← All Guides

How to Avoid Rug Pulls on Base

Published 2024-12-01 · Updated 2026-08-10

A rug pull is any token launch engineered so insiders can extract the money and leave holders with nothing. On Base — Coinbase's Ethereum L2, where deploying a contract costs pennies and a swap costs fractions of a cent — the economics overwhelmingly favor the attacker. Solidus Labs counted more than 500 scam tokens deployed on Base between its developer launch on July 13, 2023 and its public launch in August 2023, before the chain even officially opened (soliduslabs.com). GoPlus later found that roughly two thirds of all new tokens created on Base in its first ten months tripped at least one security flag (goplussecurity.medium.com). Scam tokens are not an occasional hazard here; they are the statistical majority of what gets deployed.

The good news is that almost every rug uses one of four known mechanisms — the liquidity pull, the honeypot, the mint or permission rug, and the slow rug — and each mechanism leaves fingerprints on-chain before it fires. A trader who spends five disciplined minutes on BaseScan, a security API, and a holder-distribution check will walk away from the vast majority of traps. The attackers know this too, which is why the modern scam stack extends past the token contract into approval phishing, wallet drainers, address poisoning, and social-engineering plays that target you rather than your token pick.

This guide covers all of it: how each of the four rug mechanisms works at the contract level, the exact BaseScan and GoPlus checks that expose them, the adjacent attack vectors that drain wallets without any token purchase at all, a full approval-hygiene walkthrough with revoke.cash, what to do in the worst case, and — because no tool catches everything — why position sizing is the defense that works when every check has passed and the rug happens anyway. Everything here is educational; nothing is investment advice.

Rug Pulls on Base: Why the Problem Is Structural

Every property that makes Base attractive to builders makes it attractive to scammers. Deployment is permissionless — anyone with a wallet can publish an ERC-20 contract in one transaction. Fees are negligible — since EIP-4844 blobs landed in March 2024, a contract deployment typically costs well under a dollar and a swap costs fractions of a cent, so a scammer can deploy hundreds of variations of the same trap and profit if even one catches (docs.base.org). Liquidity is permissionless too: seeding a Uniswap or Aerodrome pool requires no listing review, no identity, and no minimum commitment. The result is a token firehose in which fraud is cheap to attempt and expensive only for the victims.

The scale is documented. In a study covering August 1, 2023 through May 24, 2024, GoPlus Security identified 564,180 suspected risky tokens across five Ethereum L2s — and Base alone accounted for 381,790 of them, about 66.6% of the 573,484 new tokens created on the chain in that window (goplussecurity.medium.com). The flagged risks ranged from honeypot mechanics and blacklist functions to hidden owners, transfer freezing, balance manipulation, and self-destruct capability. In Q4 2024 alone, GoPlus flagged tens of thousands of additional risky tokens on Base as memecoin launch activity accelerated (gopluslabs.io).

Base's launch period set the tone. Solidus Labs found that of the 500+ scam tokens deployed before the public launch, roughly 300 contained hidden functions letting creators mint unlimited new supply, about 70 carried concealed transaction-fee modifiers, and over 60 were honeypots that trapped buyers from ever selling. Those tokens attracted about $3.7 million in trading volume — including $300,000 of wash trading executed by the scammers themselves to fake demand — and netted the operators around $2 million, of which $1.7 million was extracted through liquidity drains (soliduslabs.com). The infamous BALD memecoin, launched in the same pre-launch window, saw its creator extract an estimated $5.2 million through price and volume manipulation before pulling liquidity (soliduslabs.com).

None of this means Base is unusually dangerous relative to other permissionless chains — GoPlus flagged an even higher percentage of new tokens on Optimism and Arbitrum in the same study — but it does mean the default assumption for any unknown Base token should be hostile until verified. The rest of this guide is the verification.

What the Data Says: Crypto Scam and Rug-Pull Losses

Industry trackers measure the problem from different angles, and the differences are instructive. Chainalysis, which measures on-chain scam revenue at the ecosystem level, estimated that at least $14 billion flowed to crypto scams in 2025, a figure it expects to grow past $17 billion as more scam addresses are attributed over time — and noted that AI tooling made scams dramatically more scalable, with impersonation schemes growing about 1,400% year over year (chainalysis.com).

CertiK's Hack3d report for 2024 counted about $2.3 billion lost across 760 discrete on-chain security incidents — a 31.6% increase in value over 2023 — with phishing the single largest vector at roughly $1 billion and about 39% of all incidents (certik.com). Immunefi's 2024 tally, which counts incident-level losses, recorded $1.49 billion, of which fraud (the category containing rug pulls and scams) was only about $28 million — under 2% of the total, but up 72% year over year (immunefi.com). The gap between these numbers and Chainalysis's ecosystem-level billions tells you something important: rug pulls are individually small and rarely make incident databases. A $40,000 memecoin rug never gets a post-mortem. The losses are death by ten thousand cuts, which is exactly why they don't generate the headlines that would teach people to avoid them.

Two adjacent numbers complete the picture. Scam Sniffer tracked $494 million stolen by wallet-drainer phishing in 2024 — up 67% from 2023, across roughly 332,000 victim addresses, with the single largest theft at $55.4 million (scamsniffer.io). And Chainalysis's study of approval phishing — the technique of tricking users into granting token allowances to attacker contracts — found at least $1 billion stolen via that method since May 2021, including an estimated $516.8 million in 2022 and $374.6 million in 2023 through November (chainalysis.com). The lesson of the data is that "avoiding rug pulls" is really two disciplines: vetting tokens before you buy, and protecting your wallet from attacks that need no purchase at all. This guide covers both.

The Four Rug-Pull Mechanisms at a Glance

Nearly every token rug is a variation on four mechanisms. Naming them precisely matters, because each one is exposed by a different check — a token can pass three of the four screens and still be a trap on the fourth.

Analysts sometimes split these into "hard rugs" (the first three, where malicious code or a single decisive act does the damage) and "soft rugs" (the fourth, where the extraction is just selling). Soft rugs are by far the most common because they are the hardest to prosecute and the easiest to execute — Solidus Labs found that 93% of the 388,000 liquidity pools it analyzed on one major launch platform showed soft-rug characteristics (soliduslabs.com). Hard rugs are rarer but faster and total.

The four mechanisms also stack. A typical sophisticated rug launches with clean-looking code, locked liquidity, and renounced ownership — passing every automated check — while insiders hold 60% of supply across thirty fresh wallets. The sections that follow take each mechanism in turn: how the contract functions actually work, what the on-chain fingerprints look like, and the exact verification steps on BaseScan and GoPlus. If you want the compressed version, the Base meme coin risk checklist distills these into ten yes/no questions.

Mechanism 1: The Liquidity Pull

The original rug, and still the cleanest kill. On an automated market maker like Uniswap or Aerodrome, a token's entire market is a pool holding two assets — the token and something valuable like WETH. Whoever deposits liquidity receives LP tokens (on Uniswap v2-style pools) or a position NFT (on v3/Slipstream-style concentrated pools) representing a claim on the pool's contents. Whoever holds that claim can call the withdrawal function at any time and take both sides of the pool out. If the deployer seeded the only pool and kept the LP tokens, then every buyer's ability to ever sell exists at the deployer's pleasure. One transaction — a removeLiquidity call — converts every holder's tokens into unsellable numbers, because a pool with no WETH in it pays nothing for tokens.

The on-chain fingerprint is straightforward: the LP tokens sit in the deployer's wallet, or in a fresh wallet funded by the deployer. Some operators add camouflage — moving LP tokens through two or three intermediate wallets, or locking a token amount for a trivially short period — but the chain records every hop. Solidus Labs attributed $1.7 million of the roughly $2 million extracted by Base's pre-launch scam wave specifically to liquidity drains (soliduslabs.com), and the BALD incident in the same period showed the mechanism at memecoin scale: liquidity in, hype up, liquidity out, market dead within days of launch.

There are only two credible closures of this vector. Burning the LP tokens — sending them to the dead address (0x…dead) or the zero address — makes withdrawal permanently impossible; the liquidity stays in the pool forever. Locking them in a recognized time-lock contract (services like Team Finance or UNCX operate on Base) makes withdrawal impossible until the lock expires — which means you must check the unlock date, not just the word "locked." A 30-day lock on a token designed for a 2-week pump is not protection; it is a scheduled rug. Launch platforms have partially standardized this away: tokens deployed through Clanker, the Farcaster launch bot, ship with liquidity locked by design, which is one reason standardized launchpads have grown popular — though as we'll see, locked liquidity closes exactly one of the four vectors and none of the others.

How to Verify Liquidity Locks and Burns on BaseScan

This check takes about three minutes once you've done it twice. You are answering one question: who can withdraw the pool?

Two traps to avoid while reading. First, percentage matters: 80% of LP burned with 20% in the deployer's wallet still lets the deployer drain a fifth of the pool — and on a thin pool, a 20% drain through the price curve can take much more than 20% of the value. Second, liquidity can be re-rugged socially: a project that "migrates liquidity to a new pool" is asking everyone to accept a fresh unlocked pool. For a deeper treatment of pool depth, impact, and what liquidity numbers actually mean, see How to Read Token Liquidity.

Mechanism 2: The Honeypot

A honeypot allows buys but blocks sells. The chart only ever goes up — because the only sells ever executed are the deployer's — and that spectacular chart is the bait. GoPlus found honeypot mechanics among the most common flags across the hundreds of thousands of risky tokens it identified on Base and other L2s (goplussecurity.medium.com), and over 60 of Base's original pre-launch scam tokens were honeypots (soliduslabs.com).

Under the hood, honeypots are variations on a few contract patterns. The crudest override the token's internal _transfer function with a blacklist: every buyer's address gets silently added to a mapping, and transfers from blacklisted addresses revert — often with a misleading error so the failed sell looks like user error. A second family uses transfer restrictions: a maximum-transaction amount set to zero after launch, a trading-enabled flag the owner flips off, or a cooldown that makes selling practically impossible. A third family taxes instead of blocking: the sell tax is owner-settable and gets cranked to 99–100%, so sells technically succeed but pay the seller nothing — the tax is routed to the deployer. GoPlus's API distinguishes these with separate flags: is_honeypot, cannot_sell_all (contracts that force you to leave a balance behind), slippage_modifiable (editable taxes), transfer_pausable, and is_blacklisted (gopluslabs.io).

The nastiest variants are conditional. Time-delayed honeypots trade normally for the first hours or days — long enough to pass every simulation and accumulate victims — then activate via a block-number check or an owner transaction. Others whitelist known simulator addresses so automated checkers see a working sell while real users can't exit. Some newer variants flagged by GoPlus go further, using gas-abuse and external-call tricks so that merely interacting with the token wastes or extracts value (gopluslabs.io). This is why honeypot detection is necessary but never sufficient: a passing check proves the token is sellable right now, not that it will be sellable when you try.

The behavioral tell remains the strongest evidence: real, recent, successful sells by ordinary wallets that are not the deployer or its funding tree. A token with 500 buys and 3 sells — all three from wallets the deployer funded — is a honeypot regardless of what any scanner says. Chart shape is never evidence; honeypots have the best-looking charts on the chain by construction.

How to Run a Honeypot Check: GoPlus and honeypot.is

Run both of these before any buy of an unknown token; together they take under a minute.

Interpretation rules: any single hard failure — failed sell simulation, is_honeypot true, owner_change_balance true, unverified source — disqualifies the token outright. Do not average a hard failure against good signals elsewhere; honeypot authors deliberately buy good signals (locked liquidity, renounced ownership, paid trending slots) to offset the one flag they cannot hide. And remember the temporal limit: a check is a snapshot. If the contract retains owner permissions, the token you checked at noon is not necessarily the token that exists at midnight. That's the next mechanism.

Mechanism 3: The Mint and Permission Rug

An ERC-20 contract is just code, and code can reserve powers. The mint rug is the plainest version: the contract keeps a function — often named something innocuous or buried behind obfuscated logic — that lets a privileged address create new tokens at will. The insider mints a mountain of supply and dumps it into the pool, extracting the WETH side and collapsing the price in one motion. Roughly 300 of Base's original 500+ pre-launch scam tokens carried hidden unlimited-mint functions, and about $300,000 of the scammers' haul came specifically from minting new coins and selling them for ETH (soliduslabs.com). A related trick skips mint entirely: owner_change_balance functions let the operator directly rewrite the balances mapping — setting your balance to zero or their own to billions — which GoPlus flags as one of its most severe risks (gopluslabs.io).

The permission rug generalizes this. Any owner-settable parameter is a rule that can change after you buy: settable taxes (launch at 2%, harvest at 99%), pausable trading, editable max-wallet and max-transaction limits, blacklist admission. The upgradable proxy is the master key — if the token is a proxy contract, the implementation behind it can be swapped entirely, converting a clean, audited token into a honeypot in one transaction. GoPlus's is_proxy flag exists for exactly this reason. And "renounced ownership," the badge marketed as the cure, has known counterfeits: hidden_owner patterns retain control through a second privileged address after the visible owner renounces, and can_take_back_ownership functions let a "renounced" deployer reclaim control later (gopluslabs.io).

Verification is mostly reading flags plus one non-negotiable rule. On BaseScan, an unverified contract — no published source code — is an automatic disqualifier, full stop: hidden code is hidden rules, and legitimate teams verify source as a matter of course since it costs nothing. For verified contracts, GoPlus's permission flags (is_mintable, owner-related flags, is_proxy, pausable and tax flags) summarize what a manual read would find. If you do read source, search for the strings "mint", "onlyOwner", "blacklist", "setFee", and "upgradeTo" — five searches that surface the majority of retained powers.

The honest caveat: retained permissions are not always malicious. Serious DeFi protocols keep upgradability and admin roles for safety and iteration, usually behind multisigs and timelocks. Context is the discriminator — a week-old memecoin with a mint function has no legitimate use for it; a year-old protocol with a documented multisig might. For anonymous memecoin launches, hold the strict line.

Mechanism 4: The Slow Rug

The slow rug is the one that beats checklists, because there is nothing wrong with the contract. Liquidity: locked. Ownership: renounced. Honeypot check: clean. Source: verified. The extraction mechanism is simply that insiders hold a dominant share of supply — allocated to themselves at launch for free — and sell it into every wave of buying until there is nothing left. No single transaction is a crime scene; the chart just bleeds 10% a day for a month while the community is told to trust the roadmap. The "locked liquidity" and "renounced" badges remain technically true the entire way down. Incident trackers barely register slow rugs — which is part of why Immunefi's fraud category shows only $28 million for all of 2024 while ecosystem-level scam-revenue estimates run to billions (immunefi.com, chainalysis.com) — but distribution-driven extraction is the most common way memecoin buyers actually lose money. Solidus Labs' finding that 93% of pools on one major launch platform showed soft-rug characteristics gives a sense of the base rate on permissionless launchpads (soliduslabs.com).

The defense is distribution analysis, and it lives in BaseScan's Holders tab. The raw top-ten list is misleading on its own — pools, lockers, and burn addresses legitimately hold large shares — so the method is: exclude the pair contract, locker contracts, and dead/zero addresses, then ask what share of the circulating float the top real wallets control. There's no magic threshold, but as a working heuristic, a launch where the top ten non-pool wallets hold more than 25–30% of float has a structural seller problem, and anything approaching 50% means the "market" is a handful of people deciding when to exit.

Then look for sybils — one seller wearing camouflage. The fingerprints: many wallets holding suspiciously similar balances (thirty wallets each holding 0.8–1.1% of supply), all funded from the same source wallet within minutes of each other, all buying in the token's first blocks before any public announcement. Click into a few top holders and check their funding transaction; if they trace to the deployer or to one common wallet, treat them as a single position. Finally, read the deployer's history: BaseScan's contract page links the creator address, and a creator who has deployed six tokens in three months — each now at zero — is showing you the business model. The risk checklist guide covers the distribution heuristics in more depth.

The Five-Minute Pre-Trade Routine

Here is the full routine, consolidated and ordered so the cheapest checks run first. With practice it genuinely takes about five minutes, and it catches the overwhelming majority of the traps described above.

Two rules govern the routine. First, hard failures are absolute: unverified code, failed sells, unlocked liquidity, and balance-manipulation powers are walk-aways, not discounts — no community enthusiasm or chart shape buys them back. Second, passing everything is a floor, not a ceiling: the routine certifies that a token is not one of the known trap patterns today. It does not certify the team's intentions, the token's staying power, or tomorrow's contract state. This distinction — screening versus endorsement — is the entire epistemology of token safety, and it's why the final section of this guide is about position sizing rather than better checklists. If you're hunting brand-new launches, where every one of these risks is at maximum, the new Base tokens page and the new meme coins guide apply this routine to the launch firehose specifically.

Where the BaseBubbles Risk Score Fits In

Every token on the BaseBubbles map carries a 0–100 risk score where higher scores flag higher risk: scores of 0–30 indicate lower structural risk, and scores above 60 flag elevated risk. The score is computed from live market-structure data refreshed with the rest of the map: liquidity depth (thin pools rug easier and slip harder), pair age (the overwhelming majority of scams die young, so youth itself is risk), website and social presence (anonymous, linkless launches correlate with abandonment), volatility, and trading volume. The Risk Scanner exposes the same analysis for any Base contract address you paste in, with the contributing flags named individually, and the methodology guide documents the full pipeline.

Understand what the score is and is not. It is a structural screen: it automates several checks from this guide's routine — the liquidity and maturity dimensions especially — and it is good at surfacing the profile that precedes most rugs: young pair, shallow pool, no web presence, erratic volume. It is not an audit, not a contract-level code analysis, and not a guarantee in either direction. A high score means a token passes basic structural checks, not that its team is honest; a low score means the structure is consistent with elevated risk, not that fraud is proven — plenty of legitimate launches begin life with a thin pool and a young pair. The score also cannot see intentions: a slow rug with locked liquidity, renounced ownership, and a real website can score respectably right up until the insiders finish distributing.

The practical workflow is layering. Use the map to notice tokens — the bubble view makes divergences visible, like heavy volume on a token whose risk badge is dark. Use the Risk Scanner as step seven of the pre-trade routine, a fast cross-check that you didn't miss a structural problem. Then do the contract-level work (GoPlus flags, LP trace, holder scan) that no market-structure score can do for you. Tools that overlap are a feature, not redundancy: every automated check has blind spots, and the checks are cheap while the failures are expensive. Treat any single tool — including ours — claiming to be a complete rug detector as overpromising by definition.

Approval Phishing and Wallet Drainers

Everything so far assumed the attacker needs you to buy their token. The approval-phishing family skips that step: instead of selling you a trap, the attacker gets you to sign one. The numbers rival token rugs — Chainalysis attributes at least $1 billion in losses to approval phishing since May 2021, with an estimated $516.8 million in 2022 and $374.6 million in 2023 through November (chainalysis.com), while Scam Sniffer tracked $494 million drained via phishing signatures in 2024 alone, up 67% year over year, from about 332,000 victim addresses (scamsniffer.io).

The mechanism abuses a legitimate primitive. ERC-20 tokens implement approve(spender, amount): you grant a contract permission to move up to a set amount of your tokens, which is how every DEX swap works — you approve the router, the router pulls your tokens mid-swap. The attack is getting you to approve the attacker's contract instead, usually for unlimited amounts (interfaces historically defaulted to the maximum value so you'd never need to re-approve). Once signed, the attacker's contract can call transferFrom and empty that token from your wallet whenever it likes — no further action from you required, today or six months from now. Modern variants extend the same trick to signatures: EIP-2612 permit and Permit2 messages are off-chain signatures that authorize token movement without an on-chain approval transaction, so a "gasless" signature request on a phishing site can be a full allowance grant. NFT holders face setApprovalForAll, which hands over an entire collection in one signature.

The delivery vehicle is the drainer kit: turnkey drainer-as-a-service software that phishing crews rent, which detects your wallet's most valuable assets and generates precisely the malicious approval or signature bundle to extract them (scamsniffer.io). The bait layer is wherever you are: fake airdrop-claim pages, cloned DEX and bridge frontends reached through malicious ads or typosquatted URLs, "verify your wallet" bots, compromised project Discords and X accounts posting urgent claim links. Chainalysis also documents a patient variant — approval phishers building weeks of rapport, romance-scam style, before delivering the one link that matters (chainalysis.com).

Defenses are behavioral. Never sign a transaction you don't understand — wallets like Rabby and modern Coinbase Wallet simulate transactions and translate what a signature actually grants; read that output every time. Reach dapps by bookmark, never by ad click or DM link. Treat any unexpected "claim," "verify," or "migrate" prompt as hostile until independently confirmed. And cap the blast radius with approval hygiene — the revoke.cash section below.

Address Poisoning, Fake Airdrops, and Dust in Your Wallet

Address poisoning attacks your transaction history rather than your signatures. The attacker generates a vanity address whose first and last four-to-six characters match an address you actually transact with — trivially cheap to brute-force, since wallets and explorers display addresses as 0xd9A1…3f7b with the middle elided. They then send you a zero-value or dust transaction from that lookalike, planting it in your history. The trap springs later, when you copy "your usual address" from the history list instead of from a verified source and send real funds to the impostor. The canonical case: in May 2024 a whale sent 1,155 WBTC — about $68 million — to a poisoned lookalike address; the funds were returned about a week later only after intense negotiation and on-chain pressure from investigators, an outcome nobody should plan on (coindesk.com). A quirk of the ERC-20 standard makes the history-planting worse: transferFrom with a zero amount succeeds without any approval, letting attackers fabricate history entries that appear to come from addresses you know (chainalysis.com).

Defenses are mechanical and cheap:

Fake airdrops are the same ambush from a different angle. Scam tokens and NFTs appear unsolicited in your wallet, often named as URLs ("Claim-rewards-site.xyz") or impersonating real projects' pending drops. The token itself sitting in your wallet is harmless — receiving is permissionless and requires nothing from you. The trap is interaction: visiting the URL leads to a drainer site requesting approvals, and attempting to swap or interact with the scam token's own contract can trigger malicious code paths, including the gas-abuse patterns GoPlus now flags (gopluslabs.io). The correct handling is total inaction: don't visit, don't swap, don't even revoke-interact with the token contract; just hide it in your wallet UI. Legitimate airdrops on Base are claimed at official project domains announced through official channels — never through tokens that announce themselves.

Impersonation, Fake Audits, and Compromised Channels

Rugs are marketing operations, and the off-chain production values improve every year — Chainalysis measured impersonation scams growing roughly 1,400% year over year in 2025 as AI content generation made fake teams, fake support agents, and fake communities nearly free to manufacture (chainalysis.com). Knowing the standard plays defangs most of them.

The unifying defense is that the chain is your lie detector. Every factual claim a project makes — locked liquidity, burned supply, team allocation, partnership contracts — either matches what BaseScan shows or it does not. When the story and the chain disagree, the chain is telling the truth.

Approval Hygiene: A revoke.cash Walkthrough

Every approval you've ever granted is still live unless you revoked it — a standing authorization sitting in a contract's storage, waiting. Most people who traded through a memecoin cycle are carrying dozens of unlimited allowances to contracts they interacted with once, some of which will eventually be exploited, upgraded maliciously, or turn out to have been traps all along. Approval hygiene is the practice of auditing and pruning them, and revoke.cash is the standard free tool; it supports Base natively.

The walkthrough:

Understand the tool's limits precisely. Revoking prevents future transfers under that allowance; it cannot recover tokens already taken. And revoking does nothing for a compromised private key — if your seed phrase leaked, the attacker is you as far as the chain is concerned, and the only move is evacuating everything to a fresh wallet immediately. Approval hygiene addresses the "I signed something bad" failure mode, not the "someone has my keys" one.

Incident Response: If You Get Rugged Anyway

Assume it happens eventually — to careful people too. What separates an annoyance from a catastrophe is mostly what you do in the first hour, and what you sized the position at before any of it started.

Contain first, from a calm state. Diagnose which failure mode you're in. If a token you bought rugged — liquidity pulled, honeypot activated, insiders dumped — your wallet itself is typically not compromised; the loss is contained to that position. Revoke any approvals you granted in the course of trading it (the token's contract, any unfamiliar router or bot you used) via revoke.cash, and stop interacting with the token entirely. If instead you signed something on a phishing site, treat it as an active drain in progress: revoke everything suspicious immediately, and move remaining high-value assets to a clean wallet as a precaution. If your seed phrase or private key was exposed, skip revocation theater — evacuate every asset to a fresh wallet now, highest value first, and abandon the compromised address permanently.

Do not get hunted twice. The aftermath of every rug is a second hunting ground: "recovery services" that DM victims promising to retrieve funds for an upfront fee, fake "compensation snapshots" and refund tokens, phishing sites impersonating law enforcement portals. On-chain theft is effectively irreversible by design; anyone who contacts you claiming otherwise is running the second half of the scam. The $68 million WBTC address-poisoning return was a newsworthy exception involving professional investigators and public pressure, not a service you can buy (coindesk.com).

Report it, briefly and through real channels. Report the token or site on Chainabuse (TRM Labs' free multi-chain reporting platform at chainabuse.com), flag phishing domains to Google Safe Browsing and the wallet vendors, report the token on the screeners where it's listed, and — for meaningful sums in the US — file with the FBI's IC3 at ic3.gov and the FTC at reportfraud.ftc.gov. Reports rarely recover funds, but they feed the blocklists and investigations that protect the next person, and a contemporaneous report strengthens any later legal or tax position.

Document for taxes. Record everything while it's fresh: transaction hashes, dates, amounts, what you paid, screenshots of the token page and any scam communications. Tax treatment of scam and theft losses varies sharply by jurisdiction and by the shape of the loss — in some jurisdictions disposing of the worthless tokens can realize a capital loss even where theft losses aren't deductible — so hand the documentation to a professional rather than guessing. Then make the one adjustment fully in your control: revisit position sizing, which is the final section for a reason.

The Limits of Every Tool — and Position Sizing as the Last Defense

Every check in this guide has a blind spot, and intellectual honesty about them is itself protective. Automated scanners pattern-match known trap structures: they catch the blacklist honeypot and the naked mint function, but time-delayed logic that activates after launch, simulator-aware contracts that show checkers a working sell, and novel obfuscation techniques all pass clean snapshots — GoPlus's own research chronicles a continuous arms race of new honeypot variants engineered specifically to evade the previous generation of detection (gopluslabs.io). LP locks expire, and "locked" tells you nothing after the unlock date. Renounced ownership has counterfeit versions with hidden owners and reclaim functions. Audits scope contract code, not tokenomics or team behavior. Holder analysis can be fooled by sufficiently patient sybil operations funded through exchanges to break the on-chain trail. And the slow rug — the most common extraction of all — requires no malicious code whatsoever, so a token can legitimately pass every automated check in existence and still be a coordinated exit in progress. The pre-launch Base scam wave is the standing proof that professional-grade deception ships on day one (soliduslabs.com).

This is why the final defense is not a better scanner but an allocation rule: size every position in an unvetted or young token such that a total, unrecoverable, overnight loss is an annoyance rather than an event. Not "unlikely to happen" — assume it will happen to some position eventually, because across enough launches the base rates guarantee it, and decide in advance that no single instance can matter. Corollaries follow: never add to a position because "it passed all the checks" (passing is a floor, not a signal); never let a winning position grow into a hole you can't absorb without taking some off; and never size up under time pressure, which is precisely the state scammers manufacture. Diversification across many small speculative positions beats concentration in one "verified" one, because verification certifies structure, not outcome.

Kept in that order — routine first, skepticism always, sizing as the backstop — rug pulls stop being an existential risk and become what they actually are: a known tax on a permissionless environment, payable only by those who skip the five minutes of reading the chain. The tools are free: BaseScan, GoPlus, honeypot.is, revoke.cash, and our Risk Scanner. The full toolkit, including wallets with built-in transaction simulation, is covered in Best Tools for Base Traders.

Frequently Asked Questions

Is there a free rug pull checker for Base?

Yes — several, and you should use more than one. GoPlus (gopluslabs.io) reads contract-level flags: honeypot behavior, buy/sell taxes, mint permissions, proxy risk, and blacklists. honeypot.is runs live sell simulations on Base pools. BaseScan verifies source code, LP token locations, and holder distribution for free. The BaseBubbles Risk Scanner (/risk-scanner) scores structural risk — liquidity depth, pair age, web presence, volatility, volume — for any Base contract address. No single checker is complete: automated tools catch known patterns, so combine a scanner pass with the manual liquidity and holder checks described in this guide.

Can a token still rug if liquidity is locked?

Yes. Locked liquidity closes exactly one of the four rug mechanisms — the liquidity pull — and none of the others. A token with locked LP can still be a honeypot, still carry mint or balance-editing permissions, and above all can still be slow-rugged by insiders dumping a dominant supply share into every rally. Locks also expire: a 30-day lock on a token built for a two-week pump is a scheduled rug, so always check the unlock date on the locker contract, not just the word 'locked'. Treat locked liquidity as one necessary check among five, never as a safety verdict.

Does renounced ownership make a Base token safe?

No. Renouncing ownership means the deployer gave up the contract's owner role, which does remove some rug vectors — the owner can no longer edit taxes, pause trading, or mint if those powers required ownership. But security scanners document counterfeit renounces: hidden-owner patterns that retain control through a second privileged address, and take-back functions that let a 'renounced' deployer reclaim ownership later (gopluslabs.io). And renouncing does nothing about the slow rug, since dumping a pre-allocated supply requires no owner powers at all. Check GoPlus's hidden_owner and can_take_back_ownership flags rather than trusting the badge.

How do I check if a Base token is a honeypot?

Run three checks. First, GoPlus (gopluslabs.io): enter the contract with Base selected and read is_honeypot, sell_tax, cannot_sell_all, transfer_pausable, and is_blacklisted. Second, honeypot.is: it simulates an actual buy and sell against the live pool and reports whether the sell succeeds and the real round-trip tax. Third — the step that catches simulator-aware and time-delayed honeypots — open the live transaction feed and confirm multiple unaffiliated wallets have executed successful sells recently, then click those wallets to verify they weren't funded by the deployer. A spectacular chart is never evidence; honeypots have the best charts by design.

Can I get my money back after a rug pull?

Almost never. On-chain transactions are irreversible by design, most rug operators are anonymous, and individual losses are usually too small for law enforcement to pursue. Publicized recoveries — like the $68 million WBTC address-poisoning return in May 2024 — involved professional investigators, negotiation, and public pressure, and are rare exceptions (coindesk.com). Critically, anyone who contacts you after a rug offering fund recovery for a fee is running a second scam on the same victim list. What you can do: revoke related approvals, report via chainabuse.com and (in the US) ic3.gov, and document everything for potential tax treatment.

How common are scam tokens on Base?

They are the statistical majority of new deployments. GoPlus Security identified 381,790 suspected risky tokens on Base between August 2023 and May 2024 — about 66.6% of the 573,484 new tokens created in that window — with honeypots and blacklists among the most common flags (goplussecurity.medium.com). Solidus Labs counted over 500 scam tokens deployed before Base's public launch even happened, netting operators about $2 million (soliduslabs.com). The honest framing: comparable ratios exist on other permissionless chains, and the flip side is that the vast majority of these traps catch nobody who runs the basic five-minute check.

What is the difference between a rug pull and a honeypot?

A honeypot is one specific rug-pull mechanism. 'Rug pull' is the umbrella term for any launch engineered so insiders extract the money — via pulling liquidity, blocking sells, minting supply, or slowly dumping a dominant allocation. A honeypot is the second of those: a contract that allows buys but blocks or confiscates sells through blacklists, transfer restrictions, or near-100% sell taxes, so the price only rises until the operator drains the pool. The distinction matters practically because each mechanism is exposed by a different check — a sell simulation catches honeypots but says nothing about unlocked liquidity or insider supply concentration.

Should I revoke token approvals after every trade?

After every interaction with anything experimental, yes; for everything else, a monthly review is a reasonable cadence. Every approval you grant remains live indefinitely until revoked, and Chainalysis attributes over $1 billion in losses since May 2021 to approval phishing alone (chainalysis.com). On Base the economics make hygiene nearly free: each revocation on revoke.cash costs a fraction of a cent, so pruning unlimited allowances to contracts you used once costs pennies. Revoke immediately if you suspect you signed something on a phishing site — drainers usually execute fast, but an unexploited approval can be closed before it's used. Remember revoking can't recover already-stolen funds or fix a leaked seed phrase.

Are rug pulls illegal?

Generally yes, but enforcement is rare at memecoin scale. Deliberately deceptive extraction — honeypot code, hidden mints, pulling liquidity after fraudulent promises — fits fraud statutes in most jurisdictions, and US authorities have brought cases over larger token frauds. In practice, most rug operators are anonymous, cross-border, and individually too small to pursue; incident-level trackers recorded only about $28 million in the fraud category for all of 2024 even as ecosystem-wide scam revenue ran to billions, precisely because small rugs go unreported and unprosecuted (immunefi.com, chainalysis.com). Practical conclusion: legality offers you no protection here — prevention and position sizing do.

Sources

Related

Use the Risk Scanner

Before trading any token you discover, use the BaseBubbles Risk Scanner to check for liquidity, honeypot signals, and other risk factors.

More Guides

Disclaimer: This content is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency trading involves significant risk.