolproof method. Use more than one tool, and treat missing data as a warning, not a pass.

Every pattern here is an owner power, and a Guardian smart contract audit reports powers like these. Read the full checklist below, or talk to Guardian at guardian.security.

A honeypot token lets you buy and stops you selling. The sell reverts, or a tax takes almost all of it.

The unofficial Squid Game token climbed to $2,856 while some buyers said they could not sell. A lock-up function in its contract appeared designed to prevent sales, The Block reported.

Then the developers sold for 22,328 BNB ($11.9 million), and the price fell to $0.00079 (The Block, November 1, 2021).

The checks below take minutes. None is a guarantee on its own, so use several.

How Honeypot Contracts Work

Most honeypots hide in the token's transfer logic, or in powers the owner keeps. GoPlus Security's token API flags the common ones.

The same patterns turn up in honest code. One Guardian audit found a setTaxRate that allowed a 99.99% tax (Hamsters of Opera, Medium).

Another found a launch check that a token creator could bypass to mint hidden supply to itself (Clanker, High). Both were resolved.

Blacklists, pauses and upgrades also break protocols that integrate tokens. See our weird ERC-20 checklist.

Read the Contract

Start on the block explorer, on the token's contract page.

1. Find verified source. Without it, you cannot see the rules you are buying into.
2. Read the transfer logic. Read every condition in _transfer, and in any hook it calls.
3. List owner-only functions. Look for fee, blacklist, trading, mint and balance setters.
4. Look for caps. A fee setter with no maximum can reach 100%.
5. Check the owner. A renounced owner means little if a hidden owner or reclaim function exists.
6. Check for a proxy. If the token is a proxy, read the implementation, and assume it can change.

Closed source is a red flag in itself. GoPlus warns that closed-source contracts "may hide various unknown mechanisms," and returns no data for its other risk checks.

EIP-1967 stores a proxy's logic address in a standard slot, so block explorers can show it. GoPlus notes that most proxies point to implementations that can be modified.

On Solana

Read the token's mint account. A mint authority set to None fixes the supply for good.

A freeze authority can freeze token accounts. Instructions that use a frozen account fail until it is thawed, so you cannot sell.

Simulate a Sell

A sell test answers the question directly. Run it before you commit real money.

• Use a simulator. Honeypot.is "simulates a buy and a sell transaction" on Ethereum, BNB Chain and Base, and reports both taxes.
• Run your own fork. Foundry's Anvil forks a live chain with --fork-url. Buy a little there, sell it, and compare what comes back.
• Check real holders. Honeypot.is also checks whether a sample of holders can sell, and flags high failure rates.

A passing test shows today's rules for one wallet.

GoPlus notes an owner can set "a very outrageous tax rate for an assigned address" to block it from trading. A fresh test wallet can pass while real buyers are trapped.

Check Liquidity and Ownership

A token can be sellable and still empty out. If the deployer pulls the pool's liquidity, there is nothing left to sell into.

In Uniswap V2-style pools, liquidity providers hold LP tokens and burn them to withdraw their share. Whoever holds the LP tokens controls that liquidity.

• Find the pool, and check who holds its LP tokens.
• If they are "locked", open the locker contract and read the unlock date and owner.
• Check top holders. One wallet with a large share can sell into the pool at any time.
• Check whether the owner can mint, which dilutes the pool the same way.

At SQUID, once the developers' tokens unlocked, they sold on PancakeSwap and took nearly all of the liquidity, per The Block.

For the issuer's side of LP custody, see our token launch checklist.

Scanners and Their Blind Spots

Scanners are fast. Each checks known patterns, and each documents its limits.

Honeypot.is calls its check "not a foolproof method," and warns: "Just because it's not a honeypot now, does not mean it won't change!"

Its docs note that its contract code results are cached "and may be outdated."

GoPlus returns null for most risk checks on closed-source contracts. It notes that anti-bot and cooldown code can affect its sandbox, and that "No return means unknown."

Its LP lock check only recognizes the lock and burn addresses it has included.

Use more than one tool, and treat missing data as a warning, not a pass.

Honeypot Red Flag Checklist

1. The source code is not verified.
2. The owner can change buy or sell taxes, with no cap.
3. The owner can set taxes or blacklist status per address.
4. Transfers check a whitelist, a trading flag or a cooldown.
5. The owner can mint tokens or edit balances.
6. The token is an upgradeable proxy.
7. Ownership is renounced, but a hidden owner or reclaim function exists.
8. A simulated sell fails, or loses far more than the stated tax.
9. Many wallets have bought, and few have sold.
10. The deployer holds unlocked LP tokens or a large share of supply.
11. A scanner returns no data for key checks.

If you approved a token contract or signed something you do not recognize, follow our drained wallet checklist.

How Guardian Helps

Every pattern above is an owner power. A Guardian smart contract audit attacks privileged flows and upgrade paths, and reports powers like these, as the two findings above show.

An OpSec audit maps who can upgrade, pause, mint or set parameters, and whether that sits behind a threshold or a single key.

Frequently Asked Questions

What does it mean if a token is a honeypot?

You can buy it but cannot sell it, or every sell is taxed to almost nothing. The contract's transfer rules, or powers its owner keeps, block or drain sells while buys still work.

Can a honeypot checker guarantee a token is safe?

No. Honeypot.is calls its own check "not a foolproof method," and an owner can change taxes, blacklists or code after a test passes. Read the contract and check who controls it as well.

Why can I buy a token but not sell it?

Usually a condition in the transfer logic that only applies to sells: a blacklist, a whitelist, a trading switch or a sell tax near 100%. The verified source and a simulated sell show which one.

Is a token with renounced ownership safe from honeypot changes?

Not always. A hidden owner, a function that reclaims ownership or an upgradeable proxy can keep control after ownership is renounced. GoPlus flags hidden owners and reclaimable ownership for this reason.

Sources

• The Block: Unofficial Squid Game Token Crashes 99% as Devs Dump for $12 Million (November 1, 2021)
• GoPlus Security: Token Security API, Response Details (accessed November 6, 2026)
• Honeypot.is: Honeypot Detector (accessed November 6, 2026)
• Honeypot.is docs: Honeypot Checks (accessed November 6, 2026)
• Honeypot.is docs: Summary Flags (accessed November 6, 2026)
• Foundry: anvil reference
• Ethereum Improvement Proposals: EIP-1967, Proxy Storage Slots
• Solana Program Library: Token
• Uniswap docs: V2 Pools
• Guardian: Hamsters of Opera Protocol Review (April 2, 2022)
• Guardian: Clanker Protocol Review (August 5, 2026)
• Guardian: OpSec audit