Solana · Smart Contract Security · Updated Jul 24, 2026

Is Pump.fun Safe? PUMP

On-chain security analysis — is it a scam or legit?

Contract pumpCm…9Dfn DexScreener ↗

53 / 100

High Risk How is this score calculated? →

Volume 24h

$1.01M

Liquidity

$14.62M

Price

$0.001946

Token Age

4mo

Top 10 Holders

68.8%

Security Checklist

1/5 checks passed

Contract VerifiedFail

Ownership RenouncedUnknown

No Mint FunctionUnknown

Liquidity LockedFail

Not a ProxyPass

Audit History

2 audits on record

Jul 2353

Every audit run adds a dated snapshot — history is append-only and cannot be edited.

Audit Summary

The Pump (PUMP) token mint on Solana demonstrates a strong security posture with all critical authorities, including Mint and Freeze authorities, permanently revoked. The token utilizes the spl-token-2022 program without active transfer hooks or default frozen accounts. Holder distribution data was unavailable from chain-native RPC, preventing an assessment of supply concentration.

Final Recommendation: Holders should regularly verify the on-chain status of the token mint, particularly confirming that the Mint and Freeze authorities remain revoked. Monitor for any changes in the `transfer_hook_upgradable` status and the potential introduction of a transfer hook, which would require a separate review. Due to the unavailability of holder distribution data, users should exercise caution regarding potential whale activity and monitor on-chain distribution if this data becomes available.

Category Ratings

TechnicalMedium

6/10

The Pump (PUMP) token is implemented using the spl-token-2022 program. Its supply is fixed at 850,388,805.799315888 tokens due to the Mint Authority being revoked. No Transfer Hook is active, and new accounts are not created in a frozen state, as indicated by "Default Account State Frozen: Fals

GovernanceHigh

1/10

The token exhibits healthy liquidity with $63,317,940 USD available on DEXs. The 24-hour volume of $21,543,259 USD results in a normal Volume/Liquidity Ratio of 0.34, not indicating wash trading. The DEX pair has been active for 134 days, providing a sufficient track record. Holder concentration dat

UpgradesHigh

2/10

The token's core parameters are immutable, as both Mint and Freeze authorities are revoked. Metadata is also immutable ("metadata_mutable: False"), ensuring the token's name, symbol, and image cannot be changed post-launch. While the token uses the spl-token-2022 program, no perm

What Raised This Score

5 factors

Ownership status UNKNOWN (owner could not be resolved)
Mint capability UNKNOWN (implementation ABI unreadable)
Contract source NOT verified
Top-10 concentration > 50% (68.8% total → 68.8% effective; 68.8% in EOAs, 0.0% in contracts — heavy)
Liquidity NOT locked (owner can withdraw — rug-pull risk)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Frequently Asked Questions

Is Pump.fun a scam?

It's not definitively labeled a scam based on available data, but significant risks exist. While ownership is renounced and no mint function prevents new token creation, the unverified contract, highly concentrated holder distribution (75.8% by top 10), and unlocked liquidity introduce substantial potential for malicious activity or adverse market events. Investors should be aware of these structural vulnerabilities.

Is Pump.fun safe to buy?

Pump.fun is associated with a high risk score of 52/100. Key risks include the contract not being verified, meaning its security hasn't been audited. A large portion (75.8%) of tokens is held by the top 10 wallets, risking manipulation. Additionally, the liquidity is not locked, which poses a significant rug pull risk. These factors suggest a high level of speculative risk for potential investors.

Has Pump.fun been audited?

No, the Pump.fun contract is explicitly listed as "False" for verification. This means its code has not been publicly validated or audited by a third party. Without verification, there's no transparency into the contract's functionality or security, leaving potential vulnerabilities undisclosed and raising the overall risk profile for investors.