/meme-coin-audit

name: meme-coin-audit
description: Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence.

MEME COIN & TOKEN SECURITY AUDIT

Fast-kill rug pull detection and deep token security analysis for EVM and Solana meme coins.

---

PRE-DIVE KILL SIGNALS

Check these BEFORE reading a single line of code. If any are true, skip the audit — the token is likely a rug or not worth the time.

Hard Kills (Skip Immediately)

• **Contract not verified** on Etherscan/Solscan → Cannot audit source = cannot trust
• **Deployer wallet** has history of rug pulls (check Etherscan deployer page)
• **Token age < 1 hour** AND no known team → Too early, wait for more data
• **Mint authority retained** (Solana) AND no cap → Infinite mint = certain rug
• **Freeze authority retained** (Solana) on meme coin → Honeypot confirmed
• **Transfer hook present** (Token-2022) with mutable hook program → Honeypot vector
• **Permanent delegate** extension (Token-2022) → Can steal all holder tokens

Soft Kills (Proceed with Extreme Caution)

• Top holder > 20% of supply (excluding DEX pools)
• LP not burned or locked in verified contract
• Contract is upgradeable / proxy with retained admin
• Less than $5K liquidity in the pool
• No social presence / anonymous deployer with no history

---

THE ONE RULE

> **"Check ALL authorities and owner functions. The retained authority IS the rug vector."** > > Every rug pull requires a privileged operation: mint, blacklist, fee change, LP removal, or authority abuse. If you find the privilege, you found the bug.

---

BUG CLASSES (8 TOKEN-SPECIFIC)

1. HIDDEN MINT / UNLIMITED SUPPLY

> Common rug pattern. Deployer mints tokens post-launch, dumps on LP.

**Quick grep (EVM):**

grep -rn "function mint\|_mint(\|_balances\[.*\] +=" src/ --include="*.sol" | grep -v "test\|lib\|node_modules"

**Quick grep (Solana):**

grep -rn "MintTo\|mint_to\|mint_authority" src/ --include="*.rs" | grep -v "test\|target"

**Kill if:** MAX_SUPPLY enforced in every mint path, or mint function removed entirely.

2. HONEYPOT / TRANSFER RESTRICTION

> Common scam pattern. Buy works, sell blocked.

**Quick grep:**

grep -rn "blacklist\|isBlacklisted\|_bots\|maxTxAmount\|approve.*override\|tradingEnabled" src/ --include="*.sol"

**Solana equivalent:**

grep -rn "freeze_authority\|transfer_hook\|TransferHook\|permanent_delegate" src/ --include="*.rs"

**Kill if:** No blacklist mapping, no transfer hooks, no freeze authority.

3. FEE MANIPULATION

> Common rug pattern. Sell fee set to 99% after initial buys.

**Quick grep:**

grep -rn "setFee\|setSellFee\|_taxFee\|_sellFee" src/ --include="*.sol"
grep -rn "function set.*Fee" -A5 src/ --include="*.sol" | grep -v "require\|MAX\|<="

**Kill if:** Fee setter has `require(fee <= MAX_FEE)` with MAX_FEE <= 10%.

4. LIQUIDITY POOL DRAIN

> LP removal, migration, or manipulation to crash price.

**Quick grep:**

grep -rn "migrateLP\|emergencyWithdraw\|\.sync()\|setPair\|setRouter" src/ --include="*.sol"

**Kill if:** LP tokens burned to dead address, no migration function, no pair setter.

5. BONDING CURVE MANIPULATION

> Exploits in pump.fun-style bonding curves.

**Quick grep:**

grep -rn "virtualReserve\|setCurve\|graduate\|bonding_curve" src/ --include="*.sol" --include="*.rs"

**Kill if:** Curve parameters immutable, graduation permissionless.

6. AUTHORITY RETENTION (SOLANA)

> Retained mint/freeze/update authorities on Solana tokens.

**Quick grep:**

grep -rn "mint_authority\|freeze_authority\|update_authority\|close_authority" src/ --include="*.rs"
grep -rn "set_authority.*None" src/ --include="*.rs"  # Good sign: revocation

**Kill if:** All authorities = None, verified on-chain.

7. FAKE RENOUNCE / HIDDEN OWNERSHIP

> Ownership appears renounced but backdoor control retained.

**Quick grep:**

grep -rn "renounceOwnership.*override\|_shadowAdmin\|_backupOwner\|selfdestruct" src/ --include="*.sol"

**Kill if:** renounceOwnership NOT overridden, no second admin role, no selfdestruct.

8. SANDWICH AMPLIFICATION BY DESIGN

> Contract makes holders maximally sandwichable.

**Quick grep:**

grep -rn "swapExactTokensForETH" -A5 src/ --include="*.sol" | grep "0,"
grep -rn "swapThreshold\|_rebase\|mandatoryPool" src/ --include="*.sol"

**Kill if:** Auto-swap has proper slippage, no rebase mechanics.

---

FAST RED-FLAG SWEEP

Run the 8 bug-class greps above across the source tree for fast red-flag detection. Together they catch:

• Direct mint/balance manipulation
• Blacklist and transfer restriction patterns
• Unbounded fee setters
• LP migration and emergency withdraw functions
• Fake renounce overrides
• Zero slippage auto-swaps
• All Solana authority patterns
• Token-2022 dangerous extensions

**Source grep does NOT check** (verify these out-of-band):

• On-chain state (use Etherscan/Solscan for authority verification)
• Holder distribution (use DEXTools/Birdeye)
• LP lock status (use Unicrypt/PinkLock/Solscan)
• Deployer wallet history (manual check)

---

FOUNDRY POC TEMPLATE (TOKEN EXPLOITS)

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "forge-std/Test.sol";
import "../src/Token.sol";

contract TokenExploitTest is Test {
    Token token;
    address owner = makeAddr("owner");
    address victim = makeAddr("victim");
    address attacker = makeAddr("attacker");

    // Uniswap V2 router (mainnet fork)