A Beginner's Guide to Solana Token Security

Buying a Solana token takes seconds. Paste an address, approve a swap, done. Figuring out whether that token is safe to hold can take considerably longer — and most people skip it entirely, because nothing about the buying flow asks them to.

That's the gap this guide is about. Not "is crypto risky" in the abstract, but the specific, checkable facts about a token that separate a normal launch from one built to take your money. All of it is public. None of it requires trusting the team, the Discord, or the chart.

What You're Actually Buying

A Solana token is an entry in a program called the SPL Token program (or its newer sibling, Token-2022) — not a smart contract the way an Ethereum token is. Every token has a mint account, which holds its supply, decimals, and metadata, and every wallet that holds it has its own token account tied to that mint. Creating one costs a few dollars and takes a few clicks; there's no vetting step, no minimum viability check, nothing stopping anyone from launching a token that looks, in a wallet or on a chart, indistinguishable from a legitimate one.

That ease is a feature — it's a large part of why Solana has an active token ecosystem at all. It's also why "the token exists and people are trading it" tells you nothing about whether it's safe.

The Keys That Can Still Change It

Here's the first thing worth checking, and the one most people skip: a mint account isn't necessarily finished changing after launch. Up to five separate keys, called authorities, can still act on it — and whether they exist, and who holds them, is public information anyone can read straight off the mint.

Mint authority can call mintTo and create new supply, at any time, in any amount, with no cap enforced by the protocol. A token marketed as "fixed supply" with a live mint authority doesn't actually have a fixed supply — it has a supply that's fixed until whoever holds that key decides otherwise.

Freeze authority can lock any holder's token account, instantly, without their consent. Legitimate issuers use this for compliance reasons — a stablecoin needs to be able to freeze a sanctioned wallet — but on a token marketed as decentralized, an undisclosed freeze authority means the creator can lock your balance whenever they want.

Update authority controls the token's name, symbol, and logo — a separate Metaplex account for standard SPL tokens, fields on the mint itself for Token-2022. It's the least dangerous of the five in terms of moving funds, and the most useful for impersonation: nothing stops it from being changed to mimic a token people already trust.

Permanent delegate, a Token-2022 extension, can move or burn tokens out of any holder's account without their signature. It's rare — most mints don't have one — and when it's present, it's the closest thing Solana tokens have to a built-in theft mechanism.

Close authority can close the mint once its supply hits zero. It's the mildest of the five; there's rarely a real reason to worry about it on its own.

None of these authorities being live is automatically a scam. A team running an active mint-and-burn model has a real reason to keep mint authority. A regulated product has a real reason to keep freeze authority. The problem isn't that an authority exists — it's when it exists silently, on a token marketed as fully decentralized, and nobody checks. When mint or freeze authority is set to None, that's not a promise; it's a fact enforced by the runtime, permanent, with no override. See how to revoke mint and freeze authority for what that looks like from the creator's side.

Common Solana Scam Patterns

Authorities cover keys that can act on the mint directly. Everything below is a different category — the actual, recurring shapes these launches take, in roughly the order you'd run into them. None of it requires guessing at intent; every pattern here is visible in public account data, and most of them show up stacked two or three at a time on the same token.

Fixed supply, live mint authority. The most common gap between what a token claims and what it enforces. A project's site says "1,000,000,000 fixed supply, no more will ever be minted," and the mint account's authority field still shows a live address. Nothing on-chain backs the claim — the deployer can call mintTo for another 500 million tomorrow, dilute every holder in one transaction, and there's no vote, no timelock, no warning built into the protocol that would stop them. The claim isn't a lie about the present; it's a promise about the future, made by someone who's kept the one key that can break it.

The undisclosed freeze authority. Rarer to check than mint authority, and just as dangerous. A live freeze authority means the deployer can lock any individual wallet's balance — not the whole pool, just yours, specifically, the moment you look like you're about to sell into a pump. There's no on-chain event that warns you beforehand; the first sign is usually a transaction that simply fails.

Honeypot trading restrictions. A token that's easy to buy and impossible, or nearly impossible, to sell. On Token-2022 mints this is usually a TransferHook extension — a program that runs on every transfer and can be written to allow the deployer's own sells while silently reverting everyone else's — or a transfer-fee authority free to raise the tax to 100% on a whim, which has the same practical effect as blocking the sell outright. The NonTransferable extension is the blunt version: every transfer instruction is rejected by the program itself, for every wallet but the mint, no exceptions. It's a legitimate extension for things like soulbound credentials; it's a trap on anything marketed as an ordinary tradeable token. The tell in the wild is almost always the same — normal-looking buy volume and almost no successful sells from anyone but the deployer's own wallets.

Copycat names and impersonated metadata. A scam token created with the same name, ticker, and logo as something you already trust — sometimes with a cloned website — because none of that is unique on-chain, and a live update authority means even a token that looked clean yesterday can be rebranded to impersonate something else tomorrow. The only field that can't be copied is the mint address itself, and the only place to get it safely is the real project's own site or docs, never a search result or a link forwarded in a group chat.

Fake token-approval requests. The mechanism behind most wallet drainers: a "claim your airdrop" or "verify your wallet" button that, instead of doing what it says, builds a transaction granting a delegate address permission to move tokens out of your account later, or transfers them out directly right now. Nothing about the wallet's confirmation screen is fake — it's showing you exactly what the transaction does — but the button label lied about it, and a rushed read of a dense confirmation screen is exactly what the attack is built around. How wallet-drainer contracts work covers the two transaction shapes in detail.

Unsolicited "airdrops" used as bait. Sometimes the risk isn't a token you're evaluating to buy — it's one that simply showed up in your wallet. A token you never requested, whose metadata links to a site prompting you to connect your wallet and sign something to "claim" a reward, is bait: the theft isn't the token account sitting there doing nothing, it's the signature you'd give after clicking through to investigate it. The safest response to an unexpected token is not interacting with it at all.

Concentrated holder distribution dressed up as organic. Picture a token with 1 billion tokens circulating where the top five non-pool wallets hold 70% of supply. The chart can look completely ordinary — real volume, hundreds of holders swapping small amounts back and forth — while a handful of wallets retain enough of the float to crash the price the moment they decide to sell. Sometimes this concentration is split across dozens of wallets that all trace back to the same funder, specifically to avoid looking like one whale address.

Bundled and sniped launches. A more specific version of the same problem, visible only in wallet-level forensics: a cluster of top holders whose very first buy was paid for by the same outside wallet — a "bundle" — or who all bought within the first five minutes of launch — "sniping." Either pattern means a coordinated group, not organic demand, got a disproportionate share of supply before anyone else had a real chance to buy, and it's sitting there as one effective hand on the sell button, however many wallets it's spread across.

Unlocked liquidity — the actual rug pull. Every pool has LP tokens representing a claim on the liquidity behind it, and whoever holds them can withdraw that liquidity, whole, in a single transaction. If those LP tokens are burned or locked in an audited locker, that's not possible. If they're sitting in an ordinary wallet, the deployer can pull every dollar of liquidity out from under holders at any moment, leaving a token that still "exists" and still shows a price chart, with a pool worth nothing behind it.

Serial deployers running a token factory. A deployer address — traceable through the update authority — that has launched a string of previous tokens, most of which now show no liquidity at all, is running a pattern: launch, generate volume, let it die, launch the next one. One dead prior token isn't damning; a deployer with ten tokens and nine of them abandoned is a business model, and it's checkable before you become token number eleven.

Pump-and-dump momentum. A price that's down 70% or more in 24 hours, especially paired with a volume spike, is almost never a "healthy correction" — it's usually the tell of a coordinated exit, insiders or bundled wallets selling into the exact demand that got generated to attract them.

Urgency, fake audits, and unverifiable claims. The social layer wrapped around most of the above: countdown timers ("presale ends in 10 minutes"), an "audited" badge with no audit report linked anywhere, a "doxxed team" that can't actually be verified as anyone in particular. None of this framing is proof of a scam by itself — plenty of legitimate launches use urgency language sloppily — but it's a reliable cue to slow down and check the mechanics above instead of trusting the tone.

How to Actually Check a Token

In practice, checking a token before you buy comes down to a short, repeatable set of questions.

The mint address, first. Not the name in a group chat, not the ticker — the actual address, from the project's own site or docs. This is the one field a copycat can't fake, because faking it means it's a different token.

Mint and freeze authority. Any wallet or explorer shows these fields on the mint account. You're looking for None. A live address on either one is worth a direct question, not an assumption that it'll be revoked "soon."

Supply and decimals. Do they match what's actually being advertised? A token claiming a 1 billion cap should show a supply of 1 billion, not something a live mint authority could still be adjusting.

Metadata. Is there any, and is the update authority still live? Metadata with no update authority is locked in; metadata with a live one can be rewritten at any point, logo included.

Holder distribution. Imagine a token with 1 billion tokens circulating, where the top five wallets — excluding liquidity pools — hold 70% of them. The chart can look completely normal, with real volume and hundreds of holders trading small amounts back and forth, while a handful of wallets retain enough supply to crash the price whenever they choose. Concentration isn't damning on its own — legitimate treasury and LP wallets show up as large holders too — but it needs reading alongside which addresses hold the supply, not treated as a single scary number.

Liquidity. How much is actually sitting in the pool, and who controls the LP tokens for it? A pool with liquidity locked or burned can't be pulled out from under holders. A pool where LP tokens sit in an ordinary wallet can be drained by whoever holds that wallet's keys, at any moment, with the token's price collapsing to near zero in the same transaction.

How the Scams Actually Play Out

The mechanisms above rarely show up alone. A typical bad launch stacks several of them — live mint authority, a concentrated top 10, thin liquidity in an unlocked wallet — and dresses the combination in urgency: a countdown timer, an "audited" claim with no audit linked, a "doxxed team" that can't actually be verified. None of that framing is proof of a scam by itself. What is checkable is the underlying mechanics, which is why the specific facts above matter more than how confident the marketing sounds. Common Solana scam patterns goes deeper on the recurring structures if you want the fuller list.

A 60-Second Security Check

Put together, here's what actually fits into the time it takes to read a few tweets about a token before deciding whether to buy it:

None of these require insider knowledge or a paid tool. They require looking at the mint account instead of the marketing around it.

A Worked Example

Say you're comparing two tokens that both look active on a chart. Mint A: mint and freeze authority both read None, the top 10 non-pool wallets hold 18% of supply, and liquidity is deep and locked. Mint B: mint authority is a live address, freeze authority is the same address, and the top 10 wallets hold 71% — most of it in one wallet that also happens to be the deployer's.

Nothing about a price chart or a follower count would tell these two apart. The mint account does, immediately. That's the entire point of checking it before you buy rather than after.

Tools Worth Knowing

You can do every check above by hand, one field at a time, on Solana Explorer or Solscan — reading the raw account is always the ground truth, and it's worth knowing how, which how to read Solana Explorer walks through. For a faster pass, Token Inspector pulls all of it into one number: a score from 0 to 100, starting clean and losing points per finding, weighted so a key that can actually take your tokens costs far more than a signal that merely correlates with risk — a live permanent delegate or a non-transferable mint caps the score outright, while a locked metadata field costs almost nothing. It adds holder forensics on top of the raw mint fields: which top holders bought within minutes of launch, which share a fee payer or funding wallet, and how much of supply the deployer itself still holds. Account Inspector is the more general version for reading any account, token or otherwise, when you're not sure what you're looking at yet.

A high score isn't a verdict — it can't read intent or guarantee a team won't do something dumb tomorrow. It's one input, built from facts nobody can fake, which is precisely the kind of input worth having before the others.

Common Questions

Is a token with live mint authority always a scam? No. Established projects — a stablecoin, a token actively used for staking rewards — often keep it deliberately, for reasons they can explain. The problem is a live authority combined with a claim of fixed supply, or one that's simply never disclosed.

Can I check these things without connecting my wallet? Yes. Every field discussed here — authorities, supply, metadata, holder distribution, liquidity — is public account data. Reading it never requires a signature, an approval, or connecting anything.

Do bundled or sniped wallets always mean the token is a scam? Not automatically. A dozen bundled wallets sitting on 3% of supply is a launch tactic, common even on tokens that turn out fine. The same dozen wallets holding 30%, still unsold, is a different situation — the severity is in how much of supply the group actually controls, not just whether the pattern exists.

If liquidity is locked, is the token safe? It closes off one specific failure mode — the deployer pulling the pool out from under holders. It says nothing about mint authority, freeze authority, holder concentration, or whether the metadata could still be rewritten. Locked liquidity is one checkmark on the list, not the whole list.

Does a revoked mint authority mean the token is safe? It means one specific risk is closed off permanently. It says nothing about freeze authority, holder concentration, liquidity, or whether the metadata is about to be swapped to impersonate something else. Safety is the combination of checks, not any single one.

What's the single fastest check if I only have ten seconds? Mint and freeze authority. They're the two fields most directly tied to whether your tokens can be taken or locked without your consent, and they're a two-second read on any explorer.

Final Thoughts

Don't trust the ticker. Don't trust the logo. Don't even trust the project's own website — all three can be copied. The mint address and its authorities can't be, and reading them takes less time than most people spend deciding which meme to reply to a launch announcement with. That trade is worth making every time.