The 3am token I almost bought

It was 3am and a Base token was up 40x on the reads of everyone in a group chat I half-trust. Deep liquidity, six figures locked, a website that looked better than most startups. I had the buy screen open with $300 keyed in and my cursor on confirm. Something about the holder chart felt off, so I copied the contract address into Basescan instead of clicking.

The contract was verified and looked clean on the surface. Then I found a setBlacklist function owned by a wallet that had not renounced, and a sell fee that a separate setTaxes call could push from 5% to 99% at any time. Nobody had scammed me yet. They did not need to — the gun was loaded and the trigger was theirs. I closed the tab. Six hours later the token was down 97% and the chat was full of people who could not sell. I had lost nothing but thirty seconds.

That is the whole reason this check exists. A honeypot is not always an obvious fake — it is a token engineered so that buying is easy and selling is impossible. On Base, where anyone can deploy a contract for a few cents, the difference between a fair launch and a trap is often a single function you can read in eight minutes.

I have been the other guy too. An earlier version of me bought a token on a "trust the chart" impulse, watched it climb for an hour, and then discovered the sell button did nothing while gas estimates failed. That loss is what turned a habit into a checklist. The checklist is not paranoia — it is the cheapest thing you will ever do before risking money, because it costs a few minutes and it has an unusually good hit rate.

A honeypot is not one trick — it is a menu

People picture a honeypot as one sneaky line of code. In practice it is a family of techniques, and a token can stack several at once. The core trick is always the same — your buy succeeds and your sell does not — but the mechanism varies, which is why a single tool rarely catches all of them:

Blacklist / sell-block. A privileged address can add your wallet to a blocklist after you buy, so transfer() reverts only for you.
Pause switch. Trading can be frozen globally at any moment, locking everyone in at once, usually right before a rug.
Mutable tax. The buy tax is friendly; the sell tax can be set to 90%+ whenever the owner decides.
Hidden mint. An owner-only mint() silently inflates supply, then dumps on holders.
Whitelist-gated transfers. Only pre-approved addresses can sell; everyone else is trapped.
Cooldown and max-wallet games. Artificial delays and caps that make exiting slow or impossible during a dump.

The broader scam taxonomy — rug pulls, liquidity drains, and how they overlap with honeypots — is laid out in meme coin risks on Base. Read that once, then use the checklist below every time.

The reason a menu beats a single check is that scammers study whichever detector is popular and design around it. A token built to pass a simulator can still carry an unrenounced pause switch; one with renounced ownership can still hide four wallets holding 70% of supply. Layering two or three cheap checks — contract code, sell simulation, holder and LP layout — is what makes the menu hard to defeat entirely.

Five minutes on Basescan beats a hundred Telegram calls

The single highest-value habit is reading the contract yourself instead of trusting a screenshot. On Basescan, open the Contract tab and confirm the source is verified. Unverified means the code is hidden — for a token hours old, that is enough to walk away. Verified does not mean safe, but it means you can actually audit what you are buying.

Then open Read Contract and Write Contract. In Read, check owner() to see who holds power — a live EOA is a warning, a renounced or null address is better. In Write, scan for the dangerous function names: setBlacklist, pause, setTaxes, mint, enableTrading, excludeFromFee. The names are not always exact, but the shapes repeat. Ask one question of every privileged function: can this let the deployer stop me from selling, or change how much I lose when I do?

If the answer is yes and the owner has not renounced, the token is only as safe as the stranger holding the keys. Sometimes that is a known, doxxed team and the risk is acceptable. Usually it is an anonymous deployer thirteen hours old, and it is not.

The sell simulation is the only test that counts

Reading code tells you what could happen. A sell simulation tells you what happens right now. Honeypot detectors — honeypot.is and similar chain-aware forks of it — execute a real buy and sell against a simulated copy of the chain and report whether the sell reverts and what taxes actually apply. Paste the Base contract and read the result before anything else in your routine.

The trap is treating a PASS as proof. Simulations run at one point in time and can be beaten by restrictions that trigger on a later block, on wallet age, on a holder-count threshold, or on a single owner transaction fired minutes after launch. A "no honeypot detected" badge is a filter, not a guarantee, which is exactly why my final step is always a tiny real buy followed immediately by a real sell. That live round trip is the only test that reflects the contract as it actually exists.

When you do that test buy, set slippage tight — the same discipline that protects normal swaps, covered in the slippage tolerance guide. A token that only lets you buy at 15% slippage is telling you how it treats sellers before you have even tried to sell.

One nuance with the live test: sell the exact amount you bought, not less. Some contracts let small sells through and revert on anything larger, a pattern meant to look functional on a tiny test. If your $8 test sells cleanly, try selling that same $8 position, and if the token advertises a higher cap, buy a second small slice and test again. When a token passes at $8 but the sell reverts at $80, you have found the threshold rather than a safe asset.

Red flags hiding in the holder list and the pool

Two charts expose most traps before you touch the contract. First, the holders. On the token's Holders tab, look at how concentrated the supply is. If one wallet outside the liquidity pair controls more than 10-20%, they can single-handedly dump and send the price to zero. Watch also for a suspiciously tiny number of holders on a "trending" token — ten wallets and a hype campaign is not organic demand.

Second, the liquidity. Open the main trading pair and check who owns the LP tokens. Burned (sent to a null address) or locked in a reputable locker means the deployer cannot pull the floor out. If the deployer still holds the LP, the entire pool is a withdrawal button they can press whenever the chart looks best for them. A token with strong holders but an LP the deployer still controls is still a rug waiting for its moment.

One more signal worth learning to read: who is actually trading. On L2s the classic frontrun sandwich is mostly absent because there is no public mempool, so a suspicious cluster of buys is more often the deployer's own wallets than external MEV; the mechanics are in the L2 MEV guide. When the top buyers and the top holders are the same few addresses, you are looking at a controlled market, not a discovery.

Which tools are worth opening

I keep exactly three tools open for this and ignore the rest. Basescan is non-negotiable — verified source, Read/Write Contract, holders, and the LP breakdown all live there for free. A honeypot simulator gives the quick buy/sell verdict and flags the obvious traps. A DEX aggregator screen (DexScreener, GeckoTerminal and similar) shows liquidity, volume and the age of the pool in one glance, which is often where the "this pair is two hours old" alarm fires.

What I do not trust: token "safety scores," paid audit badges on a one-day-old contract, and any website telling me to raise slippage above 10% to buy. A score is a snapshot that a deployer who knows the scoring rules can sit just above, and a paid audit of a contract nobody uses is decoration. The tools narrow the field; they do not replace the sell test.

Treat every tool as one lens, not the verdict. The same skepticism you aim at the token's Twitter should land on its dashboard too.

Because all of this is cheap and fast on L2, there is no excuse to skip it. A Base transaction that checks a contract costs a fraction of a cent, and the Basescan page loads instantly. The entire exercise is cheaper than the first swap you might have made, which is what makes it so strange that people skip it under time pressure.

The checklist I run before any Base token buy

This is the exact sequence, and I do not skip a line because a call is "moving fast." Fast is what rugpullers need.

Contract verified on Basescan? If no, done — walk away.
owner() renounced, or a known team? An anonymous live EOA is a hard no for anything I mean to keep.
Any blacklist, pause, mint or mutable-tax function? If yes and unrenounced, treat the sell as a switch someone else controls.
Sell tax under 10%? Higher means you can leave only on bad terms.
Top non-LP holder under 10-20%? Otherwise one wallet can end the chart.
Liquidity burned or locked, with more than $50-100k depth so you can actually exit?
Honeypot simulator returns a clean sell, and the pool is more than a few hours old?
Then a $5-10 live buy, sold immediately, before the real position.

Eight checks, about eight minutes. It is the cheapest insurance in crypto, and it has never once cost me a good trade — only the trades that would have cost me everything.

If you already hold a token that just blocked the sell

First, do not approve more. A trapped token is a reason for a scammer to ask you to "release" it by signing something or approving another contract — that is how a stuck position becomes a drained wallet. No legitimate fix requires a new signature from you. If you are already in a compromised situation, the recovery steps are in the wallet drained recovery guide.

Second, if you bought through a marketplace or router that required an approval, revoke it so a malicious contract cannot pull more from you later; the routine is in revoking token approvals, and the mechanics of what an approval actually grants are in the ERC-20 approval guide. On Base each revoke costs a few cents, so there is no excuse to leave a live allowance on a scam token.

And if the token simply cannot be sold, accept the loss rather than feeding it. Chasing a honeypot with more gas, more approvals, or a "recovery" service is how a $300 lesson becomes a $3,000 one. The money is gone the moment the sell reverts; the wallet does not have to follow it.

The 8-Minute Honeypot Check I Run Before Buying Any Base Token