Methodology

How we judge a token.

Every finding in a report comes from one of the checks below. Each one says what it reads, where the data comes from, why it matters, and how severity is decided. The same fact means different things at different ages, so most rules are gated by whether a token is young or small (under 30 days, or under $10M valuation) or established.

What we cannot know

Pewcake identifies observable risk signals. It does not predict the future. It cannot guarantee:

that a token will not rug — only that the observable signals for it are absent right now
that a deployer will not sell, or that a wallet with a clean history stays clean
that a program will not be exploited, or that a pool will not be drained by a bug
what happens to liquidity after the moment of the check; a report is a snapshot
the intent behind any on-chain fact; a live freeze authority is a risk, not proof of a scam
anything about a token we could not read; when a source fails, the report says 'not checked' rather than 'safe'

A clear result means we found nothing, not that there is nothing. The Caught wall keeps the public record of how often that holds.

The checks

Mint authority

Reads: Whether the mint still has an authority that can create new supply.
Source: The mint account, read directly from the chain.
Why it matters: Live mint authority means the deployer can dilute every holder at will. Finished tokens revoke it.
Severity: Critical on a token under 30 days old or under $10M valuation. Warning on established or issuer-backed tokens, where it is normal (stablecoins mint on demand).

Freeze authority

Reads: Whether an authority can freeze token accounts.
Source: The mint account, read directly from the chain.
Why it matters: A frozen account cannot sell. On a memecoin there is almost no honest reason for it.
Severity: Critical when young or small; warning on established tokens, where regulated issuers use it for compliance.

Token-2022 extensions

Reads: Permanent delegate, transfer hook, transfer fee, default-frozen, non-transferable, pausable, mint-close authority.
Source: The extension list on the mint, parsed byte by byte. Layouts validated against live mints.
Why it matters: These are the newer ways a token can tax, freeze, or seize your balance without a traditional rug.
Severity: Non-transferable is always critical. Delegate, hook and default-frozen are critical on unverified young tokens and warnings on verified issuers. A transfer fee of 5% or more is critical.

Liquidity

Reads: Total liquidity across every pool for the mint, and its ratio to valuation.
Source: DexScreener, all Solana pairs for the mint.
Why it matters: Thin liquidity means your own sell moves the price, and a valuation far above the pool is a price nobody could actually realise.
Severity: Under $5k critical, under $30k warning. Valuation over 50× liquidity is critical, but only for young or small tokens; large caps trade mostly off-chain and routinely show high ratios.

Launch age

Reads: How long the token has existed.
Source: The earlier of Jupiter's creation date and the oldest pool. A new pool on an old token does not make it young.
Why it matters: Most rugs happen inside the first hours.
Severity: Under an hour or under a day is a warning. Age also gates most other severities.

Holder concentration

Reads: The share of supply held by the largest twenty accounts.
Source: Largest token accounts from the chain; Jupiter audit data when the token has too many holders for the RPC to scan.
Why it matters: A handful of wallets that can end the token whenever they choose usually do.
Severity: Over 60% critical, over 35% warning. When neither source answers, the report says so rather than guessing.

LP status

Reads: Whether the liquidity behind the token can be withdrawn: burned, locked, spread across many holders, or held by one wallet.
Source: Pool accounts read from the chain for Raydium, PumpSwap and Meteora; pools discovered through DexScreener. Weighted across the top three pools by depth.
Why it matters: Whoever holds unburned LP tokens can pull the pool and leave nothing to sell into. This is how most rugs end.
Severity: 95%+ locked in is fine. Under 50% is critical on young tokens and a warning on established ones. Concentrated-liquidity pools have no LP token to burn; that is stated, not scored as safe. Raydium's own burn figures matched ours to the decimal in testing, and ours also count LP sent to the incinerator.

Sell route

Reads: Whether a $10 position can be sold right now, and how much the price moves.
Source: A live Jupiter sell quote at the moment of the check.
Why it matters: A token you cannot sell is a honeypot no matter what else looks fine.
Severity: No route is critical. A $10 sell moving the price more than 10% is critical; more than 2% is a warning.

Deployer history

Reads: How many tokens the deployer has launched, how many graduated, and how much of this one they still hold.
Source: Jupiter audit data. The Deployer page goes further, from the wallet's own creation transactions.
Why it matters: A wallet with twelve dead launches is telling you what the thirteenth will be.
Severity: Six or more launches is critical, two to five a warning. A thousand or more is a launch service, flagged as such because the real creator is hidden. A dev bag over 20% of supply is critical.

Exit quote

Reads: For the exact amount you entered: what selling straight back would return.
Source: Two live Jupiter quotes, the buy and the reverse.
Why it matters: It is the one number every trader understands: how much of my money disappears just turning around.
Severity: Shown as a percentage. Red at 15% or more, or when no sell route exists. Informational; it does not block on its own.

How a verdict is formed

Any critical finding makes the verdict Do not swap this and disables the swap button. You can proceed only after acknowledging every critical signal in a dialog, and not at all when a signal means you could not sell (frozen, non-transferable, no sell route). Warnings only give Proceed carefully. No warnings give Nothing alarming found, which is exactly what it says. Reports are cached for 45 seconds; every finding shows its source and how old it is.