meme-coin-audit

> **⚠️ AUTHORIZED USE ONLY**

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> **Mandatory confirmation gate**

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

# MEME COIN & TOKEN SECURITY AUDIT

Fast-kill rug pull detection and deep token security analysis for EVM and Solana meme coins.

---

PRE-DIVE KILL SIGNALS

Check these BEFORE reading a single line of code. If any are true, skip the audit — the token is likely a rug or not worth the time.

Hard Kills (Skip Immediately)

- **Contract not verified** on Etherscan/Solscan → Cannot audit source = cannot trust

- **Deployer wallet** has history of rug pulls (check Etherscan deployer page)

- **Token age < 1 hour** AND no known team → Too early, wait for more data

- **Mint authority retained** (Solana) AND no cap → Infinite mint = certain rug

- **Freeze authority retained** (Solana) on meme coin → Honeypot confirmed

- **Transfer hook present** (Token-2022) with mutable hook program → Honeypot vector

- **Permanent delegate** extension (Token-2022) → Can steal all holder tokens

Soft Kills (Proceed with Extreme Caution)

- Top holder > 20% of supply (excluding DEX pools)

- LP not burned or locked in verified contract

- Contract is upgradeable / proxy with retained admin

- Less than $5K liquidity in the pool

- No social presence / anonymous deployer with no history

---

THE ONE RULE

> **"Check ALL authorities and owner functions. The retained authority IS the rug vector."**

>

> Every rug pull requires a privileged operation: mint, blacklist, fee change, LP removal, or authority abuse. If you find the privilege, you found the bug.

---

BUG CLASSES (8 TOKEN-SPECIFIC)

1. HIDDEN MINT / UNLIMITED SUPPLY

> Common rug pattern. Deployer mints tokens post-launch, dumps on LP.

**Quick grep (EVM):**

grep -rn "function mint\|_mint(\|_balances\[.*\] +=" src/ --include="*.sol" | grep -v "test\|lib\|node_modules"

**Quick grep (Solana):**

grep -rn "MintTo\|mint_to\|mint_authority" src/ --include="*.rs" | grep -v "test\|target"

**Kill if:** MAX_SUPPLY enforced in every mint path, or mint function removed entirely.

2. HONEYPOT / TRANSFER RESTRICTION

> Common scam pattern. Buy works, sell blocked.

**Quick grep:**

grep -rn "blacklist\|isBlacklisted\|_bots\|maxTxAmount\|approve.*override\|tradingEnabled" src/ --include="*.sol"

**Solana equivalent:**

grep -rn "freeze_authority\|transfer_hook\|TransferHook\|permanent_delegate" src/ --include="*.rs"

**Kill if:** No blacklist mapping, no transfer hooks, no freeze authority.

3. FEE MANIPULATION

> Common rug pattern. Sell fee set to 99% after initial buys.

**Quick grep:**

grep -rn "setFee\|setSellFee\|_taxFee\|_sellFee" src/ --include="*.sol"
grep -rn "function set.*Fee" -A5 src/ --include="*.sol" | grep -v "require\|MAX\|<="

**Kill if:** Fee setter has `require(fee <= MAX_FEE)` with MAX_FEE <= 10%.

4. LIQUIDITY POOL DRAIN

> LP removal, migration, or manipulation to crash price.

**Quick grep:**

grep -rn "migrateLP\|emergencyWithdraw\|\.sync()\|setPair\|setRouter" src/ --include="*.sol"

**Kill if:** LP tokens burned to dead address, no migration function, no pair setter.

5. BONDING CURVE MANIPULATION

> Exploits in pump.fun-style bonding curves.

**Quic