SOLANA·HUB
DE
Security

Detecting Solana Honeypot Tokens: Why a Token Won't Let You Sell

A honeypot is a token you can buy but not sell. Here's how to spot the warning signs yourself in a block explorer — freeze authority, Token-2022 extensions, sell patterns.

SOLANA·HUB ·

A honeypot is one of the sneakiest traps on Solana: a token you can buy but that won’t let you sell. The money goes in but doesn’t come out. The good news: because everything on Solana is public, you can check the warning signs yourself in a block explorer — before you invest.

Short answer: A honeypot lets you buy but not sell. Check three things in a block explorer: whether the sell history of other wallets is nearly empty, whether the freeze authority is active, and whether the token uses Token-2022 extensions like a transfer hook or an extreme transfer fee. A tiny test sell before committing exposes many traps.

In plain terms: Look at whether other people actually got back out of the token. If everyone only buys and nobody successfully sells, something is wrong.

1. What a Honeypot Is and Why It Works

With a honeypot the buy works normally — you receive your tokens. Only when you try to sell do you notice the transaction fails or is blocked. This works because the creator keeps technical control over the token: through certain permissions or built-in rules that trigger precisely when someone else tries to sell. The bait is a rising price (often staged through the creator’s own buys) — the trap is the blocked exit.

2. The Tell-Tale Pattern in the Explorer: Many Buys, Barely Any Sells

The clearest signal is in the token’s transaction history. With a healthy token, buys and sells from many different wallets alternate. With a honeypot it stands out: many buys, but practically no successful sells from wallets other than the creator’s. Watch for failed sell transactions too — they are a direct clue. How to read a single transaction: using Solscan.

3. Active Freeze Authority — Your Tokens Can Be Frozen

Every Solana token has two key permissions. The mint authority allows creating new tokens. The freeze authority allows freezing individual token accounts — a frozen account can no longer send, so it can no longer sell. If the freeze authority is active, the creator can deliberately lock your account the moment you try to sell. On the token page in the explorer you can see whether both permissions have been renounced (null). An active freeze authority is a strong honeypot warning sign.

4. Misused Token-2022 Extensions

The newer Token-2022 standard brings powerful extensions that legitimate projects use sensibly — but that can also be abused as a honeypot mechanism. Check in the explorer which extensions a token has enabled:

  • Transfer hook: Custom code runs on every transfer. It can be written to block sells specifically.
  • Transfer fee: A fee per transfer. Set extremely high (say 99%), it acts like a sell tax that makes selling effectively impossible.
  • Default account state: New token accounts start frozen by default — you can only send once the creator unfreezes your account (or never).
  • Permanent delegate: An address that can permanently control all tokens — it can claw back or move your tokens at any time.

Related is the pausable extension, which can temporarily halt transfers. A compact overview of all extensions: Token-2022 explained.

5. The Test Sell: Simulate Before You Commit

Before you put a larger amount into an unknown token, a tiny test sell right after the buy helps: if a small sell goes through, the crudest honeypot is ruled out. Many wallets and tools also let you simulate a transaction without actually sending it — if even the simulation fails, that’s a clear stop sign. Neither is a guarantee: some mechanisms only trigger above a certain amount or selectively per wallet.

6. How This Connects to Wider Scam Checking

A honeypot is just one of several traps. The same tools — a block explorer and a few targeted checks — also expose other risks. In parallel, check the general warning signs of a token: check a wallet or token for scams. Closely related is the rugpull, where the liquidity is pulled. And you can spot staged buying activity via bot wallets.

Important Context

No single signal is proof on its own — and this article explains the method on general patterns; it does not label any specific, real token as a honeypot or scam. An active freeze authority or a Token-2022 extension often has entirely legitimate reasons. Only the combination of several signals — empty sell history, active locking permission, extreme transfer fee — paints a serious warning picture. Verify for yourself, judge for yourself.

Not financial or investment advice. This article is for education and self-defense.

If You Want to Dig Deeper

Some mechanisms — like transfer-hook logic that only triggers under certain conditions, or nested delegate relationships — are hard to see through manually. For automated, deeper forensics there is Scry, our affordable wallet-intelligence interface. This is optional — the checks above cost nothing and expose most honeypots.

Sources and Further Reading

#honeypot #scam-detection #token-2022 #forensics #security

Related Articles