Honeypots and the sell test

A honeypot is a token engineered so you can buy but can't sell — or can only sell into a woodchipper. The chart looks incredible because it's a one-way door: every buy pushes price up and no sell ever pushes it down. The blocking mechanics come in flavors. Blacklist functions: the contract keeps a list, and transfers from listed (or all non-whitelisted) addresses simply revert. Fee traps: sells technically work, but a "tax" the owner can crank to 99% eats the proceeds — often set low at launch for the sell-checkers, then raised once bags are heavy. Some contracts have transfer limits so small you'd need ten thousand transactions to exit.

Solana has its own knife drawer. Every SPL token can have a freeze authority: if it isn't revoked, the holder of that key can freeze YOUR token account specifically, and frozen tokens don't move — that's a per-wallet honeypot switch. Mint authority left live means infinite supply printing over your head. And Token-2022 (the extensions program) adds programmable behaviors that are legitimate tools with evil use-cases: transfer hooks that run custom code on every transfer (code that can just say "no"), permanent delegate (an address that can move or burn your tokens from your wallet, forever), and configurable transfer fees. On EVM chains, add approval drainers to the list: a malicious site gets you to sign an unlimited token approval, and the "honeypot" is your own wallet.

Defense is boring and effective. Before buying: run the token through a reputable scanner (they simulate a sell and read the contract), check that freeze and mint authority are revoked, check for Token-2022 extensions and treat permanent delegate as an instant no, and look at the holders page — if real wallets have only ever bought, be suspicious. The strongest single test: watch for organic sells from normal wallets actually landing on-chain. And accept the limit of your tools: a passing scan means "not currently a honeypot," not "safe" — owner-controlled taxes and upgradeable logic can turn hostile after you're in. If you can't verify you can leave, don't enter.