Intermediate· Lesson 3 of 8· 3 min

Token metadata and where it lives

The Token program stores a supply and a decimal count. The name, symbol and logo live somewhere else — and where they live decides who can change them.

A mint account has no field for a name. Wallets and explorers get “USDC” and its logo from a separate record that points at the mint, and from a JSON file that record points to. Three locations, three different guarantees.

Metaplex Token Metadata

For classic SPL tokens the record is an account owned by the Token Metadata program, metaqbxxUerdq28cj1RbAWkYQm3ybzjb6a8bt518x1s, at a program derived address built from the mint. Anyone can compute it from the mint alone, which is how a wallet finds the name for a token it has never seen. It holds a name (up to 32 bytes), a symbol (10), a URI (200), an update authority, an is_mutable flag and a few NFT-era fields.

12345

1. The update authority: the only key that can change the fields below.
2. Name and symbol, on-chain. This is what most explorers display.
3. The URI is empty. USDC's logo comes from wallets' own token lists, not the chain.
4. isMutable: true, so the issuer can still edit the record. Setting it false is permanent.
5. tokenStandard is null: the record predates the field. Newer tokens say Fungible.

The off-chain JSON

The URI points to a JSON document with the fields the chain has no room for: description, image, external_url, and for NFTs attributes and properties. Wallets fetch the JSON, then the image. Where it is hosted matters more than people expect:

Token-2022: metadata in the mint

Token-2022 can hold the same fields inside the mint account itself, through two extensions: MetadataPointer, which says where the metadata is, and TokenMetadata, which stores it — name, symbol, URI and free-form key–value pairs. One account, one rent deposit, one authority. Wallets support both layouts; most new Token-2022 mints use this one. Token-2022 metadata extensions has the details.

The update authority

Whoever holds the update authority can rename the token, swap the logo or repoint the URI at any time — as long as is_mutable is true. Two one-way moves close that door: set is_mutable to false, or (on Token-2022) set the metadata's update authority to none. A buyer reading a token should check for a live update authority the same way they check the mint authority; it is the difference between “this is what the token is” and “this is what it is today”.

What wallets actually display

• The on-chain name and symbol, unless the wallet overrides them for well-known tokens from its own list.
• The image from the JSON, cached — a logo change can take a day to show.
• A “verified” tick from a curated list (Jupiter's strict list, the wallet's own), never from the chain. Anyone can create metadata; nobody can create verification.
• Nothing, if the JSON is unreachable. A token with a dead URI shows as a bare address.

Lookalikes

Nothing on-chain stops a second mint from naming itself USDC with the same logo. The metadata record is cheap and the fields are free text. That is why the mint address is the only identity that counts, and why the update authority and the creator's other tokens are worth a look — Token Inspector surfaces both, and flags a name that matches a well-known token on a different mint.

Editing yours

Token Manager updates name, symbol and URI for tokens whose update authority you hold, on either layout, and can make the record immutable when you are done. Upload the new logo first so the URI you write already resolves.