Wallet & security
Check a Solana token for rug pull risks before you buy
Paste a mint address or a Solscan, pump.fun, Dexscreener or Birdeye link and get a pass, warn or fail verdict for every on-chain risk factor, read live from mainnet with no wallet connected.
How it works
- 1
Paste the mint or a token link
Enter the token's mint address, or paste a Solscan, Birdeye, pump.fun or Dexscreener URL and the checker extracts the mint for you. Dexscreener pair links are resolved to the traded token through their public API.
- 2
Read the checklist
Each check shows Pass, Warn, Fail or Info with a one-line summary. Open any row for the full explanation, the address that holds the relevant authority, and a link to the tool an issuer would use to fix it.
- 3
Inspect the holders
The report lists the largest holders with pool vaults and burn addresses detected and pre-excluded. Untick or tick rows to see how concentration changes; for small tokens every holder is scanned, for large ones the top 20 accounts.
- 4
Share the report
The mint is written into the page URL, so the Share button copies a link that reopens the same live report. Nothing is stored on a server; the data is re-read from the chain each time.
What does a Solana rug check actually look at?
A Solana token is defined by its mint account, an 82-byte record (larger for Token-2022) owned by one of two programs: the original SPL Token program or Token-2022. The mint stores the supply, the decimals and two optional keys, the mint authority and the freeze authority. Everything a scanner can prove about a token's safety comes from that account, the Metaplex metadata account derived from it, the mint's own extension data, and the token accounts that hold the supply.
This checker reads all of those directly through the RPC. It does not rely on a third-party score, which is why it is a useful alternative to RugCheck and the security tabs on DEX screeners when you want to see the raw facts. Every item comes with the exact address involved and a plain explanation of what the holder of that key can do.
Mint authority and freeze authority: the two classic rug levers
An active mint authority means someone can call MintTo and create more tokens at will, then sell them into the liquidity pool. For a stablecoin or a liquid-staking token that is the intended design, and the checker marks recognised issuers such as USDC, USDT, PYUSD or JitoSOL as Info rather than Fail. For a memecoin there is no legitimate reason to keep it, so it fails.
An active freeze authority can freeze any token account for that mint. A frozen account cannot send, sell or burn. This is how honeypot tokens work: buyers can enter, but their accounts are frozen before they can exit. The checker marks it as a warning because some launches keep it briefly, but you should treat it as a hard stop unless the key belongs to a known team multisig. Both authorities are revoked with a single SetAuthority instruction and the change is permanent; the Revoke Mint Authority and Revoke Freeze Authority tools do exactly that.
Token-2022 extensions that scanners miss
Token-2022 mints can carry extensions that change what a transfer means. A transfer fee withholds a percentage of every transfer, including sells; the checker shows the basis points, the per-transfer cap and whether the fee authority can still raise the rate, which can legally go to 100 percent. A permanent delegate gives one address the right to move or burn tokens from any wallet without a signature and cannot be removed, so it always fails. A transfer hook routes every transfer through a custom program that can reject it under any rule.
Default account state set to Frozen means every new holder starts frozen and must be thawed by the issuer. Non-transferable tokens cannot be sold at all. The pausable extension lets one key halt all transfers. Confidential transfers and interest-bearing configuration are informational: the first hides balances from the holder scan, the second inflates the displayed balance without minting anything. The report decodes each extension present using the same TLV parser the token program uses.
Why there is no single safety score
Scanners that print a number out of 100 have to decide how a 3 percent transfer fee compares to a mutable logo, and that weighting is arbitrary. A token can score 90 and still have a permanent delegate, or score 40 because of cosmetic warnings while being perfectly fine. Worse, a single score is easy to game: revoke two authorities, burn the LP, and the number looks clean even if ten wallets funded from the same source hold 60 percent of supply.
Instead this report counts fails and warnings and tells you what each one means, so you decide what matters for your trade. A stablecoin will always show active authorities. A fresh pump.fun token will always be young with a concentrated bonding-curve vault. Neither fact is a verdict by itself. What you are looking for is the combination of a lever that lets someone take your money and no good reason for that lever to exist.
What this checker cannot tell you
On-chain configuration says nothing about intent. A token with every authority revoked, immutable metadata and burned liquidity can still collapse because the team sells its allocation, because insiders bought the first blocks through bundled wallets, or because the project was never real. Holder concentration helps, but wallets are cheap: 30 addresses holding 2 percent each can be one person.
The report lists the pool vaults it finds among the top holders, but it does not verify whether the LP tokens for those pools were burned or locked. That requires inspecting the LP mint of each pool, which is covered in the Burned vs Locked guide and can be done for your own token with the Burn LP Tokens page. Treat this page as the first ten minutes of research, not the last.
Questions & answers
How do I check if a Solana token is safe before buying?
Paste the mint into the checker above. Look first at the Fail items: an active mint authority, an active freeze authority on an unknown token, a permanent delegate or a default-frozen account state are each enough to walk away. Then read the warnings, look at the top holders with pool vaults excluded, and confirm the token has a pool with burned or locked liquidity using the LP guide. If the token is hours old, wait.
Is this a RugCheck alternative and how is it different?
It covers the same core checks, mint and freeze authority, metadata mutability, top holders and Token-2022 extensions, but reads everything live from the RPC in your browser rather than from a cached index, decodes every extension on the mint with the token program's own layouts, and refuses to print a single numeric score. It also accepts pump.fun, Solscan, Birdeye and Dexscreener links directly. It does not track insider wallets or bundle detection.
What does mint authority enabled mean on a Solana token?
The mint account still holds an address that is allowed to create new tokens. Whoever controls it can mint any amount and sell into the pool, diluting holders instantly. It is expected for stablecoins and staking tokens whose supply must track deposits, and the checker labels known issuers accordingly. For anything else it is the most common rug pull mechanism and fails the check. Revoking it is permanent and takes one transaction.
Why does a pump.fun token show its largest holder as a program vault?
Tokens launched on pump.fun sit on a bonding curve until they graduate. The curve is a program-derived account owned by the pump.fun program that holds the unsold supply and receives SOL from buyers. The checker recognises that the owner is program-owned rather than a wallet, labels it as the pump.fun bonding curve vault and excludes it from the concentration check by default. The same applies to Raydium, Orca, Meteora and PumpSwap pool vaults after graduation.
Does the rug check verify that liquidity is burned or locked?
No. It detects pool vaults among the top holders and links them, which tells you a pool exists and how much of the supply sits in it. Whether the pool's LP tokens were burned, locked or are still in the deployer's wallet is a separate check on the pool's LP mint, explained in the Burned vs Locked guide. Claiming to verify it from the token mint alone would be misleading, so the report says exactly what it did and did not check.
Can I check a Token-2022 token with a transfer fee?
Yes. The checker detects the Token-2022 program, decodes the transfer fee extension and shows the current basis points, the maximum fee per transfer and whether the fee authority is still set. Fees above 5 percent fail the check; any fee, or a fee that can still be raised, is a warning. It also reports permanent delegates, transfer hooks, default-frozen state, pausable configuration, confidential transfers and interest-bearing settings on the same mint.
Is the rug check safe to use and does it need my wallet?
It is read-only. No wallet connection is requested, no transaction is built and nothing is signed. The only data that leaves your browser is the mint address, sent to the RPC node and, when the metadata points there, to an IPFS gateway to load the token image. The report is generated in your browser and not stored anywhere; the shareable link simply contains the mint address.
How much does the Solana rug check cost?
Nothing. The checker is free without limits and has no premium tier. SOLTidy charges fees only on tools that send transactions on your behalf, such as revoking an authority, which costs 0.02 SOL. Checking a token, whether it is USDC or a token that launched five minutes ago, will always be free.
Is this tool free?
The Solana rug check is completely free and read-only: it needs no wallet connection, sends no transaction and charges no fee, only the RPC reads that build the report.
Guides that go deeper
Built and maintained by Jacob, a Solana trader who uses these tools daily. Content reviewed . Every transaction is built in your browser and signed in your own wallet — see the terms for fees.