Rug Pulls and Fake Projects

Go: open a terminal in a folder you can write to, e.g. cd ~/Desktop (Windows: cd %USERPROFILE%\Desktop).

Do: save this as token.sol. On a real token you would get this by opening the contract address on the chain’s block explorer and using its Contract → Code tab; if that tab shows only machine code, the source was never published, and that alone is a reason to walk away.

contract MoonRocket {
    address public owner;
    mapping(address => uint256) public balanceOf;
    mapping(address => bool) public blacklist;
    uint256 public sellTax = 5;

    modifier onlyOwner() { require(msg.sender == owner); _; }

    function mint(address to, uint256 amount) public onlyOwner {
        balanceOf[to] += amount;
    }

    function setBlacklist(address who, bool banned) public onlyOwner {
        blacklist[who] = banned;
    }

    function setSellTax(uint256 newTax) public onlyOwner {
        sellTax = newTax;
    }

    function transfer(address to, uint256 amount) public {
        require(!blacklist[msg.sender], "blocked");
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
    }
}

You should see: nothing — this is a file to save, not a program to run. Confirm it landed with ls token.sol (Windows: dir token.sol), which should print the filename back.

If not: if your editor added a .txt extension, the next step will report FileNotFoundError. In Notepad’s Save dialog set Save as type to All Files before saving.

Go: same folder.

Do: save this as scan.py, then run python3 scan.py token.sol.

import re, sys

DANGERS = {
    "mint":         "the owner can create new tokens out of nothing",
    "blacklist":    "the owner can stop chosen wallets from selling",
    "setSellTax":   "the owner can change the sell tax after you buy",
    "pause":        "the owner can freeze all transfers",
    "selfdestruct": "the contract can be destroyed",
}

source = open(sys.argv[1]).read()
defined = 1 if re.search(r"modifier\s+onlyOwner", source) else 0
owner_only = len(re.findall(r"\bonlyOwner\b", source)) - defined

print(f"scanning {sys.argv[1]}")
print(f"functions only the owner may call: {owner_only}")
found = 0
for name, why in DANGERS.items():
    if re.search(r"\b%s\b" % name, source, re.I):
        print(f"  FOUND {name:14s} -> {why}")
        found += 1
print("no owner-controlled danger found" if not found else f"{found} danger(s) found")

You should see: three powers the developer kept for themselves:

scanning token.sol
functions only the owner may call: 3
  FOUND mint           -> the owner can create new tokens out of nothing
  FOUND blacklist      -> the owner can stop chosen wallets from selling
  FOUND setSellTax     -> the owner can change the sell tax after you buy
3 danger(s) found

Nothing here is hidden or clever. These functions are declared in public, and anyone who looked before buying would have seen them. That is what makes rug pulls preventable in a way most crypto losses are not.

If not: IndexError: list index out of range means you ran python3 scan.py without naming a file — the filename is the argument. FileNotFoundError means token.sol is not in this folder.

Go: same folder. A detector you have only ever seen say “danger” is a detector you cannot trust.

Do: save this as clean.sol and run python3 scan.py clean.sol.

contract PlainToken {
    mapping(address => uint256) public balanceOf;
    uint256 public totalSupply = 1000000;

    constructor() {
        balanceOf[msg.sender] = totalSupply;
    }

    function transfer(address to, uint256 amount) public {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
    }
}

You should see: a clean report — and the same scanner producing it:

scanning clean.sol
functions only the owner may call: 0
no owner-controlled danger found

The whole supply is handed out once, at creation, and after that the contract can do exactly one thing: move tokens between holders. There is no owner, so there is nobody who can change the rules later. “Nobody can change this” is the property you are shopping for.

If not: if this file also reports dangers, you passed token.sol again — check the filename on the command line.

Go: same folder. “The owner can mint” sounds abstract until it is arithmetic.

Do: save this as dilute.py and run it.

supply = 1_000_000
mine = 10_000
print(f"you own {mine:,} of {supply:,} = {mine / supply:.2%} of the project")

for minted in (1_000_000, 10_000_000, 1_000_000_000):
    print(f"owner mints {minted:>13,} more -> your share is now "
          f"{mine / (supply + minted):.6%}")

You should see: your stake shrinking towards nothing, without a single token leaving your wallet:

you own 10,000 of 1,000,000 = 1.00% of the project
owner mints     1,000,000 more -> your share is now 0.500000%
owner mints    10,000,000 more -> your share is now 0.090909%
owner mints 1,000,000,000 more -> your share is now 0.000999%

You still hold every token you bought. Your balance never changed, so nothing looks stolen — and you own a thousandth of what you did. The newly minted tokens are then sold into the same pool your money is in, which is where the value goes.

If not: if the percentages print as decimals like 0.005, the % is missing from the format specifier — it must be :.6%.

Go: same folder. This is the classic rug pull: not a function in the token at all, but the developer withdrawing the pool that lets anyone sell.

Do: save this as pull.py and run it. It models a standard automated pool, where the coin balance times the token balance stays constant.

coins, tokens = 100.0, 1_000_000.0        # the pool: x * y = k
k = coins * tokens
print(f"price before: {coins / tokens * 1_000_000:.2f} coins per million tokens")

spend = 1.0                                # you buy with 1 coin
got = tokens - k / (coins + spend)
coins, tokens = coins + spend, tokens - got
print(f"you bought  : {got:,.0f} tokens for {spend} coin")

coins, tokens = 0.01, tokens              # the owner removes the liquidity
k = coins * tokens
back = coins - k / (tokens + got)
print(f"you sell back {got:,.0f} tokens and receive: {back:.8f} coins")

You should see: a coin going in, and essentially nothing coming back:

price before: 100.00 coins per million tokens
you bought  : 9,901 tokens for 1.0 coin
you sell back 9,901 tokens and receive: 0.00009901 coins

Your tokens were never taken. They are still yours, and they are now worth about one ten-thousandth of what you paid, because the coins you would be paid from are gone. This is why the practical check is not only the contract but the pool: is the liquidity locked, for how long, and who holds the key? A project that cannot answer that has answered it.

If not: ZeroDivisionError means the remaining pool balance was set to exactly 0 instead of 0.01 — a real pool is drained to near-zero, not to zero. If back comes out negative, the last two lines were swapped; the sale must happen after the pool is drained.