Solana Token Safety Check: What to Look For

Solana tokens break most EVM checklists. There's no owner() to renounce, no tax coded into a custom contract, and every standard token runs on the same shared program. The risks live somewhere else: in the authorities stored on the token's mint account, and in the optional extensions a Token-2022 coin can switch on.

This guide covers only what is different on Solana. The general pre-buy checks are in how to check if a token is safe. For EVM chain specifics, see the BNB Chain honeypot check and the Robinhood Chain memecoin guide.

Why doesn't the EVM checklist work on Solana?

Because a Solana token isn't its own contract. A memecoin is a mint account owned by either the original SPL Token program or the newer Token-2022 program. The creator can't write a hidden blacklist or a custom sell rule into it. What they can do is keep certain authorities, or create the coin with extensions that change how transfers work.

So the questions shift from "what does this code do?" to "who holds which authority, and which extensions are on?" Both are public fields you can read on any explorer in under a minute.

Is the mint authority revoked?

It should be. The mint authority is the address allowed to create new tokens. If it's still set, whoever holds it can mint a billion more and sell them into the pool, and your share of the supply shrinks to almost nothing. On EVM this is the "mintable" flag. On Solana it's one field on the mint account.

Revoking sets the field to none, and that can't be undone. No one can turn it back on later. A token showing "Mint Authority: none" (or "disabled") on the explorer has a fixed supply.

Is the freeze authority revoked?

This is the Solana honeypot switch, so it matters most. The freeze authority can freeze any wallet's token account for that coin. A frozen account can't send its tokens, which means you can't sell. The dev doesn't need to hide anything in code: they freeze buyers, then sell their own bag into the liquidity you added.

A live freeze authority on a memecoin has almost no honest use. Stablecoins keep it for compliance, but a fresh meme coin has no reason to. Treat a live freeze authority as a fail, not a warning. The ownership side of this is covered in what renounced ownership means.

The tell people miss: coins from the big launchpads usually come with both authorities already revoked, so seeing them revoked is the normal baseline, not a green flag. It rules out two traps. It says nothing about the rest of this list.

Which token program does it use?

Check the token program on the explorer. If it's the original SPL Token program, there are no extensions and the authority checks above cover the contract side. If it's Token-2022 (also called Token Extensions), read the list of extensions the mint has enabled. That list is where the newer traps hide.

What Token-2022 extensions should worry you?

• Transfer fee. A cut is taken on every transfer, buys and sells alike, and the withheld amount can be collected by a separate withdraw authority. If the fee config authority is still set, the rate can be raised. A change only takes effect two epochs after it's set (an epoch is roughly two days), so you get some warning, but only if you're watching. Fee mechanics are in what is a sell tax.
• Permanent delegate. An address that can move or burn tokens from any holder's account, without your signature. On a memecoin, that means the dev can take your tokens back. This is the one to look for by name, because a revoked freeze authority doesn't protect you from it.
• Transfer hook. A separate program runs on every transfer and can make it fail. If that program is upgradeable, its behaviour can change after you buy, so a sell that works today can be blocked tomorrow.
• Non-transferable. The token can't be moved at all once it's in your wallet. It's meant for badges and credentials. On anything sold as a tradeable coin, it's a honeypot.
• Default account state: frozen. New token accounts start frozen and need the freeze authority to thaw them. Combined with a live freeze authority, the dev chooses who can trade.

A worked example: what would a clean-looking trap look like?

Take a hypothetical new coin. The explorer shows mint authority none, freeze authority none, and buys are going through. Most people stop here. Now open the extensions: it's a Token-2022 mint with a 1% transfer fee, a transfer hook pointing at an upgradeable program, and a permanent delegate set to a fresh wallet.

Every quick check passed, and the coin is still controlled. The delegate can pull tokens from your account, and the hook program can be upgraded to block transfers. Two fields you didn't read turned a "clean" coin into one you shouldn't touch. The fix is simple: on any Token-2022 coin, read every extension before you buy.

Is the liquidity safe on Solana?

Check where the coin trades first. Coins still on a launchpad bonding curve trade against the curve itself, so there's no LP for the dev to pull yet. The pool risk starts when the coin moves to a DEX pool. From there, check that the LP tokens were burned rather than held in a wallet that can redeem them, and don't assume a migration burned them without checking that specific pool. Concentrated-liquidity pools use position NFTs instead of LP tokens, so the burn check works differently there. The full lock-versus-burn breakdown is in liquidity locked vs burned.

Was the launch bundled?

Look at the first block of trading. On Solana, a creator can submit a bundle of transactions that land together, buying the first chunk of supply from many fresh wallets in the same block as the launch. The holder list then looks spread out when one person controls a large share. If many top holders bought in the launch block and were funded from the same wallet, count them as one holder. How to test wallets for this is in how to spot fake smart money.

What does MoonRadar check on Solana?

When MoonRadar reads a Solana token, it reports whether the mint authority and freeze authority are live or revoked, whether there's a Token-2022 transfer fee and its rate, whether a transfer hook is set, whether the token is non-transferable, and whether its metadata can still be edited. The read comes from a contract-security scan. If that scan doesn't answer, MoonRadar says "not checked" rather than showing a pass.

It doesn't currently flag a permanent delegate, so check that one on the explorer yourself, or use a deeper Solana report - MoonRadar vs RugCheck covers what each one reads. MoonRadar is non-custodial: you sign every trade in your own wallet. Passing these checks only means the coin isn't rigged at the contract level. Most Solana memecoins still go to zero. Popular EVM sell simulators such as Honeypot.is don't cover Solana at all - MoonRadar vs Honeypot.is compares the two chain by chain.