How to Spot a Rug Pull Before You Deposit into a Farm

23 October 2026

A rug pull is a scam where developers drain deposited funds from a DeFi protocol and disappear. You spot one by examining the code, the team, the liquidity structure, and the incentive design before you deposit. No single check guarantees safety, but combining several tests eliminates most scams.

Check the liquidity lock

The most common rug pull mechanism is removing liquidity from the pool after deposits accumulate. Legitimate projects lock liquidity for a set period. You need to verify that lock exists and how long it lasts.

1. Find the liquidity pool address on a block explorer like Etherscan or the chain’s equivalent.
2. Look for a lock contract - often labeled as "Liquidity Locker" or "TimeLock". Common services are Unicrypt, Team Finance, or DXlock.
3. Check the unlock date. Anything less than six months is a warning. Permanent locks are ideal but rare.
4. Confirm the lock contract has not been revoked. Some locks allow the owner to cancel early. If the contract has a "withdraw" function callable by the deployer, it is not a real lock.

If the project does not show a lock contract, or if the lock period ends in days or weeks, treat it as a high-risk deposit.

Examine the minting authority

A rug pull often involves minting new tokens that the team dumps on depositors. Check whether the token contract can create unlimited supply.

1. On the block explorer, open the token contract code.
2. Look for functions named mint, mintTo, or burn. Also check for owner or admin addresses that can change token parameters.
3. If the owner can mint arbitrarily, the team can inflate supply and crash the price. Some projects use multisig wallets to restrict minting - this is better but not safe alone.
4. Check if the contract is a proxy. Proxy contracts allow upgrading to a new implementation that could include malicious minting later. A proxy with a short timelock or a single owner is dangerous.

A non-upgradeable contract with no mint function and a renounced owner is the safest structure.

Analyze the Team and Reputation

Anonymous teams are not automatically scams, but they require more caution. Do the following checks:

• Search the project name plus "audit". Read the audit report yourself, not just the summary. Look for critical or high-severity issues. If no audit exists, that is a major red flag.
• Check the team’s history. Have they launched other projects? Did those projects fail or exit-scam? A clean track record matters.
• Look for social media accounts that show real activity over months, not just a week of bot-driven posts. Legitimate projects have ongoing community engagement.

Evaluate the yield source

Extremely high APY - above 1000% - usually comes from token inflation, not real revenue. Ask where the yield is generated:

• If the farm rewards you with its own token, the yield is paid by new token issuance. That token must have demand from outside the farm to hold value. If no external use case exists, the price will drop as people sell rewards.
• If the farm claims to generate yield from trading fees or lending interest, verify those fees exist. Check the protocol’s actual fee collection on-chain. A farm showing 500% APY with $10,000 in total fees collected per day is mathematically impossible.
• Be suspicious of "single-sided" farms that let you deposit one asset and earn a high percentage on it. These almost always pay yield from new token sales.

Test the withdrawal mechanics

Before depositing significant funds, try a test transaction:

1. Deposit a very small amount - $1 or the minimum allowed.
2. Immediately withdraw that amount. Note the time it takes to complete and whether any fees or delays appear.
3. If the withdrawal fails or requires manual approval, the protocol may prevent withdrawals when larger sums are at risk.
4. Check if there is a withdrawal fee or a cooldown period. Some legitimate protocols have timelocks to prevent flash loan attacks, but a 7-day unbonding period combined with anonymous developers is a red flag.

Look at the Social Signals, Not Just the Hype

Rug pulls often have inflated social media metrics. Use these checks:

• On Twitter or Telegram, look for genuine discussion - questions about risks, code, and audits. If every post is "wen moon" or "to the moon", the community is manufactured.
• Check the Telegram group for censorship. If you ask a technical question and get banned or ignored, that is a warning.
• Search for "rug pull" or "scam" alongside the project name on Google and Twitter. If multiple reports exist, do not deposit.

The minimum viable checklist

Before any deposit, confirm these four things:

1. Liquidity is locked for at least six months in a verifiable, non-revocable contract.
2. The token contract cannot mint new tokens arbitrarily and is not upgradeable by a single owner.
3. A professional audit exists with no critical issues, and you have read it.
4. The yield source is explained in terms that make mathematical sense for the protocol’s actual revenue.

If any of these checks fail, skip the farm. The next one will still be there tomorrow, and the one after that. Missing a fake opportunity costs nothing. Depositing into one costs everything.

Back to defi yield