How Liquidity Locking Works (and Why It Prevents Rug Pulls)

Q: How long should I lock liquidity for?

Industry standard for memecoins is 6–12 months minimum. Many serious projects burn LP outright. A lock under 30 days is widely considered a red flag.

Q: How do I verify a liquidity lock on Solana?

Find the lock contract address on the project's site or DexScreener, open it on Solscan or Solana Explorer, and confirm the LP token balance, unlock date and that the contract is the audited Streamflow/PinkLock program.

Q: What is the difference between locking and burning LP?

Burning sends LP tokens to a null address — irreversible and permanent. Locking puts them in a vault that releases after a set date. Burning is stronger; locking preserves upgrade flexibility.

Q: Can a project still rug pull with locked liquidity?

They can't drain the locked pool, but they can dump team tokens, deploy a second unlocked pool, or exploit a malicious tax/blacklist function in the token contract. LP lock is necessary but not sufficient — combine it with a token audit.

Locking liquidity means depositing the LP (liquidity provider) tokens of a DEX pool into a smart-contract vault that cannot be withdrawn until a future date. Because LP tokens are what entitles their holder to pull the underlying SOL and token reserves, locking them removes the deployer's ability to rug the pool.

Definition

A liquidity lock is a programmatic time-lock on the LP tokens issued by an AMM pool (Raydium, Orca, Meteora). The LP tokens are transferred to an audited lock contract — Streamflow, PinkLock, Team.Finance — which only releases them after a chosen unlock date. While locked, no one (including the deployer) can withdraw the underlying liquidity.

How it works step by step

Creator seeds a DEX pool (e.g. Raydium) with SOL + token and receives LP tokens in their wallet.
Creator opens a lock contract (Streamflow is the Solana standard) and selects an unlock date, e.g. 1 year.
LP tokens are transferred from the creator's wallet into the lock vault on-chain.
The lock contract issues a public proof URL anyone can verify on a block explorer.
After the unlock date, the original depositor (or a multisig) can withdraw and either re-lock or remove liquidity.

LP burn vs LP lock

Burning LP tokens (sending them to a null address) is permanent and stronger than a lock, but it also makes future migrations impossible.
Locking keeps optionality — the project can renew the lock or migrate to a new pool when the lock expires.
For pure memecoins, burning is the gold standard. For projects that may need to add liquidity later, a long lock (12+ months) is acceptable.

Benefits

Removes the most common rug-pull vector.
Increases buyer trust and improves listing odds on aggregators (DexScreener, Birdeye, Jupiter).
Required by most reputable launchpads, audit tools and marketing partners.
Easy to verify — anyone can paste the lock address into a Solana explorer.

Risks and limitations

A lock does not prevent the deployer from dumping tokens they still hold.
A lock only protects the pool it covers; secondary pools on other DEXs may still be drainable.
Short locks (< 30 days) provide almost no protection.
Always check the lock contract is the verified version from a reputable provider.

Frequently Asked Questions

How long should I lock liquidity for?

Industry standard for memecoins is 6–12 months minimum. Many serious projects burn LP outright. A lock under 30 days is widely considered a red flag.

How do I verify a liquidity lock on Solana?

Find the lock contract address on the project's site or DexScreener, open it on Solscan or Solana Explorer, and confirm the LP token balance, unlock date and that the contract is the audited Streamflow/PinkLock program.

What is the difference between locking and burning LP?

Burning sends LP tokens to a null address — irreversible and permanent. Locking puts them in a vault that releases after a set date. Burning is stronger; locking preserves upgrade flexibility.

Can a project still rug pull with locked liquidity?

They can't drain the locked pool, but they can dump team tokens, deploy a second unlocked pool, or exploit a malicious tax/blacklist function in the token contract. LP lock is necessary but not sufficient — combine it with a token audit.