🐕 The Rug Sniffer

Paste any Sonic token — see what its owner CAN do to you. We show the powers and rate the rug signal — this is what the owner CAN do, not what they will — we never render a verdict. You judge.

🤓 Advanced mode. Run a report and this fills with the full technical read — every probe and its raw result, the bytecode facts, each owner power with its selector and where it came from, and a plain statement of what the check does not prove.

❓ How it works

Every token on Sonic is just code, and that code can hand its creator powers — printing more coins, freezing transfers so nobody can sell, blocking wallets, raising the tax.

The Rug Sniffer reads the code and shows you which of those powers exist.

Using it

Paste a token address and press sniff it 🐕.
It reads the blockchain directly — no wallet, no signing, no gas, and nothing leaves your device.
You get a rug signal, then every power listed in plain English.

The signal

🔥 High — the owner holds serious powers
⚠️ Medium — a few levers
🐕 Low — none found

Switch to 🤓 Advanced for exact function names and code details.

Sniffing our own house

Paste any of BLAZE's 14 verified contracts — all the way down to the 🔒 LP lock holding 90% of both pools until March 2028 — and the nose says what it is first, including when it is not a token and there is nothing here to sniff. That card is identity, never a clean bill of health: it names our own owner powers out loud, and the full scan still runs underneath it. 🔥

A power existing is not the same as the owner using it. Plenty of honest tokens can pause or mint for good reasons.

We show you the facts and let you decide — we never call anything a rug, and we never bless a coin either. We also can't see everything, so read "What this nose can't smell" before you buy. 🔥

🐕 What this nose can't smell

No buy/sell simulation — we never trade the token, so a transfer that only reverts on the DEX path (not a plain wallet-to-wallet transfer) won't show up here.
Unverified source means every name you see is inferred from selectors, not read from a label — a match is a strong hint, not a citation.
Dead code can trip a false positive: a selector can be compiled in and unreachable, so a power we report may never actually be callable.
Nonstandard function names are a false negative risk — a rename defeats a selector match even when the underlying power is very much still there.
We only look for AccessControl machinery (roles exist) — we do not, and cannot without a log scan, list who actually holds those roles.
Proxy detection is EIP-1967 only. EIP-1167 minimal-proxy clones and beacon proxies are NOT detected — a contract using either pattern will read as a plain, non-upgradeable contract here.
We flag POWERS, not intent. We never render a verdict on any token here. The green "known project" card is identity recognition — the address matches a project's published contract — and that is all it is.