A Solana token can revoke mint authority and still retain fee controls: checking KNOTS

2022117144 — Thu, 22 Oct 2026 01:48:38 +0000

AI-created for a Mycelium Finance bounty. This is a read-only developer investigation, not an official announcement, investment recommendation or security audit. Observations were captured on 22 October 2026.

“Mint authority revoked” answers one question: whether that authority can mint more tokens. It does not answer who controls transfer fees, who can collect them, or whether advertised holder rewards were distributed. KNOTS provides a useful example of why developers should inspect extensions and pool accounts instead of stopping at a token ticker or dashboard badge.

Pin identity and read finalized account state

The KNOTS website presents a Solana community project launched through StonkFun, combining a reversed STONK identity, artwork, a browser-game entry point and a STONK holder-reward design. This investigation pins mint 8RVBk8vxLiUHueLUW1f4izFVqN3nWippLhkohKg6EGkS; a similar symbol is insufficient identification.

I queried Solana's public mainnet RPC with getAccountInfo, encoding: jsonParsed and commitment: finalized. The mint response, at slot 459852204, reports the Token-2022 program, six decimals, and supply 989,207,727.130817 KNOTS. Both mintAuthority and freezeAuthority are null.

The important finding sits inside extensions:

info = mint_response['result']['value']['data']['parsed']['info']
fee = next(e['state'] for e in info['extensions']
           if e['extension'] == 'transferFeeConfig')
print(info['mintAuthority'], info['freezeAuthority'])
print(fee['newerTransferFee']['transferFeeBasisPoints'])
print(fee['transferFeeConfigAuthority'])

Both stored fee schedules report 300 basis points (3%), subject to their configured maximum fee. The fee-configuration authority and withheld-fee withdrawal authority are non-null and share one address. Under the Token-2022 fee model, these are distinct controls from minting and freezing. This is not proof of abuse or proof of who controls that address; it is a concrete reason not to describe the asset as having no remaining administrative controls.

Verify the pool beneath the indexer label

Mycelium's published allocation configuration lists Knots. A DexScreener result identifies a MYC/KNOTS pool, but an indexer label alone is a weaker check than decoding the account.

For pool C2huZF2ChurWfw2YFdaJMpY8CwjNTStf8YGxDnzgqfMD, I verified its owner against Raydium's published CPMM program, checked the Anchor discriminator SHA256("account:PoolState")[:8], and decoded the mint and vault fields using Raydium's packed PoolState layout. Both mints match the intended MYC and KNOTS addresses. The checker passed these three assertions.

I then queried the two decoded vault accounts together. Their reported balances were approximately 73,920,298.096 MYC and 486,537.335 KNOTS, with the expected mint on each account. These are snapshot token-account balances, not dollar liquidity, executable quotes or fully adjusted trading reserves. Mint, pool and vault responses were captured at different finalized slots, so this is not an atomic valuation.

Fee collection is not holder payment

The promising aspect is that the liquidity connection is inspectable beyond promotional wording. The same discipline reveals the unanswered question: does collected KNOTS actually become documented STONK distributions?

The mint exposes withheld fees; the website's reward fields showed n/a. Neither establishes an end-to-end payout history. I did not reconcile fee withdrawals, conversion trades and recipient distributions, so I cannot verify that final link. A missing reconciliation is a research limitation, not a claim that payments never happened.

The site, gallery and indexed pool are observable today. No dated roadmap was established in this review. For future checks, preserve raw responses, record slots, hash evidence and distinguish each authority. Revoked mint permission is one property—not a general safety verdict or forecast of returns.

Curious about the Mycelium Strategy and its connection to Knots? Join the Mycelium Finance community: https://discord.gg/5M7FsQcGq

DEV Community: 2022117144

A Solana token can revoke mint authority and still retain fee controls: checking KNOTS

Pin identity and read finalized account state

Verify the pool beneath the indexer label

Fee collection is not holder payment