Freeze Authority & Honeypots: The Tokens You Can Buy But Can't Sell

There's a special kind of rug that doesn't pull the liquidity or dump the supply. It just stops you from selling. You ape in, you're up 3x on paper, you hit sell — and the transaction reverts. Again. The money's right there on the screen and you can't touch it. That's a honeypot, and on Solana the most common way to build one is freeze authority.

What freeze authority actually is

Every SPL token has an optional role called the freeze authority — the wallet allowed to freeze any token account holding that mint. When your account is frozen, the tokens are still yours on paper, but you can't transfer them. No transfer means no swap, and no swap means no sell. The dev doesn't need your keys and doesn't touch your wallet; they just flip a switch on-chain and your exit is gone.

It's a sibling of mint authority, the switch that lets a dev print new supply. Both are leftover admin powers from when the token was created. A clean launch revokes both. A token that keeps freeze authority live is holding a loaded gun pointed at every holder's exit.

How freeze becomes a honeypot

The mechanic is simple and brutal. Buys succeed, sells revert. Liquidity stays in the pool so the chart looks alive and keeps printing green — that's the bait. New buyers see number-go-up and pile in. But the freeze authority can lock selling accounts whenever it wants, so the buy side flows and the sell side jams. Everyone who entered is trapped holding a bag they can't exit, while the chart keeps painting paper gains nobody can realize.

Sometimes it's blanket — every holder frozen. Sometimes it's surgical — the dev freezes specific wallets while letting their own insiders sell into the bids you're providing. Either way the outcome is the same for you: trapped.

Why legit projects revoke it

There are narrow, legitimate uses for freeze authority — regulated stablecoins freeze accounts tied to sanctions or theft, for example. But a memecoin has zero reason to keep the power to lock your tokens. So real projects revoke freeze authority at or shortly after launch, setting it to null forever. It's a one-way, irreversible move, and it's the cheapest trust signal a dev can give. When a launch leaves it active and can't explain why, the explanation is usually the obvious one.

Token-2022: honeypots beyond classic freeze

Here's the part most checklists miss. The newer Token-2022 standard adds extensions that can trap you even when freeze authority looks clean:

• ▸Transfer hooks — the token can run custom program logic on every transfer. A malicious hook can make sells fail by design while letting buys through, a honeypot with no freeze authority in sight.
• ▸Transfer-fee extension — a fee skimmed on every transfer. Set reasonably it's harmless; set near 100% it's an economic honeypot — you *can* sell, you just keep almost nothing.
• ▸Permanent delegate — a role that can move or burn tokens from any account, another way to drain or trap holders.

The takeaway: "freeze authority revoked" is necessary but not sufficient on Token-2022 mints. You have to check the extension set too, because the trap can live somewhere classic SPL checks never look.

How to check before you ape

• ✓Freeze authority is revoked (null) — your sells can't be blocked
• ✓Mint authority is revoked too — supply can't be inflated under you
• ✓On Token-2022 mints, no transfer hook, no permanent delegate, and any transfer fee is sane (not near 100%)
• ✓Liquidity is locked or burned — so a clean contract isn't paired with a pullable pool
• ✓If anything reads as unknown, you treat it as a risk, not a pass

Bottom line

A honeypot is the cruelest rug because it lets you watch profits you can never collect. Active freeze authority is the loudest warning sign — a capability, not a verdict, but one you can't afford to test from inside the trap. Token-2022 widens the attack surface, so check the extensions, not just the old flags. When in doubt, the honest answer is to stay out.

Rug Stop flags active freeze authority automatically and tags it with the on-chain evidence behind the call, alongside Token-2022 extension checks. You get two separate reads — a safety score and a smart-money score — never a bare SAFE/SCAM label, because capability and confirmed behavior aren't the same thing and you deserve to see both. Want the full pre-buy routine? Start with how to check if a Solana token is safe, or just paste a mint and scan it.