Catching the Rug: Early Prediction of Fraudulent Me... | AI Research

What the paper is about

The rapid proliferation of memecoins on blockchain platforms has increased the risk of fraudulent activities, particularly rug pulls. While previous studies have focused on Ethereum-based tokens, this paper shifts the spotlight to Solana, the leading blockchain for memecoins by trading volume and token count. Unlike Ethereum, where rug pulls often exploit smart contract backdoors, Solana memecoin rug pulls are predominantly driven by liquidity manipulation and social dynamics. This research pioneers large-scale rug pull early detection in the Solana ecosystem by assembling a dataset of 6.4 million tokens over 7 months. Market analysis reveals that a vast majority of these memecoins exhibit rug pull characteristics within one hour of launch, highlighting the urgency of short-horizon prediction. Despite the absence of code-level features, we demonstrate that classic machine learning models, particularly Gradient Boosting (XGBoost), achieve robust performance in detecting potential rug pulls using only the first 5 minutes of trading data. Furthermore, we evaluate cross-platform generalization between PumpFun and Raydium, revealing that multi-source data fusion significantly mitigates domain shift and improves detection reliability. This study advances the understanding of DeFi fraud on high-throughput chains and provides a practical framework for protecting investors.

What it covers

Catching the Rug: Early Prediction of Fraudulent Memecoins on Solana via Machine Learning Jianghai Li Affiliation: Higher School of Economics Moscow, Russia [email protected] Pavel Kuznetsov Affiliation: Moscow State University Moscow, Russia [email protected] Yury Yanovich Affiliation: Skolkovo Institute of Science and Technology Moscow, Russia [email protected] Konstantin Nott-Whaley Affiliation: Independent Researcher London, UK [email protected] Igor Vodolazov Affiliation: Independent Researcher Barcelona, Spain [email protected] Abstract The rapid proliferation of memecoins on blockchain platforms has increased the risk of fraudulent activities, particularly rug pulls. While previous studies have focused on Ethereum-based tokens, this paper shifts the spotlight to Solana, the leading blockchain for memecoins by trading volume and token count. Unlike Ethereum, where rug pulls often exploit smart contract backdoors, Solana memecoin rug pulls are predominantly driven by liquidity manipulation and social dynamics. This research pioneers large-scale rug pull early detection in the Solana ecosystem by assembling a dataset of 6.4 million tokens over 7 months. Market analysis reveals that a vast majority of these memecoins exhibit rug pull characteristics within one hour of launch, highlighting the urgency of short-horizon prediction. Despite the absence of code-level features, we demonstrate that classic machine learning models, particularly Gradient Boosting (XGBoost), achieve robust performance in detecting potential rug pulls using only the first 5 minutes of trading data. Furthermore, we evaluate cross-platform generalization between PumpFun and Raydium, revealing that multi-source data fusion significantly mitigates domain shift and improves detection reliability. This study advances the understanding of DeFi fraud on high-throughput chains and provides a practical framework for protecting investors. Index Terms: Decentralized Exchange, Scam Detection, Blockchain, Machine Learning, Deep Learning, Solana I Introduction The rapid advancement of blockchain technology, Web3 innovations, and decentralized finance (DeFi) has significantly fueled the expansion of the cryptocurrency market [ 31 ] . By May 2024, the market capitalization of cryptocurrencies surpassed 2 trillion US dollars [ 14 ] , highlighting the profound influence of these technologies. To support token transactions and provide alternatives to peer-to-peer exchanges, various trading platforms and cryptocurrency exchanges have emerged. These platforms are categorized into centralized exchanges (CEXs) [ 28 ] , which operate similarly to traditional financial institutions, and decentralized exchanges (DEXs) [ 17 ] , which utilize smart contracts and cryptographic methods to ensure asset security. The rise in DEX activity has significantly impacted the memecoin market. In 2024, memecoins emerged as a leading trend in the crypto world, not generating the largest trade volume overall, but driving substantial activity on DEXs [ 13 ] . Memecoins are a type of crypto asset often created as a joke or to capitalize on memes and trends on the Internet [ 34 ] . Unlike traditional cryptocurrencies such as Bitcoin or Ethereum, which have specific use cases and underlying technologies, memecoins typically lack inherent utility or serious purpose. Instead, they gain popularity through social networks, community engagement, and viral marketing. Modern memecoins are tokens deployed on established blockchains (e.g., Solana, Ethereum) rather than native coins with dedicated consensus layers. However, this growth has led to an increase in fraudulent schemes, such as rug pulls [ 9 , 43 ] , where developers promote a token to attract investors and then withdraw liquidity, causing the token’s value to plummet. The decentralized nature of DEXs and user anonymity further complicate the detection of such schemes. As DeFi continues to expand, developing effective methods to detect rug pulls on Solana and other blockchains is crucial to safeguard users and maintain trust in the ecosystem. Rug pulls on decentralized exchanges pose a significant threat to investor confidence and market stability. Currently, there is a lack of specialized tools for real-time rug pull detection on DEXs, allowing fraudsters to exploit this vulnerability. Consequently, there is an urgent need for mechanisms capable of identifying potential rug pulls before they occur [ 29 , 33 ] . Although artificial intelligence has become a cornerstone of financial fraud detection [ 40 ] , rug pulls in decentralized memecoin markets present unique challenges: extreme class imbalance, rapid token lifecycles, and chain-specific microstructures not addressed by traditional frameworks. Recent work has begun to address these challenges on specific chains: Hu et al. [ 25 ] introduced MemeTrans , a 40k Solana memecoin dataset focused on launchpad-phase risk annotation, while Yaremus et al. [ 41 ] developed a TVL/Idle-based detection framework for the TON blockchain. Our work extends this line of research by scaling to 6.4M Solana tokens over 7 months, emphasizing early prediction and evaluating cross-platform generalization between PumpFun and Raydium. The main contributions of this paper are summarized as follows:

• We assemble and analyze a comprehensive dataset of 6.4 million Solana memecoins over a 7-month period, exceeding prior Solana-specific studies by over 150 × \times in scale, which enables robust statistical analysis of rare rug pull patterns.

• We conduct a rigorous evaluation of model transferability between Solana’s primary memecoin platforms, PumpFun and Raydium, revealing significant distribution shifts and demonstrating that multi-source data fusion combined with tree-based models yields the most robust cross-platform generalization.

• We validate the efficacy of short-horizon early detection, using the first 5 minutes of trading data to forecast 1-hour outcomes, specifically within the high-throughput, liquidity-driven microstructure of Solana, showing that reliable predictions can be achieved using only tabular liquidity and trading dynamics without relying on smart contract code analysis. II Background: Solana vs Ethereum Memecoins Memecoins have emerged as a significant segment within the cryptocurrency landscape, characterized by their blend of humor, speculative appeal, and community engagement [ 42 ] . This section explores the contrasting community and technological ecosystems of Solana and Ethereum, two prominent blockchain platforms that support memecoins. Solana memecoins inherently benefit from the high throughput and low transaction costs of the platform, attracting traders interested in rapid and cost-effective transactions [ 39 ] . In contrast, Ethereum memecoins leverage the platform’s established network effects and extensive user base. The Ethereum blockchain [ 6 ] , which has transitioned to a proof-of-stake consensus and adopted a modular architecture, leverages established network effects. Although this approach offers flexibility and independent upgradability, it introduces complexity in layer coordination, potentially affecting user experience. A critical issue in both ecosystems is the prevalence of rug pulls [ 29 ] , a type of fraud in which developers abandon a project after securing investor funds. Ethereum’s robust DeFi infrastructure and the ease of launching tokens via the ERC-20 standard [ 35 , 15 ] have made it a prime target for such scams. Ethereum memecoins, such as Shiba Inu (SHIB) and Pepe (PEPE), have gained significant traction due to community support and strategic marketing. Although smart contracts on Ethereum, primarily written in Solidity, enable decentralized, trustless, and transparent transactions, they require robust security measures such as whitelisting to manage access and reduce fraud risks. Blockchain technology has introduced easy-to-use auditability into digital systems [ 5 ] . However, to fully benefit from this, the source code of smart contracts should be open source. While most DeFi applications adhere to this principle, many memecoins on Ethereum do not. Although the bytecode of the smart contract is always publicly available and can often be reverse-engineered [ 16 , 3 ] , researchers sometimes fail to find the source code in certain notable scam cases, casting a shadow on the Ethereum memecoin ecosystem. ⬇ 467 function fullWhitelist ( address target ) public onlyOwner { 468 authorizations [ target ] = true ; 469 isFeeExempt [ target ] = true ; 470 isTxLimitExempt [ target ] = true ; 471 isInternal [ target ] = true ; 472 } Fig. 1 : Ichimoku Inu’s fullWhitelist function Most of Ethereum memecoins are based on the ERC-20 token standard, though the code may have modifications. A notable example is the inclusion of whitelists. Whitelisting in smart contracts controls access to comply with regulatory requirements such as Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations [ 18 , 36 , 37 ] , essential for token sales and NFT minting. Implementing whitelisting involves using Solidity’s mapping to store approved addresses and restrict access to specific functions. This ensures proper access control within the contract, providing a layer of security against potential fraud. ⬇ 336 function _transferFrom ( address sender , address recipient , uint256 amount ) internal returns ( bool ) { 337 if ( inSwapAndLiquify ) { 338 return _basicTransfer ( sender , recipient , amount ); 339 } 340 if (! authorizations [ sender ] && ! authorizations [ recipient ]) { 341 require ( tradingOpen , "" ); 342 } 343 344 require ( amount = swapThreshold ) { 346 marketingAndLiquidity (); 347 } 348 if (! launched () && isPair [ recipient ]) { 349 require ( _balances [ sender ] > 0, "" ); 350 launch (); 351 } 352 353 // Exchange tokens 354 balances [ sender ] = balances [ sender ]. sub ( amount , "" ); 355 356 if (! isTxLimitExempt [ recipient ] && restrictWhales ) { 357 require ( balances [ recipient ]. add ( amount ) Δ ​ t ) ) . \mathrm{Rug}{t}=\mathbb{I}\left((\mathrm{MDD}{t}\Delta t)\right). The thresholds θ \theta and Δ ​ t \Delta t are empirically selected based on the distributional analysis of TVL drops and durations of inactivity. IV-C Rolling Time Series Cross-Validation The construction of training and test sets directly impacts the reliability of model evaluation. Since Rug Pull detection is a time-dependent task, random partitioning or standard K-fold cross-validation introduces look-ahead bias, exposing the model to future market information during training and leading to overly optimistic evaluation results. Therefore, this study employs forward rolling window cross-validation based on token issuance time, reserving the last time window as an independent test set. Another reason for using time partitioning is that Rug Pull fraud exhibits concept drift characteristics, with its on-chain features constantly changing with the market. Compared to standard K-fold cross-validation, which mixes data from different time periods, a fixed-length rolling window utilizes only the most recent 3 months of data for training. Furthermore, because Rug Pulls are a minority class event, this study implements a positive sample guarantee mechanism. When the number of positive samples in the validation set is insufficient, the validation window is automatically expanded to ensure that each validation fold contains at least 5 Rug Pull samples, thereby guaranteeing the statistical significance of the evaluation results. This partitioning method follows the process of "historical training, future verification" to avoid data leakage and ensure that the final test set is used only for one-time evaluation, thereby improving the credibility of the experimental results. IV-D Detection Model and Parameter Optimization The primary objective of this study is to develop a detection learning model capable of predicting token behavior. We simplified the complex task of rug pull detection into a binary classification problem, predicting a token’s future behavior using only the first 5 minutes of trading data. For traditional machine learning, we selected Random Forest, XGBoost, and MLP. We utilized Optuna (Bayesian search) to optimize hyperparameters across all folds, subsequently retraining the models with the average optimal parameters. For transformer models, we choose FT-Transformer, TabTransformer, AutoInt. They represent three different ideas for tabular data modeling. We incorporated a cross-entropy loss function into our experiments to control the training and understanding of the model. Then, we evaluated the model’s predictive performance on different platforms (Pumpfun and Raydium) under transfer training and fusion training to identify potential anisotropies in model performance. IV-E Experimental Prediction Framework Rug Pull is defined as a fraudulent event in which the developers of a project abandon it, leading to a rapid and substantial decline in the token’s value. In this study, the target labels are binary indicators of whether a TVL rug pull or an Idle rug pull has occurred at 1 hour. This paper constructs a basic experimental prediction framework Figure 3 for DeFi scenarios. The framework first collects unified transaction data related to PumpFun and Raydium through blockchain indexer, and performs feature engineering at the data layer to extract multi-dimensional features such as price dynamics, liquidity changes, and trading behavior. At the model layer, dedicated models for PumpFun and Raydium are designed, respectively, and a hybrid model integrating the distribution characteristics of the two types of data is further constructed to improve cross-platform generalization capabilities. In the prediction phase, new input samples are classified and discriminated, dividing tokens into potential rug pull Tokens or Good Tokens. Finally, in the evaluation module, the model performance is systematically verified using multiple indicators. The preset window of the experiment is t = 5 min, predicting the likelihood of a rug pull within a 1-hour horizon. Fig. 3 : The Memecoin Future Prediction Framework uses Time t t to predict t + t 0 t+t{0} . IV-F Model Evaluation Metrics In the crypto market, over 80% of Memecoins experience rug pulls. This research is based on unbalanced data from the real world of the cryptocurrency market. For unbalanced label recognition tasks, the accuracy (ACC) does not accurately reflect the performance of the classifier. When the data distribution is unbalanced, it often causes the output of the classifier to tend to the Rug class, which will have a higher classification accuracy, but performs poorly in the minority class Non-Rug. To solve this problem, the study adopts evaluation indicators specifically designed for imbalanced classification. Rather than reporting all standard metrics, we focus on the three most robust indicators for detecting the minority class (Rug Pulls): the F1-score for the positive class, the Matthews Correlation Coefficient (MCC), and the Area Under the Precision-Recall Curve (AUCPRC).

• F ​ 1 ​ -score (Positive Class) = 2 ⋅ Recall × Precision Recall + Precision F1\text{-score (Positive Class)}=2\cdot\frac{\text{Recall}\times\text{Precision}}{\text{Recall}+\text{Precision}} , where Recall = T ​ P T ​ P + F ​ N \text{Recall}=\frac{TP}{TP+FN} and Precision = T ​ P T ​ P + F ​ P \text{Precision}=\frac{TP}{TP+FP} • M ​ C ​ C = T ​ P × T ​ N − F ​ P × F ​ N ( T ​ P + F ​ P ) ​ ( T ​ P + F ​ N ) ​ ( T ​ N + F ​ P ) ​ ( T ​ N + F ​ N ) MCC=\frac{TP\times TN-FP\times FN}{\sqrt{(TP+FP)(TP+FN)(TN+FP)(TN+FN)}} • AUCPRC = Area under the Precision-Recall (PR) curve These three metrics together provide a comprehensive and unbiased evaluation framework for the severe class imbalance present in rug pull detection. V Numerical Experiments V-A Data Analysis The data contains addresses for 6.4 million Memecoins. For all Memecoins, the study collected transaction data from the first hour for preprocessing, and Table IV illustrates some basic data characteristics. This study used a data fusion method, ensuring that b