Scam patterns
Most token scams reduce to a handful of repeatable patterns. Here's what they look like on-chain and which CSDS dimension surfaces them.
Rug pull
The team drains value and abandons the project. Tell-tale signals: liquidity that isn't locked (or unlocks soon), supply concentrated in a few wallets, and an owner that can mint or move funds. Dimensions: liquidity, holder concentration, owner privileges.
Honeypot
You can buy but can't sell. Revealed by transfer restrictions, blacklist functions, or abnormal sell-side gas behavior, and often an unverified contract that hides the logic. Dimensions: verification, owner privileges, gas anomalies.
Hidden mint / owner abuse
An active mint authority (Solana) or mint/owner functions (EVM) let insiders inflate supply and dump on holders, or freeze accounts to block selling. Dimensions: owner privileges, supply.
Liquidity theft
LP tokens held by the deployer and never locked can be pulled at any moment, leaving holders unable to trade. Short lock durations are a softer version of the same risk. Dimensions: liquidity.
Pump & dump / wash trading
Coordinated volume and price spikes — often bot-driven — manufacture hype before insiders exit. Detected by comparing recent activity to a multi-week baseline. Dimensions: trading patterns.
Relaunch & copycats
Serial deployers spin up near-identical tokens after each failure. Repeated-deployer and code-similarity patterns flag this. Dimensions: relaunch risk, scam connections.
Upgradeable proxy risk
A proxy contract lets the owner swap the implementation — useful for legitimate upgrades, but also a path to inserting malicious logic later. Dimensions: proxy risk, owner privileges.