On-chain security analysis — is it a scam or legit?
SolanaThe Pump (PUMP) token mint on Solana demonstrates a strong security posture with all critical authorities, including Mint and Freeze authorities, permanently revoked.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Holder balances as recorded by the audit of Sep 22, 2026
The 20 remaining pairs hold $147.7K between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
This token is an SPL token mint, not a deployed program: there is no contract source code on-chain for a line-by-line review, so no code-level vulnerability could be identified either way. The assessment on this page therefore rests on mint/owner authority, mint capability, holder concentration, which are read directly from chain state and from third-party risk registries.
Read the risk score breakdown below as the substance of this audit. For a code-level review, the token would need an accompanying verified program.
Acknowledged
The Pump (PUMP) token mint on Solana demonstrates a strong security posture with all critical authorities, including Mint and Freeze authorities, permanently revoked. The token utilizes the spl-token-2022 program without active transfer hooks or default frozen accounts. Holder distribution data was unavailable from chain-native RPC, preventing an assessment of supply concentration.
The Pump (PUMP) token is implemented using the spl-token-2022 program. Its supply is fixed at 850,388,805.799315888 tokens due to the Mint Authority being revoked. No Transfer Hook is active, and new accounts are not created in a frozen state, as indicated by "Default Account State Frozen: False". The token is not balance_mutable, closable, freezable, non_transferable, or transfer_fee_upgradable.
The token exhibits healthy liquidity with $63,317,940 USD available on DEXs. The 24-hour volume of $21,543,259 USD results in a normal Volume/Liquidity Ratio of 0.34, not indicating wash trading. The DEX pair has been active for 134 days, providing a sufficient track record. Holder concentration data was unavailable, preventing an assessment of supply distribution risk.
The token's core parameters are immutable, as both Mint and Freeze authorities are revoked. Metadata is also immutable ("metadata_mutable: False"), ensuring the token's name, symbol, and image cannot be changed post-launch. While the token uses the spl-token-2022 program, no permanent delegate is configured, and the transfer hook is not active, although the transfer_hook_upgradable flag is true.
Holders should regularly verify the on-chain status of the token mint, particularly confirming that the Mint and Freeze authorities remain revoked.
Monitor for any changes in the transfer_hook_upgradable status and the potential introduction of a transfer hook, which would require a separate review. Due to the unavailability of holder distribution data, users should exercise caution regarding potential whale activity and monitor on-chain distribution if this data becomes available.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
It's not definitively labeled a scam based on available data, but significant risks exist. While ownership is renounced and no mint function prevents new token creation, the unverified contract, highly concentrated holder distribution (75.8% by top 10), and unlocked liquidity introduce substantial potential for malicious activity or adverse market events. Investors should be aware of these structural vulnerabilities.
Pump.fun is associated with a high risk score of 52/100. Key risks include the contract not being verified, meaning its security hasn't been audited. A large portion (75.8%) of tokens is held by the top 10 wallets, risking manipulation. Additionally, the liquidity is not locked, which poses a significant rug pull risk. These factors suggest a high level of speculative risk for potential investors.
No, the Pump.fun contract is explicitly listed as "False" for verification. This means its code has not been publicly validated or audited by a third party. Without verification, there's no transparency into the contract's functionality or security, leaving potential vulnerabilities undisclosed and raising the overall risk profile for investors.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
