Security & blacklist
How BaniPool rates token and pool security (EVM & Solana), what the A–F grades mean, and the scam-token blacklist.
A–F grades
Each check is Not indicated, Attention, High risk or Unknown. The score starts at 100: high risk −35, attention −8, unknown −2.
| Value | Score | Meaning |
|---|---|---|
A | ≥ 90 | No meaningful risk found by automated checks. |
B | 75–89 | Low risk; a few points need attention. |
C | 60–74 | Medium risk; review the attention points. |
D | 40–59 | High risk; confirmation required before continuing. |
F | < 40 | Very high risk; added to the scam-token blacklist. |
A honeypot (cannot be sold), buy/sell tax ≥50%, or a token impersonating an official asset is graded F immediately. Any single high risk caps the score at 55.
Token checks
| Check | EVM | Solana |
|---|---|---|
| Buy & sell simulation (honeypot) | Buy then sell after 1 minute, 1 hour, 24 hours; several amounts | Jupiter swap simulated on-chain: buy 0.05 SOL from a large SOL wallet, sell from a real holder |
| Buy / sell tax | Simulation result | Simulation vs quote difference; Token-2022 transfer fee |
| Owner control | Owner, proxy, mint, blacklist, pause | Mint & freeze authority, permanent delegate, transfer hook, Pausable, close authority, default frozen accounts |
| GoPlus | Supplementary data | Balance-changing authority, mutable metadata, settings changeable later, malicious creator |
| Holders & creator | Holder distribution, deployer history | Holder distribution (program vaults excluded), number of tokens launched by the creator, creator balance share |
| Market | Fake activity, liquidity lock | Organic vs bot volume, LP lock (pump.fun migration), age & liquidity, price crash, pool permission per DEX |
| Creator fee sharing | Clanker v4 (LP-fee recipients & admins), Zora coins (payoutRecipient & owners) — Base | pump.fun fee sharing: creator-fee recipients & shares (max. 10 wallets), active/paused, locked or still changeable by the admin. Only fees are shared, not token supply |
| Identity | Impersonation of official assets | BaniPool registry, Jupiter verification, impersonating symbols |
Trusted tokens (flagged by GoPlus or "strict"-verified on Jupiter, e.g. regulated stablecoins) still show their issuer controls as notes; only permanent delegate and balance-changing authority remain at attention level.
Pool security (EVM & Solana)
The Pool security panel on the pool page combines pool checks and both tokens. For Solana pools it checks:
- Pool program: created by an official DEX program (Orca, Raydium CLMM/CPMM/AMM, Meteora DLMM, PumpSwap) or unknown.
- Liquidity ownership & lock: pool positions are read on-chain; if one regular wallet holds most of the active liquidity, it can be withdrawn at any time (rug-pull risk). The pump.fun migration LP is burned.
- Active liquidity, pool price vs market, trading activity vs TVL, pool age and pool fee.
Automated checks are not an audit and not a safety guarantee. A sell simulation is only valid at the time of the check; an active owner can change the token behaviour.
Scam-token blacklist
Whenever a token or pool security report is saved (EVM & Solana), tokens graded F are automatically added to the BaniPool blacklist with the main reasons, the number of detections and the first & last detection time. A token leaves the list only when a complete re-check scores ≥ 60.
When you pick a blacklisted token (Create pool on EVM & Solana, or viewing the Pool security panel), a red warning table "This coin has been detected as a scam token on BaniPool" appears with the grade, address, detection times, reasons and safety steps. Continuing requires ticking a dedicated confirmation.
Blacklisted tokens get a "⛔ Scam" badge in the token picker (EVM & Solana, including search results) and a "⛔ Scam token" badge in the dashboard position table; EVM & Solana Swap show a warning table and require confirmation. BaniPool admins can restore a wrongly flagged token or mark a scam manually with a reason; admin decisions are sticky (not overwritten by automated checks) and recorded in the audit log.
curl -s "https://banipool.com/api/v1/security/blacklist" | jq .data.tokens
curl -s "https://banipool.com/api/v1/security/blacklist?chain=solana&token=<MINT>" | jq .data.entry