A Beginner's Guide to Solana Token Security

Buying a Solana token takes seconds. You paste an address and approve a swap. Working out whether the token is safe to hold takes longer, and most people never do it, because nothing in the buying flow asks them to.

This guide is about that step. It isn't about whether crypto is risky in general. It covers the specific facts you can check about a token that tell a normal launch apart from one built to take your money. All of them are public, and none of them depend on trusting the team, the Discord or the chart.

What you're buying

A Solana token is an entry in the SPL Token program or its newer sibling, Token-2022. It isn't its own smart contract the way an Ethereum token is. Every token has a mint account, which holds its supply, decimals and metadata, and every wallet that holds it has its own token account linked to that mint. Creating a token costs a few dollars and takes a few clicks. Nobody reviews it, and nothing stops anyone launching a token that looks exactly like a legitimate one in a wallet or on a chart.

That ease is a large part of why Solana has such an active token scene. It's also why "the token exists and people are trading it" tells you nothing about whether it's safe.

The keys that can still change it

Start here, because most people skip it. A mint account can keep changing after launch. Up to five separate keys, called authorities, can still act on it. Whether they exist, and who holds them, is public, and anyone can read it straight off the mint.

Mint authority can call mintTo and create new supply at any time, in any amount. The protocol enforces no cap. A token sold as "fixed supply" with a live mint authority doesn't have a fixed supply. Its supply stays fixed only until the key holder decides otherwise.

Freeze authority can lock any holder's token account instantly, without asking. Legitimate issuers use it for compliance, since a stablecoin has to be able to freeze a sanctioned wallet. On a token sold as decentralized, an undisclosed freeze authority means the creator can lock your balance whenever they like.

Update authority controls the token's name, symbol and logo. For standard SPL tokens these live in a separate Metaplex account, and for Token-2022 they're fields on the mint. It's the least dangerous of the five for moving funds and the most useful for impersonation, because nothing stops the holder from changing the token to look like one people already trust.

Permanent delegate is a Token-2022 extension that can move or burn tokens out of any holder's account without their signature. Most mints don't have one. When a mint does, it's the closest thing Solana tokens have to a built-in way of stealing from holders.

Close authority can close the mint once its supply reaches zero. It's the mildest of the five, and on its own there's rarely any reason to worry about it.

A live authority doesn't make a token a scam. A team running a mint-and-burn model has a real reason to keep mint authority, and a regulated product has a real reason to keep freeze authority. The problem is an authority nobody mentions, on a token marketed as fully decentralized, that nobody checks. When mint or freeze authority is set to None, you aren't relying on a promise. The runtime enforces it permanently and nobody can override it. How to revoke mint and freeze authority shows this from the creator's side.

Common Solana scam patterns

Authorities are keys that act on the mint directly. The patterns below are something else: the shapes bad launches keep taking, roughly in the order you'd run into them. You don't have to guess anyone's intent. Each one shows up in public account data, and they often appear two or three at a time on the same token.

Fixed supply with a live mint authority. This is the most common gap between what a token claims and what it enforces. The project's site says "1,000,000,000 fixed supply, no more will ever be minted", and the mint's authority field still shows an address. Nothing on-chain backs the claim. The deployer can mint another 500 million tomorrow and dilute every holder in one transaction, and the protocol has no vote, timelock or warning to stop it. The claim may be true today. It's a promise about the future from someone who kept the one key that can break it.

An undisclosed freeze authority. People check this less often than mint authority, and it's just as dangerous. A live freeze authority lets the deployer lock a single wallet's balance, yours, just as you're about to sell into a pump. Nothing on-chain warns you first. Usually the first sign is a sell that fails.

Honeypots. These tokens are easy to buy and impossible, or nearly impossible, to sell. On Token-2022 this is usually a TransferHook extension, a program that runs on every transfer and can be written to let the deployer's sells through and fail everyone else's. A transfer-fee authority that can raise the fee to 100% whenever it likes has the same effect. The NonTransferable extension is the blunt version: the token program rejects every transfer, for every holder. It has honest uses, such as soulbound credentials, but on anything sold as an ordinary tradeable token it's a trap. You can nearly always spot a honeypot the same way: normal-looking buys and almost no successful sells from anyone except the deployer's own wallets.

Copycat names and impersonated metadata. A scam token can copy the name, ticker and logo of something you already trust, sometimes with a cloned website too, because none of those are unique on-chain. With a live update authority, a token that looked clean yesterday can be renamed tomorrow to pose as something else. The mint address is the one thing that can't be copied. Get it from the real project's own site or docs, and never from a search result or a link forwarded in a group chat.

Fake approval requests. This is how most wallet drainers work. A "claim your airdrop" or "verify your wallet" button builds a transaction that gives a delegate permission to move your tokens later, or sends them out right away. The wallet's confirmation screen isn't fake. It shows what the transaction does. The button label lied, and the attack depends on you skimming a dense confirmation screen in a hurry. How wallet-drainer contracts work explains both transaction shapes.

Unsolicited airdrops as bait. Sometimes the risky token isn't one you're thinking of buying. It just turned up in your wallet. If you never asked for it and its metadata links to a site that asks you to connect and sign something to "claim" a reward, it's bait. The token account sitting in your wallet does nothing. The danger is the signature you'd give after clicking through to find out more. The safest thing to do with an unexpected token is to leave it alone.

Concentrated supply made to look organic. Picture a token with 1 billion tokens in circulation where the top five wallets, not counting pools, hold 70%. The chart can look completely ordinary, with real volume and hundreds of holders swapping small amounts, while a handful of wallets hold enough to crash the price whenever they sell. Sometimes that supply is spread across dozens of wallets that all trace back to one funder, so that no single whale shows up.

Bundled and sniped launches. This is a narrower form of the same problem, and you only see it by looking at individual wallets. A bundle is a group of top holders whose first buys were all paid for by the same outside wallet. Sniping is a group that all bought within the first five minutes of launch. Either way, a coordinated group took a large share of supply before anyone else had a fair chance to buy, and however many wallets it's spread across, it can sell as one.

Unlocked liquidity, the actual rug pull. Every pool has LP tokens that represent a claim on its liquidity, and whoever holds them can withdraw all of it in one transaction. If the LP tokens are burned or locked in an audited locker, that can't happen. If they sit in an ordinary wallet, the deployer can pull the liquidity whenever they like. The token still exists and still has a price chart, but there's nothing left in the pool behind it.

Serial deployers. Some deployer addresses, which you can trace through the update authority, have launched a string of earlier tokens that now have no liquidity at all. That's a routine: launch, drum up volume, let it die, launch the next one. One dead earlier token proves little. A deployer with ten tokens and nine of them abandoned is running a business, and you can check that before you buy token number eleven.

Pump and dump. A price down 70% or more in 24 hours, especially with a spike in volume, is almost never a healthy correction. It usually means insiders or bundled wallets selling into the demand that was created to attract buyers.

Urgency, fake audits and claims nobody can check. Most of the patterns above come wrapped in the same social layer: countdown timers ("presale ends in 10 minutes"), an "audited" badge with no report linked anywhere, a "doxxed team" that nobody can confirm. None of this proves a scam on its own, because plenty of honest launches use urgent language carelessly. Treat it as a reason to slow down and check the mechanics above.

How to check a token

In practice, checking a token before you buy comes down to a short list of questions you can repeat every time.

Start with the mint address. Use the address from the project's own site or docs, and not a name from a group chat or a ticker. A copycat can't fake the address, because a different address is a different token.

Mint and freeze authority. Any wallet or explorer shows these on the mint account. You want None. If either shows an address, ask about it directly, and don't assume it'll be revoked "soon".

Supply and decimals. Check that they match what's advertised. A token claiming a 1 billion cap should show a supply of 1 billion, and that number shouldn't be one a live mint authority can still change.

Metadata. Is there any, and is the update authority still live? Metadata without an update authority is locked. With a live one, it can be rewritten at any time, logo included.

Holder distribution. High concentration isn't damning on its own, because treasury wallets and pools are large holders too. Look at which addresses hold the big balances, and don't reduce it to a single scary percentage.

Liquidity. How much is in the pool, and who controls its LP tokens? If the LP tokens are locked or burned, nobody can pull the liquidity out from under holders. If they sit in an ordinary wallet, whoever holds that wallet's key can drain the pool at any moment, and the price collapses to near zero in the same transaction.

How these scams play out

These mechanisms rarely appear alone. A typical bad launch combines several of them, such as a live mint authority, a concentrated top 10 and thin liquidity in an unlocked wallet, and wraps them in urgency. You can't check the marketing, but you can check the mechanics, so the facts above tell you more than how confident the marketing sounds. Common Solana scam patterns covers the recurring structures in more depth.

A 60-second check

All together, this fits in the time it takes to read a few posts about a token before you decide whether to buy:

You don't need inside knowledge or a paid tool for any of them. You need to look at the mint account and not at the marketing around it.

A worked example

Say you're comparing two tokens that both look active on a chart. On Mint A, mint and freeze authority both read None, the top 10 non-pool wallets hold 18% of supply, and liquidity is deep and locked. On Mint B, the mint authority is a live address, the freeze authority is the same address, and the top 10 wallets hold 71%, most of it in one wallet that turns out to be the deployer's.

A price chart or a follower count wouldn't tell you these two apart. The mint account tells you straight away, which is why you check it before you buy and not after.

Tools that help

You can do every check above by hand, one field at a time, on Solana Explorer or Solscan. The raw account is always the final word, and it's worth learning to read it. How to read Solana Explorer shows how.

For a quicker pass, Token Inspector combines all of it into one score from 0 to 100. Every token starts at 100 and loses points for each finding. The weights depend on the risk. A key that can take your tokens costs far more than a signal that's merely linked to risk, so a live permanent delegate or a non-transferable mint caps the score outright, while a locked metadata field costs almost nothing. On top of the mint fields it looks at holders: which top holders bought within minutes of launch, which share a fee payer or funding wallet, and how much of the supply the deployer still holds. Account Inspector is the general version for reading any account, token or not, when you don't yet know what you're looking at.

A high score isn't a verdict. It can't read anyone's intentions, and it can't promise a team won't do something stupid tomorrow. It's one input, built from facts nobody can fake, and it's a good one to have before the others.

Common questions

Is a token with a live mint authority always a scam? No. Established projects, such as a stablecoin or a token used for staking rewards, often keep it on purpose and can explain why. The problem is a live authority alongside a claim of fixed supply, or one that's never mentioned at all.

Can I check these things without connecting my wallet? Yes. Every field in this guide (authorities, supply, metadata, holder distribution and liquidity) is public account data. Reading it never needs a signature, an approval or a wallet connection.

Do bundled or sniped wallets always mean a scam? Not always. A dozen bundled wallets holding 3% of supply is a common launch tactic, even on tokens that turn out fine. The same dozen wallets holding 30% and not selling is a different situation. What matters is how much of the supply the group controls.

If liquidity is locked, is the token safe? Locked liquidity rules out one thing: the deployer pulling the pool from under holders. It tells you nothing about mint authority, freeze authority, holder concentration, or whether the metadata can still be rewritten. It's one item on the list.

Does a revoked mint authority mean the token is safe? It closes one risk for good. It tells you nothing about freeze authority, holder concentration, liquidity, or whether the metadata is about to be changed to impersonate something else. Safety comes from all the checks together.

What's the fastest check if I only have ten seconds? Mint and freeze authority. Those two fields decide most directly whether your tokens can be diluted or locked without your consent, and any explorer shows them in two seconds.

Before you buy

Don't trust the ticker, the logo or even the project's website, because all three can be copied. The mint address and its authorities can't be. Reading them takes less time than most people spend picking a meme to reply to a launch announcement with, so do it every time.