How to Spot a Honeypot Token Before a Presale Goes Live

23 September 2026

A honeypot token is a smart contract designed to let buyers in but not out. You can identify most of them before a presale begins by auditing the contract code, checking the deployer’s history, and running simulation tests. The warning signs are mechanical - not market sentiment - and they are visible to anyone who reads blockchain data.

Understand what a honeypot contract does

A honeypot contract contains a function that blocks or reverts sell transactions while allowing buys to succeed. Common mechanisms include:

• A blacklist function that marks specific addresses (or all holders except the deployer) as unable to sell.
• A fee modifier that spikes the sell tax to 100% for certain wallets.
• A “liquidity denial” pattern where the contract holds all LP tokens, and the owner can drain the pool after buys accumulate.

The goal is to attract buyers during a presale or public launch, then trap them so the deployer can dump into the rising price without competition.

Step 1: Read the Contract Source Code (or Find an Audit)

If the presale page does not link to verified source code on Etherscan or BscScan, treat it as a red flag. Verified contracts allow you to inspect the functions. Look for:

• No transfer function override - a standard ERC-20 does not block sells. If the contract overrides _transfer with conditional logic, read the conditions.
• onlyOwner modifiers on sell-related functions - if the owner can set sell taxes, pause trading, or exclude addresses from fees, the contract can become a honeypot after the presale.
• Blacklist or _isExcluded arrays - any mapping that tracks “excluded” addresses is a risk. If the deployer’s address is permanently excluded from fees while others are not, sells may be blocked for everyone else.
• Honeypot detection tools - run the contract address through services such as Honeypot.is, Token Sniffer, or GoPlus Security API before the presale. These tools simulate a buy and sell transaction on the current state of the contract. A return of “sell failed” or “transfer restricted” is a clear warning.

If the contract is not verified, you cannot audit it. Skip the sale.

Step 2: Check the Deployer’s Wallet History

A clean deployer wallet does not guarantee safety, but a dirty one is a strong signal. Use BscScan or Etherscan to review the deployer address:

• Previous token launches - does the same wallet have other tokens that turned into honeypots? Look for contracts with low liquidity, abandoned social channels, or reports on RugDoc or similar watchdog sites.
• Age and activity - a wallet created two hours before the presale with no outgoing transactions except the token deployment is a common pattern for rug-pull operations. Older wallets with consistent gas spending are less suspicious, though not safe on their own.
• Funding source - if the deployer wallet was funded from a centralized exchange (Binance, Coinbase) or a known mixer, trace the origin. Mixers are not proof of fraud, but they are used disproportionately by bad actors in token launches.

Check also whether the deployer has renounced ownership of the contract. On BscScan, the Owner field shows the current owner. If ownership has been renounced (set to address 0), the contract cannot be modified later. If ownership is still held, the deployer retains the ability to change sell taxes, pause trading, or blacklist addresses after the presale ends.

Step 3: Examine Liquidity Lock and Token Distribution

A honeypot often relies on the deployer controlling the liquidity pool. Before the presale, look for:

• Liquidity lock - is the LP token sent to a lock contract (Unicrypt, DXlock, or a team multisig)? If the LP is not locked, the deployer can remove liquidity immediately after buys, making sells impossible. Locked liquidity does not prevent a honeypot - it only prevents a liquidity pull - but unlocked liquidity is a strong warning.
• Token supply allocation - a standard presale allocates a fixed percentage to the sale and the rest to liquidity, with team tokens vesting. If the deployer holds 90% of the supply in a single wallet, they can dump into any buy pressure, but more relevant to honeypots: if the deployer’s wallet is the only one that can sell, the contract is effectively a honeypot regardless of the exact distribution.
• Mintable supply - if the contract has a mint function that only the owner can call, the deployer can inflate the supply after the presale, diluting buyers and potentially blocking sells by toggling pause or fee logic.

Step 4: Simulate a Sell Transaction Yourself

Do not rely only on third-party tools. If you have basic Solidity reading ability, or access to a test environment like Remix or Hardhat, do the following:

1. Fork a mainnet node (or use a public simulation service like Tenderly).
2. Impersonate a buyer address that holds a small amount of the token.
3. Call the transfer function to send tokens back to the liquidity pool.
4. Check whether the transaction reverts. If it does, you have found a honeypot.

You can also simulate a swap on a decentralized exchange (PancakeSwap, Uniswap) using the same impersonation method. A revert on the sell side, combined with a successful buy, confirms the honeypot.

Why honeypots slip past launchpad filters

Launchpads often check for sybil attacks, wallet age, and KYC, but they rarely perform deep contract audits for every project that applies. Many honeypot launches pass through because the contract code looks clean at deployment time and only activates the sell-blocking function after a threshold of buys is reached. This is called a “time bomb honeypot.” The code may include a counter or a block number condition that triggers after 100 buys or 24 hours. At presale stage, the trigger has not fired, so simulations return normal results.

To catch a time bomb, check the contract for block.timestamp comparisons, totalSupply thresholds, or _isHoneypotActive flags that can be toggled by the owner. If you see any variable that can change behavior after a condition, treat the project as high risk.

What to do if you spot one

Do not participate in the presale. Report the contract to the launchpad platform and to community watchdogs (RugDoc, Coffeezilla’s scam database). If you see others discussing the token on Telegram or Twitter, share the specific code evidence - not just a claim - so they can verify it themselves.

A honeypot token is a mechanical trap, not a market risk. You can avoid it entirely by reading the contract and simulating a sell before you send funds. If you cannot verify that a sell works, you should assume it does not.

Back to token launches