The Illusion of the Green Checkmark
In decentralized finance, liquidity locking is meant to be the ultimate safeguard against rug pulls. When developers lock their liquidity pool tokens, investors believe those funds are inaccessible until a predetermined unlock timestamp arrives.
However, as retail traders learned to demand lock links, scammers engineered a deceptive workaround: the Fake Locker Contract Scam. Instead of using industry-standard, audited locking infrastructure, scammers build or deploy unverified custom contracts that mimic legitimate lockers on the surface while retaining a secret backdoor.
How the Fake Locker Works
To the average user glancing at a transaction on Solscan, a fake lock looks completely genuine:
- The Custom Contract: The developer deploys an unverified smart contract on Solana designed to look like a custodial lock vault.
- The Deposit Instruction: The developer transfers 100% of their Raydium LP tokens into this contract. The transaction clearly displays LP tokens leaving the developer's personal wallet and entering the contract account.
- Marketing the Proof: The developer shares the transaction link across Telegram and Twitter, claiming the liquidity is locked for one year. Unsuspecting buyers see the tokens sitting in a separate contract address and buy in with confidence.
- The Emergency Backdoor: Inside the custom contract code, the developer included an unrestricted administrative instruction (such as
emergencyWithdrawor an arbitrary delegate transfer). Once retail liquidity reaches its peak, the developer executes this instruction, reclaims the LP tokens, and drains the pool.
Reputable Lockers vs Custom Traps
On Solana, legitimate locks must occur through recognized, open-source, and audited protocols such as Streamflow or native Raydium token incinerators. Any lock hosted on an unknown decentralized application or an unverified custom program address should be treated as an immediate red flag.
If liquidity is not burned permanently to the Solana incinerator address, you must verify the contract program ID governing the custody vault.
Automated Locker Verification with RugPullShield
Manually auditing bytecode and program IDs for every new token launch is impractical for retail traders. RugPullShield handles this verification automatically.
Our scanner does not merely check if LP tokens moved out of the deployer wallet. It evaluates the exact custody program holding the LP tokens, verifies protocol reputation against our database of audited lockers, and inspects withdrawal permissions. If a token utilizes an unverified or custom locking contract, RugPullShield alerts you before you put your capital at risk.