Chapter 01

The architecture of a Solana SPL token mint

Creating and trading tokens on Solana operates through the SPL Token Program (or the newer Token Extensions program, commonly known as Token-2022). Unlike the Ethereum Virtual Machine where each token is an independent smart contract containing custom execution logic, Solana separates program logic from state. All standard tokens execute through the same shared system program: TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA.

A token exists on-chain as a Mint Account. This account stores the fundamental parameters of the token: total supply, decimal precision, the Mint Authority address, and the Freeze Authority address. User balances are stored in separate Associated Token Accounts (ATAs) owned by the user's wallet but governed by the Token Program. Because the execution code is standardized, verifying a Solana meme token does not require auditing bytecode; it requires verifying the cryptographic authorities configured in the Mint Account.

Chapter 02

Verifying mint authority: is the supply fixed?

The Mint Authority is the public key authorized to execute the MintTo instruction, creating brand new tokens out of thin air and expanding the circulating supply.

In a fair decentralized launch, the token creator must revoke this authority immediately after creating the initial supply. Revoking the authority involves setting the mint_authority field to null (represented on-chain as a None option). - If the mint authority is active and held by a private key or single-signature developer wallet, the creator can mint trillions of additional tokens at zero cost and dump them into decentralized exchange liquidity pools, wiping out other holders. - Verifying revocation requires inspecting the raw account JSON via an RPC node (getAccountInfo) or through a trusted Solana block explorer, confirming that mintAuthority is null.

Chapter 03

The freeze authority: can wallets be blacklisted?

The Freeze Authority is the public key empowered to execute the FreezeAccount and ThawAccount instructions on any Associated Token Account holding that mint.

If a token creator retains the freeze authority: 1. They can freeze the token account of any individual buyer, liquidity pool, or automated market maker. 2. A frozen account cannot transfer, sell, or bridge its tokens, while the creator retains the ability to trade freely. 3. This is the primary mechanism behind Solana honeypot tokens: users can buy the asset, but their token accounts are instantly frozen, preventing any selling.

A meme token cannot be considered safe unless the freeze_authority is explicitly revoked (null). Never trade a token that retains an active freeze authority unless it is an institutional asset whose compliance policies explicitly disclose blacklisting capabilities.

Chapter 04

Token-2022 extensions: new capabilities and hidden risks

The introduction of the Token Extensions (Token-2022) program (TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb) expanded Solana tokens with modular on-chain features. While designed for institutional compliance and complex DeFi applications, bad actors increasingly use extensions to embed predatory mechanics in meme tokens:

  • Transfer Fee Extension: Allows an authority to deduct a percentage fee on every transfer, routing proceeds to a creator fee wallet. While visible, developers can configure fees as high as 100%.
  • Permanent Delegate Extension: Grants a designated wallet unlimited authority to transfer or burn tokens from any holder's account without the holder's signature. If a meme coin contains a permanent delegate, the creator can confiscate user balances at will.
  • Transfer Hook Extension: Executes custom smart contract logic on every transfer. An attacker can write a transfer hook that reverts transactions whenever a non-whitelisted wallet attempts to sell.
  • Default Account State Extension: Can be configured so that any new ATA created for the token is initialized in a frozen state by default.

When inspecting a token, check whether it is deployed under the classic SPL Token program or Token-2022. If Token-2022 is used, inspect the extension array thoroughly before connecting a wallet.

Chapter 05

Verification workflow before trading any Solana token

Before interacting with a newly discovered Solana token:

1. Confirm the token mint address matches official project announcements. 2. Inspect the mint account data: verify that mintAuthority is strictly null. 3. Verify that freezeAuthority is strictly null. 4. If the token uses Token-2022, verify there is no Permanent Delegate or predatory Transfer Hook attached. 5. Check metadata immutability: confirm the Metaplex metadata account has isMutable: false to prevent the creator from altering token graphics or names post-launch.

Cross-reference these checks with our meme-coin research checklist and our launchpad safety guide to protect capital from algorithmic traps.

Chapter 06

Solana SPL token program architecture and authority accounts

Tokens deployed on the Solana blockchain adhere to the SPL (Solana Program Library) Token Standard, executing via the standardized Token Program or Token-2022 Program. In the Solana account model, a token is represented by a central Mint Account that stores fundamental cryptographic parameters.

Key commands for inspecting an SPL Mint Account: - "solana account <mint_address>" to view raw binary account data and ownership. - "spl-token display <mint_address>" to inspect human-readable token parameters.

The output of the SPL token display command reveals critical security attributes: - Mint Authority: The public key authorized to execute the "MintTo" instruction, generating newly minted tokens and diluting existing circulating supply. - Freeze Authority: The public key authorized to execute the "FreezeAccount" instruction, permanently locking user token accounts and preventing transfers or sales. - Supply and Decimals: The current aggregate supply and numerical decimal precision (typically 6 or 9 decimals).

To prove that a token's supply cannot be arbitrarily inflated, the creator must permanently revoke the mint authority by assigning it to a null address: spl-token authorize <mint_address> mint --disable spl-token authorize <mint_address> freeze --disable

If the mint authority displays "None", the supply is mathematically fixed. If an active base58 public key remains listed as the mint authority, the key holder retains the capability to print trillions of new tokens and crash the market liquidity pool.

Chapter 07

Metadata manipulation and mutable metadata update risk

Beyond token program authorities, meme coins utilize the Metaplex Token Metadata program to attach external branding information (name, ticker symbol, logo image URL, and description) to the on-chain mint address. A significant and frequently overlooked vulnerability is the "is_mutable" metadata attribute.

If "isMutable" is set to "true", the metadata update authority retains the cryptographic power to modify the metadata pointer at any time. Malicious creators frequently launch tokens with professional branding, wait for community buying to build liquidity, and subsequently update the metadata to point to a different token image or deceptive scam URLs. Legitimate projects lock metadata permanently by executing Metaplex's "UpdateMetadataAccountV2" instruction with "is_mutable: false". Verifying both authority revocations and metadata immutability is an essential prerequisite before interacting with newly launched Solana tokens.