/token-scan

---

description: Meme coin and token security scan — checks for rug pull vectors (hidden mint, honeypot, fee manipulation, LP lock bypass, authority retention, bonding curve exploits, fake renounce, sandwich amplification). Runs automated token_scanner.py + manual 8-class audit. Usage: /token-scan [--chain solana]

/token-scan

Fast rug pull detection for meme coins and token contracts. Covers EVM (Solidity) and Solana (Rust/Anchor).

Usage

/token-scan contracts/Token.sol                          # Single EVM contract
/token-scan src/ --recursive                             # Scan entire directory
/token-scan programs/token/ --chain solana --recursive   # Solana program
/token-scan contracts/Token.sol --output findings/report.md  # Save report

Step 0: Quick Kill Signals

Before scanning code, check:

[ ] Contract is verified (source code available)?
[ ] Deployer has no rug history?
[ ] Token has been trading > 1 hour?
[ ] Liquidity > $5K?
[ ] Not a proxy with retained admin?

If ANY answer is NO → flag and proceed with extreme caution.

Step 1: Run Automated Scanner

# EVM
python3 tools/token_scanner.py 

# Solana
python3 tools/token_scanner.py  --chain solana --recursive

# JSON output for piping
python3 tools/token_scanner.py  --json

The scanner checks all 8 bug classes via regex and returns a risk score + verdict.

Step 2: Hidden Mint Check

grep -rn "function mint\|_mint(\|_balances\[.*\] +=" src/ --include="*.sol" | grep -v "test\|lib"
grep -rn "delegatecall" src/ --include="*.sol"
# Solana:
grep -rn "MintTo\|mint_to\|mint_authority" src/ --include="*.rs"

Look for: mint without MAX_SUPPLY cap, direct balance manipulation, delegatecall to unknown targets.

Step 3: Honeypot Check

grep -rn "blacklist\|isBlacklisted\|_bots\|maxTxAmount\|approve.*override" src/ --include="*.sol"
# Solana:
grep -rn "freeze_authority\|transfer_hook\|permanent_delegate" src/ --include="*.rs"

Look for: blacklist mappings, max tx setters without minimum bound, approve overrides that don't call super.

Step 4: Fee Manipulation Check

grep -rn "setFee\|setSellFee\|_taxFee\|_sellFee" src/ --include="*.sol"
grep -rn "function set.*Fee" -A5 src/ --include="*.sol" | grep -v "require\|MAX"

Look for: fee setters without upper bound, fee exclusion for owner.

Step 5: LP Drain Check

grep -rn "migrateLP\|emergencyWithdraw\|\.sync()\|setPair\|setRouter" src/ --include="*.sol"
grep -rn "addLiquidityETH" -A5 src/ --include="*.sol" | grep "owner\|msg.sender"

Look for: LP migration functions, emergency withdraw, auto-LP to owner wallet.

Step 6: Bonding Curve Check

grep -rn "virtualReserve\|setCurve\|graduate\|bonding_curve" src/ --include="*.sol" --include="*.rs"

Look for: mutable curve parameters, manipulable graduation threshold.

Step 7: Authority Check (Solana)

grep -rn "mint_authorit