DEV Community

Owens Mark
Owens Mark

Posted on

How to Verify a Solana Token Before You Buy: A Practical Checklist

#solana #web3

Scam tokens on Solana are cheap to launch and easy to dress up. Here is a short checklist I run before trusting any token, using only read-only tools.

1. Verify the mint address, not the ticker

Tickers and names are not unique on Solana. Anyone can create a token called "USDC" or "BONK". The mint address is the only real identifier.

  • Copy the mint from an official source (project site, verified social, or a trusted aggregator listing).
  • Paste it into a block explorer (Solscan, Solana Explorer, SolanaFM) and confirm the address matches exactly.
  • Be careful of look-alike addresses that share the first and last few characters.

2. Check the authorities

On the mint account, look at:

  • Mint authority: if set, the owner can print unlimited supply. Ideally it is null (revoked).
  • Freeze authority: if set, the owner can freeze your token account. Ideally null too, unless it is a regulated asset.
  • Update authority (Metaplex metadata): can change name, image, and URI after the fact.

You can also check from the CLI:

spl-token display <MINT_ADDRESS> --url mainnet-beta
Enter fullscreen mode Exit fullscreen mode

Look for "Mint authority: (not set)" and "Freeze authority: (not set)".

3. Look at holder distribution

On the explorer's holders tab:

  • Does the top wallet (excluding the LP and known burn/program accounts) hold a large share?
  • Do many top wallets look funded from the same source at the same time? That suggests one entity splitting supply.
  • Very few holders and a big deployer balance is a red flag.

4. Inspect liquidity (LP)

  • Find the pool on Raydium, Orca, or Meteora via the explorer or a DEX aggregator.
  • Is the LP token burned or locked? If the deployer holds the LP tokens, they can remove liquidity (a rug pull).
  • Check pool depth: a tiny pool means any trade moves the price massively and exits are hard.
  • Check the pool age and trade history for wash-trading patterns.

5. Simulate before you sign

  • Read the transaction preview in your wallet. Unexpected token approvals, delegate changes, or "set authority" instructions are red flags.
  • Try a tiny test amount first.
  • Use a separate burner wallet with a small balance for anything unknown.

6. Never connect a wallet just to browse

Reading data does not need a wallet connection. Explorers, charts, and holder lists all work without one. Treat any site that demands a wallet connection before showing basic token info as suspicious. Phishing sites rely on a quick "connect and sign" click. Also:

  • Never share your seed phrase, ever.
  • Revoke old token delegations periodically.
  • Bookmark the sites you use instead of following links from DMs or replies.

Tools

Explorers and aggregators cover most of this. Some community-run tools, such as solspin.net, are also worth a look for Solana-related browsing, but always apply the checklist above independently and never rely on a single source.

TL;DR

Mint address over ticker, revoked authorities, sane holder spread, burned or locked LP, and no wallet connection just to look. This is not financial advice. Always do your own research.

Top comments (0)