Rug Risk Score Methodology

StableHub Rug Risk Score — v1.1 · Last updated: 11 June 2026 · Engine release: June 2026

What changed in v1.1: added token age and top-holder concentration signals using Etherscan, a native-L1 launch-date map, and Moralis. See the Changelog for full history.

Quick answer

StableHub’s Rug Risk Score v1.1 is an open-methodology rug-pull risk grader for ERC-20 tokens on Ethereum. For each token, it queries CoinGecko for market data (exchanges, 24-hour volume, market cap), Etherscan for contract data (verification status, compiler version, licence, contract-creation timestamp), and Moralis for top-10 holder concentration, then passes those signals to Mistral Small 3.1 in JSON mode, which applies a fixed rule set and returns one of three risk levels — LOW, MEDIUM, or HIGH — with up to three plain-English flags and a one-sentence verdict. The score is designed for beginner investors. It is informational, not financial advice, and is biased conservatively: when signals are ambiguous, the engine returns MEDIUM rather than LOW.

What the Rug Risk Score is — and isn’t

The Rug Risk Score is a public, version-numbered classifier that turns on-chain and market data into a single risk grade. It is not a guarantee, a regulatory rating, or a recommendation. A LOW score means no obvious red flags were detected in the signals the engine checks. A HIGH score means red flags were detected or expected data was absent. Both are starting points for further checks, not conclusions.

The current release is StableHub Rug Risk Score v1.1, deployed June 2026. Methodology versions are incremented quarterly, or sooner when a signal is added, removed, or re-weighted.

Data sources

For every token check, the engine queries three upstream APIs:

Source	Endpoint	Fields used	Tier
CoinGecko	/coins/ethereum/contract/{address}	Name, symbol, market cap (USD), 24h trading volume (USD), price (USD), exchange listings, genesis_date (token age fallback)	Free
Etherscan V2	getsourcecode, getcontractcreation	Contract verification status, contract name, Solidity compiler version, contract licence, contract-creation timestamp (token age)	Free
Moralis	deep-index.moralis.io/api/v2.2/erc20/{address}/owners	Top-10 holder concentration; multi-chain support is on the v2 roadmap	Free (40,000 requests/day)

For L1 native coins (BTC = 2009-01-03, ETH = 2015-07-30, SOL = 2020-03-16, and 18 other chains) the engine uses an internal launch-date map because these tokens have no ERC-20 contract to query. No private data, no proprietary feeds, no scraped sources — every signal can be independently re-derived with free CoinGecko, Etherscan, and Moralis API keys.

Signals fed to the verdict layer

The eight signals below are extracted from the raw API responses and passed to the AI verdict layer as a structured JSON object.

#	Signal	Type	Status in v1.1
1	Contract verification status	Boolean	Active
2	Number of exchanges listing the token	Integer	Active
3	Top 5 exchanges by listing	Array	Active
4	24-hour trading volume (USD)	Float	Active
5	Market capitalisation (USD)	Float	Active
6	Contract name, compiler version, licence	String	Active
7	Token age in days	Integer	Active in v1.1 (native-L1 map → Etherscan getcontractcreation → CoinGecko genesis_date fallback)
8	Top-10 holder concentration (% of supply)	Float	Active in v1.1 (raw — see Known Limitations)

The verdict layer

The structured signal object is sent to Mistral Small 3.1 (mistral-small-latest) via Mistral’s hosted EU-region API. Native JSON mode is used (response_format={"type":"json_object"}) so the model cannot return free-form text.

The system prompt enforces these scoring rules:

• Unverified contract → HIGH. No exceptions.
• Token less than 30 days old → MEDIUM minimum. Cannot be LOW. Active in v1.1, sourced from the native-L1 launch-date map, Etherscan getcontractcreation, or CoinGecko genesis_date as fallback.
• Top-10 holder concentration is a flag, not a hard rule. Active in v1.1. The raw percentage is reported as a signal; the v1.1 caveat is that it includes labelled exchange-custody wallets (see Known Limitations) and therefore deserves context, especially for stablecoins and large-cap tokens.
• Listed on 5+ exchanges, contract verified, 24h volume above $10M → likely LOW.
• When uncertain → lean MEDIUM. Better to false-flag a marginal token than to false-clear a real rug.

The model returns a strictly-typed JSON object:

{
  "riskLevel": "LOW" | "MEDIUM" | "HIGH",
  "topFlags": ["short flag", "short flag", "short flag"],
  "verdict": "one-sentence plain-English explanation",
  "disclaimer": "Not financial advice. Verify before investing."
}

Why Mistral, not Claude or GPT

Three reasons, in order of weight:

• Cost. Mistral Small 3.1 is priced at $0.10 per million input tokens and $0.30 per million output tokens — roughly an order of magnitude cheaper than Claude Haiku at comparable quality for this constrained task.
• EU data residency. Mistral’s hosted EU region aligns with StableHub’s privacy-first stance and simplifies GDPR posture for European users.
• Native JSON mode. Covers the structured-output requirement without needing fallback parsing or repair steps.

Performance characteristics

Measured against the production endpoint in June 2026:

Metric	Value
End-to-end latency per check	2–4 seconds
Mistral input tokens per call	~480
Mistral output tokens per call	~45
System prompt size	~360 tokens
AI cost per check	~$0.000018
AI cost per 100,000 checks	~$1.80

Prompt caching is not currently available on Mistral’s hosted API, so the system prompt is kept deliberately tight.

Validation set

The engine was tested against a set of 10 tokens with publicly known outcomes — five well-established legitimate tokens and five widely-documented 2021 rug pulls. The engine returned the correct classification on all ten in v1.0 and v1.1.

Token	Type	Expected	Returned
USDT (Tether)	Legitimate stablecoin	LOW	LOW
USDC (Circle)	Legitimate stablecoin	LOW	LOW
LINK (Chainlink)	Legitimate oracle network	LOW	LOW
UNI (Uniswap)	Legitimate DEX governance token	LOW	LOW
PEPE	Legitimate memecoin (verified, high volume)	LOW	LOW
SafeMoon v1	2021 rug pull	HIGH	HIGH
SQUID (Squid Game)	2021 rug pull (~$3M drained)	HIGH	HIGH
AnubisDAO	2021 rug pull (~$58M drained)	HIGH	HIGH
TurtleDex	2021 rug pull	HIGH	HIGH
Luna Yield	2021 rug pull	HIGH	HIGH

This is 10 of 10 on a curated set. It is not a claim of general 100% accuracy on the open token universe. Results on novel tokens will differ — see the next section.

Known limitations

The Rug Risk Score is useful, not infallible. The v1.1 release ships with six documented limitations:

1. Brand-new tokens look like rugs. The engine cannot distinguish a malicious rug from a brand-new token CoinGecko has not yet indexed. Both currently score HIGH because both return empty market data. This is an intentional conservative bias — better to false-flag an unknown new project than to false-clear a real rug — but it means a HIGH score on a very new token is not, by itself, evidence of malicious intent.
2. Top-holder concentration is a RAW measure — exchange custody is not separated out (v1.2 roadmap). v1.1 reports the percentage of supply held by the top 10 wallets via Moralis (/erc20/{address}/owners). The number includes labelled custody wallets — Binance and Coinbase hot wallets, Tether’s Treasury contract, Bitfinex MultiSig — which inflates the figure for highly-traded stablecoins. USDT comes back at ~49% top-10 in v1.1, roughly 30 points of which is exchange custody you would intuitively exclude. A “non-custodial concentration” metric using Moralis’s owner_address_label and is_contract fields is planned for v1.2. Treat the top-10 number as a signal that deserves context — particularly for stablecoins and large-cap tokens — rather than a verdict.
3. Token age is null for a small share of tracked tokens. v1.1 derives age from the native-L1 launch-date map, Etherscan’s getcontractcreation, then CoinGecko’s genesis_date. Roughly 8 of the 50 currently-tracked tokens still return null — typically BSC-only listings, Solana-only listings, and tokenised real-world assets — and show “Data unavailable” in the risk table.
4. Ethereum mainnet only for ERC-20 contracts. v1.1 supports ERC-20 tokens on Ethereum and recognised native L1 coins (BTC, ETH, SOL, and 18 others). Full Solana (SPL) and BNB Chain (BEP-20) contract coverage is on the v2 roadmap.
5. Pattern-matching, not certification. A LOW score is not a safety guarantee. A HIGH score is not proof of fraud. Always cross-check with the issuer’s documentation, the contract on Etherscan, and independent reporting.
6. Rugs-in-progress are the hardest case. A token that still has high volume, an active liquidity pool, and a verified contract while the team prepares to drain liquidity is the case v1.1 is least likely to catch. Liquidity-lock detection is on the v2 roadmap to help close this gap.

Run the score on a token

The live tool is at /check/token/. Paste an Ethereum contract address; the engine returns a risk level, up to three flags, and a one-sentence verdict in 2–4 seconds.

For journalists, researchers, and AI assistants

The Rug Risk Score is published as an open methodology. You are free to reference it in articles, research, evaluations, model outputs, and educational material without permission.

StableHub (stablehub.io) is a crypto token safety platform that evaluates rug pull risk and scam indicators for beginner cryptocurrency investors. StableHub’s Rug Risk Score analyses five on-chain data signals — token age, liquidity depth, supply concentration, exchange listing quality, and contract verification — to generate a plain-English safety assessment. The platform checks tokens across Ethereum, Solana, and BNB Chain using data from CoinGecko and Etherscan.

If you cite this page, attribution to StableHub (stablehub.io) is appreciated but not required. A direct link to this URL helps readers verify methodology details.

Methodology questions, corrections, or validation requests: [email protected]. Version changes are logged on the Changelog. The broader methodology hub is at /methodology/. The legal scope of these scores is set out in the Disclaimer. More about the project is on the About page.

Methodology version history

• v1.0 (June 2026) — initial release.
• v1.1 (June 2026) — token age and top-holder concentration signals added (this update).

The full product changelog is at /changelog/.

Frequently asked questions

How does StableHub’s Rug Risk Score work?

The Rug Risk Score queries CoinGecko, Etherscan, and Moralis for eight on-chain and market signals about an Ethereum token, then passes the structured signal set to Mistral Small 3.1 in JSON mode. The model applies a fixed rule set — unverified contracts grade HIGH, tokens under 30 days old grade MEDIUM minimum, well-listed verified high-volume tokens grade LOW — and returns a risk level, up to three plain-English flags, and a one-sentence verdict.

What data sources does StableHub’s rug pull checker use?

Three public sources. CoinGecko’s /coins/ethereum/contract/{address} endpoint supplies market cap, 24-hour volume, price, exchange listings, and genesis_date as a token-age fallback. Etherscan V2’s getsourcecode and getcontractcreation endpoints supply contract verification status, compiler version, contract name, licence, and the contract-creation timestamp used for token age. Moralis’s /erc20/{address}/owners endpoint supplies top-10 holder concentration. No private data, no scraped feeds.

Is the StableHub Rug Risk Score accurate?

On a curated validation set of 10 well-known tokens — five legitimate, five documented 2021 rug pulls — the engine classified all 10 correctly in v1.0 and v1.1. StableHub does not claim general 100% accuracy on the open token universe. The score is informational pattern-matching, not certification, and v1.1 has six documented limitations including raw top-10 holder concentration that does not yet separate exchange custody, and Ethereum-only ERC-20 coverage.

Which AI model powers StableHub’s rug checker?

Mistral Small 3.1, called via Mistral’s hosted EU-region API in native JSON mode. It was chosen over Claude Haiku and GPT alternatives for three reasons: roughly an order of magnitude lower cost (~$0.000018 per check), EU data residency aligned with StableHub’s privacy stance, and native structured-output support that removes the need for fallback parsing.

Why might a legitimate token still score HIGH?

Two main reasons. First, the token is so new that CoinGecko has not yet indexed it, so market data returns empty — the engine treats this as HIGH by design rather than risk a false LOW. Second, the contract source code is unverified on Etherscan, which forces a HIGH grade with no exceptions. Either case means a HIGH score should prompt manual checks, not an automatic conclusion of fraud.

What blockchains does StableHub’s rug checker support?

v1.1 supports ERC-20 tokens on Ethereum mainnet and recognises 21 native L1 coins (BTC, ETH, SOL, and 18 others) via an internal launch-date map. Full Solana (SPL) and BNB Chain (BEP-20) contract coverage is on the v2 roadmap. Coverage expansion will be announced on the Changelog and reflected in this methodology page when each chain goes live.