🔍How to Audit a Crypto Project Before Investing
Summary
80% of rug pulls are avoidable with 30 minutes of due diligence. This is the exact checklist professional analysts use before committing capital — applicable to any project, from memecoins to serious DeFi protocols.
Token distribution and vesting
First red flag: who holds the tokens? Use Etherscan/Solscan to see top 100 holders. If a single wallet (not exchange or contract) holds >5%, danger. If top 10 wallets control >50% of supply, extreme danger. Verify vesting: team and advisor tokens should be locked at least 12 months with cliff. Use TokenUnlocks.app to see future unlocks — a project unlocking 30% of supply next month is a time bomb.
Audits, code and team
Look for at least 2 audits from recognized firms (Trail of Bits, OpenZeppelin, Certik, Halborn, Spearbit). If only audited by "BlockSecAudit" or unknown firms — suspicious. Read the report: were critical findings fixed? If code is open source on GitHub, verify regular commits and real authors (not anon accounts created last month). Team: doxxed (public identities with verifiable LinkedIn) is better than anon, except for projects where anonymity is part of the thesis.
Liquidity, TVL and on-chain metrics
Locked liquidity (Locked LP) on platforms like Team Finance or Unicrypt is non-negotiable minimum for new tokens. Without LP locked, team can pull liquidity anytime = instant rug pull. TVL on DefiLlama: real or inflated with protocol's own tokens? Vol/TVL ratio < 0.05 = TVL likely fake or stagnant. Holder growth: if holders decline week over week, project is silently dying. CertiK Skynet and RugCheck (Solana) give automatic scores as first filter, not guarantee.
Key takeaways
- Top 10 wallets >50% of supply = extreme manipulation risk
- Minimum 2 audits from recognized firms (Trail of Bits, OpenZeppelin, Certik)
- Locked liquidity (LP locked) is mandatory for new tokens
- TokenUnlocks.app reveals time bombs: upcoming massive unlocks
- Real TVL validated with Vol/TVL ratio > 0.05 and positive holder growth
Pro tip
If after 30 minutes of auditing you cannot answer with concrete data: who holds tokens, is it audited, is LP locked, is there a verifiable team, is there real growth? — do not invest. Lack of information IS the answer.