Honeypot Detection for Snipers: A 2026 Field Guide
**Answer first** — In 2026, a new-pair sniper that doesn't run honeypot detection is bankrolling rug-pull operators. The five-layer detection stack — bytecode static scan, simulate
Answer first — In 2026, a new-pair sniper that doesn't run honeypot detection is bankrolling rug-pull operators. The five-layer detection stack — bytecode static scan, simulated buy-sell round-trip, transfer-tax measurement, owner-privilege analysis, and liquidity-lock verification — catches over 96% of intentional traps in our internal benchmark. FRB Agent runs this stack automatically before every snipe; if you're sniping anywhere else, you should be running it manually.
This guide covers the manual playbook, the signals each layer surfaces, and what false-positive looks like.
Why Honeypots Got Smarter in 2026
The simple "can't sell" honeypot of 2022 is dead — every basic scanner catches them. What's deployed today is harder:
- Conditional-tax contracts that charge 0% to addresses that hold 30+ minutes and 99% to flippers.
- Blacklist-on-buy contracts that flag a buyer's address mid-block and revert sells.
- Owner-renounced fakes where ownership transfers to a deterministic contract that the deployer still controls via CREATE2 collision or proxy admin.
- Liquidity-lock theater — visible 1-year locks on a tiny LP pool while the real liquidity sits in a separate, unlocked pool.
- Approval drainers — tokens that grant unbounded approvals back to the deployer through a hidden hook in
transfer().
A 2026 sniper has to detect all of these during the time window between liquidity-add and the next block. That's typically 200–2000ms.
The Five-Layer Stack
Layer 1: Static Bytecode Scan
Disassemble the contract and look for the signatures of known traps:
| Pattern | What It Means |
|---|---|
tx.origin checks in _transfer |
Owner-only sell allowed |
Conditional revert keyed on caller balance |
Hidden blacklist |
selfdestruct reachable from non-owner |
Token can be killed |
Proxy delegatecall to mutable implementation |
Logic can change post-launch |
Hardcoded require(false) paths |
Disabled by deployer flag |
Static scan is fast (<50ms) but produces false positives — many legitimate tokens use proxies. It's a filter, not a verdict.
Layer 2: Simulated Round-Trip
Fork the EVM at the latest block and:
- Buy a small amount.
- Wait one simulated block.
- Sell back.
Three numbers come out: bought_amount, sold_amount, gas_used. If sold_amount / bought_amount < 0.92 and the token isn't documented as having a >8% tax, it's a trap. If the sell reverts, hard reject.
This is the highest-signal check in the stack. FRB Agent runs simulated round-trips against a forked node colocated with the strategy module — see Local MEV Execution.
Layer 3: Transfer-Tax Measurement
Even when sells succeed, a tax above 25% is uneconomic for a sniper. Measure the actual tax in simulation, not the documented one. Documented "5%" tokens often have 12% buy / 18% sell once you fork-test them.
Layer 4: Owner-Privilege Surface
Enumerate every function callable only by owner, DEFAULT_ADMIN_ROLE, or ProxyAdmin. Score by danger:
| Privilege | Danger |
|---|---|
| Pause transfers | High |
| Set fee/tax | High |
| Mint new supply | Critical |
| Blacklist arbitrary addresses | Critical |
| Update DEX router whitelist | High |
| Burn from arbitrary holders | Critical |
If "ownership renounced" is claimed but a proxy admin remains, the privileges still exist. Verify via the contract's storage slots, not the public claim.
Layer 5: Liquidity Lock Verification
Check the actual locker contract for:
- Lock duration in absolute timestamp (not "1 year")
- Lock owner address (transferable locks are not locks)
- Whether the locked LP token is for the real trading pair
- Whether multiple LP pools exist for the same token (a common decoy pattern)
Tools that just say "LP locked: yes" without checking the second-pool decoy miss a major class of rugs.
Signal Aggregation: The Composite Score
FRB Agent reduces the 5 layers to a single 0–100 confidence score. Default thresholds:
- 0–40: Auto-reject. Do not snipe.
- 41–70: Require manual confirmation; flagged in dashboard.
- 71–100: Auto-execute if other strategy criteria pass.
Tune the threshold to your own risk tolerance. Aggressive snipers run at 50; conservative ones at 80.
Solana Honeypots Are Different
Solana token traps work differently because of the SPL model:
- Freeze authority — if not renounced, the deployer can freeze any holder's token account, including yours.
- Mint authority — if not renounced, deployer can dilute supply.
- Transfer fees (Token-2022) — built-in tax mechanism, often hidden behind a legitimate-looking program.
- Fake renounce — authority transferred to a multisig the deployer controls.
For Solana-specific sniping see Solana Pump.fun Sniper Bot Guide and Hunting Meme Coins on Solana.
Common False Positives (And Why)
Detection isn't free of error. Here's what triggers false positives:
- Tax on transfer is 0% but on sell is 5% — many legitimate launch contracts. Resolve by simulating both.
- Owner not renounced but timelocked — a 7-day timelock on owner functions is a near-renounce. Read the timelock contract.
- Single-side liquidity — if a token launched only one pool, the "decoy pool" check fires. Verify by querying registry.
- Proxy with public implementation — many DAO-managed tokens use proxies. Check that the proxy admin is itself a verified, audited contract (e.g. an OpenZeppelin Defender controller).
What to Do When Detection Fails
No detection is perfect. If you get caught in a honeypot anyway:
- Don't add more capital trying to "average down." Sells are blocked, not just unprofitable.
- Check whether a flash-loan-based exit exists (it usually doesn't for hard honeypots).
- Treat it as a tuition payment and move on.
- Contribute the contract address to FRB's shared honeypot blocklist (auto-flagged for all users next snipe).
FAQ
Can I detect a honeypot 100% of the time?
No. Detection is a confidence game. The five-layer stack catches 96%+ of deployed traps in our 2026 dataset. Novel patterns will always exist.
How long does the full check take?
On a co-located node, ~120–250ms end-to-end. That's why latency matters even for safety, not just speed.
Are go-plus and honeypot.is good enough?
They're useful but slow (1–3s response). They also miss conditional-tax and decoy-pool patterns. Treat them as a sanity check, not a primary defense.
Should I ever override a honeypot warning?
Only if you're hand-reading the contract and have specific reason to believe it's a false positive. "I want this token to moon" is not a reason.
Does FRB Agent share its honeypot blocklist?
Yes — anonymized addresses are aggregated across consenting users. See Telemetry for the full opt-in policy.
Related Reading
- Crypto Bot Scam Detection Guide
- MEV Bot Scams vs Legit
- Solana Meme Coin Hunting Guide
- FRB Trust & Verification
- Risk Management for MEV Trading Bots
This article is educational. Sniping new tokens carries severe risk including total loss of capital. Not financial advice.
阅读后的下一步
启动 FRB 控制台
连接您的钱包，通过 6 位 PIN 码配对节点客户端，然后分配上述合约。
相关文章
延伸阅读与工具
讨论
暂无笔记。添加第一条观察，或在以下平台与团队分享链接 X (@MCFRB).