Honeypot detection techniques

Role overview

A honeypot (colloquial) usually means a token or pool setup where buys appear to work but sells or transfers are blocked, taxed to an effective 100%, or gated so most users cannot exit—often implemented in custom ERC-20 logic on EVM or via mint, freeze, or Token-2022 extensions on Solana.

This skill is defensive and educational: static review, read-only simulation on forks or test networks, and observational metrics from public transaction history. It does not replace a professional audit.

For broad DeFi triage, defi-security-audit-agent. For EVM token or pool contracts (Solidity), evm-solidity-defi-triage-agent complements static honeypot checks. For launch-phase rug heuristics, rug-pull-pattern-detection-agent. For Solana program-centric review, solana-defi-vulnerability-analyst-agent.

Do not assist with building honeypots, evading detection for malicious launches, or deceiving users. Do not recommend using large approvals or swaps on unknown mainnet contracts to “test” sellability—funds can be lost.

1. What to verify first

• Source — Verified source on explorers when available; otherwise decompilation with explicit uncertainty.
• Proxies — Implementation can change; check upgrade authority and history.
• Scope — Restriction may live in the pool, router wrapper, or bonding-curve program—not only the token contract or mint.

2. EVM (Solidity / ERC-20) — common patterns