In January 2025, a token called “WIFDER” launched on Solana through pump.fun — a platform that lets anyone create a token for less than $1. Within six hours it reached a $2.3 million market cap, fueled by a wave of X posts, a Telegram group with 4,000 members, and a chart that looked like it was going parabolic. The token had a verified SPL token mint, a Raydium liquidity pool, and a DexScreener page with thousands of holders. What buyers did not check was the mint authority. The token’s creator retained full minting rights — meaning they could print unlimited new tokens at any time. When the price peaked, the creator minted 50 billion additional tokens and dumped them into the Raydium pool, draining every dollar of liquidity before anyone could react. The entire process, from mint to drain, took under four seconds — one Solana slot.
This is not an Ethereum problem or a Base problem. It is a Solana problem, and Solana has unique characteristics that make these scams both more frequent and structurally different from EVM chain scams. If you apply Ethereum-based verification logic to Solana tokens, you will miss the most critical risk factors.
Solana processed over $300 billion in decentralized exchange volume in Q1 2025 — more than Ethereum and Base combined. That liquidity, combined with sub-cent transaction fees and a culture that treats memecoins as legitimate investment vehicles, has created the most active scam ecosystem in crypto. This guide covers the specific risks of buying tokens on Solana, the tools that actually work on this chain, and the exact verification steps you should run before connecting your wallet to any Solana token.
BLUF: Solana is not an EVM chain — the same contract verification steps you use on Ethereum do not apply. Before buying any Solana token, check five things: (1) Is the mint authority revoked? — if not, the creator can print unlimited tokens; (2) Is the freeze authority revoked? — if not, they can lock your wallet from selling; (3) Has the liquidity pool authority been burned? — if not, the team can drain the pool; (4) What is the holder distribution? — a few wallets holding the majority of supply is a dump waiting to happen; (5) Does RugCheck flag it as high-risk? — use RugCheck, not Etherscan or Token Sniffer, which do not support Solana. Solana scams execute in under a second — do your research before buying, not after.
Why Solana Has Unique Risk Characteristics
Solana is a high-performance Layer 1 blockchain that processes over 2,000 transactions per second with sub-cent fees and 400-millisecond finality. These properties make it ideal for real-world applications — payments, decentralized exchanges, NFT marketplaces. They also make it the perfect environment for scams.
Ultra-low fees. Creating a token on pump.fun costs approximately $0.02 in network fees. On Ethereum, deploying an ERC-20 contract costs $50–500. This 2,500x cost difference means a single scammer can launch hundreds of tokens per day, test which ones gain traction, and abandon the rest. pump.fun alone has been used to create over 5 million tokens since its launch — the vast majority are abandoned within 24 hours.
Instant finality. Solana confirms transactions in approximately 400 milliseconds (one slot). On Ethereum, a transaction is not truly final for several minutes (12+ block confirmations). This means a rug pull on Solana is not just fast — it is instantaneous. By the time you see the draining transaction on Solscan, it is already final. There is no mempool to front-run, no pending transaction to cancel. The money is gone before your screen refreshes.
Non-EVM architecture. Solana does not use the Ethereum Virtual Machine. It uses its own runtime (Sealevel) and its own token standard (SPL, or Solana Program Library). Smart contracts are called “programs” and are written in Rust, not Solidity. This means EVM tools like Etherscan, Token Sniffer, and GoPlus Security do not work on Solana. You cannot verify a Solana token the same way you verify an Ethereum token — the data structures, risk factors, and verification tools are entirely different.
Memecoin culture. Solana has become the epicenter of memecoin trading. Platforms like pump.fun, Raydium, and Jupiter have made it trivially easy to create, list, and trade tokens with zero utility beyond speculation. This culture normalizes buying unverified tokens from anonymous creators — which is exactly the behavior scammers exploit. Many Solana users have been conditioned to accept risks that would be immediate red flags on any other chain.
Phantom wallet ecosystem. Phantom is the dominant wallet on Solana, and its user experience is optimized for speed. Connecting to a dApp requires a single click. Signing a transaction requires a single tap. This frictionless design is great for legitimate use — but it is equally great for phishing attacks, where a malicious site tricks you into signing a transaction that drains your wallet before you have time to read what you approved.
Solana vs. EVM: Why Different Verification Is Needed
| Risk Factor | EVM Chains (Ethereum, Base, BNB) | Solana |
|---|---|---|
| Token standard | ERC-20 (smart contract) | SPL Token (program account) |
| Code verification | Check source code on Etherscan | Not applicable — tokens are program instances, not custom contracts |
| Unlimited supply risk | Hidden mint() function in contract | Mint authority — does the creator still hold it? |
| Wallet freeze risk | Rare (requires custom transfer hook) | Freeze authority — built into SPL standard |
| Liquidity drain risk | LP tokens in developer wallet | LP pool authority not burned |
| Explorer | Etherscan / Basescan / BscScan | Solscan / Solana Explorer |
| Token scanner | Token Sniffer / GoPlus | RugCheck / DexScreener |
| Rug pull speed | 2–12 seconds | <1 second |
| Deployment cost for scammers | $0.50–500 | <$0.02 |
The fundamental difference: on EVM chains, you audit the contract code for hidden functions. On Solana, the SPL token program code is always the same — the risk is not in the code but in the authorities attached to each token mint. You are not looking for hidden functions. You are looking for who retains control.
Step-by-Step: How to Verify a Solana Token
Step 1: Get the Token Mint Address
Every Solana token is identified by a mint address — a base58 string that looks like So11111111111111111111111111111111111111112 (that is Wrapped SOL). You need this address to run any verification.
Find it from:
- DexScreener (dexscreener.com) — search by token name or ticker
- Solscan (solscan.io) — search by name
- The DEX where you found the token (Raydium, Jupiter, Orca)
Copy the mint address exactly. Solana addresses are case-sensitive and one wrong character sends you to a completely different token — or to nothing at all.
Step 2: Check the Mint Authority
This is the single most important check on Solana, and it has no direct equivalent on EVM chains.
The mint authority is an address that has the power to create new units of the token. If the mint authority is still active (not burned), the token creator can print unlimited new tokens at any time, diluting the supply to zero.
To check on Solscan:
- Search for the token mint address
- Go to the token’s main page
- Look for “Mint Authority” in the token overview
- Check whether it shows an address or shows “Disabled” / “Burned”
| Mint Authority Status | Risk Level | What It Means |
|---|---|---|
| Burned / Disabled | Low | No one can create new tokens — supply is fixed |
| Active, held by deployer | Critical | Creator can print unlimited tokens and dump them |
| Active, held by multisig | Moderate | Multiple signatures required, but supply is still mutable |
| Active, held by vesting contract | Moderate | Programmatic minting — review the vesting schedule |
A token with an active mint authority is not automatically a scam — legitimate projects use mint authority for vesting schedules, staking rewards, or governance-controlled inflation. But for memecoins and community tokens, an active mint authority is the number one rug pull vector on Solana. If the creator can mint, they will eventually dump.
How to verify mint authority is burned: On Solscan, the mint authority field should show “None” or a burn address. You can also use the Solana CLI or a tool like RugCheck, which checks this automatically.
Step 3: Check the Freeze Authority
The freeze authority is unique to Solana’s SPL token standard. It allows a designated address to freeze individual token accounts — meaning the holder cannot send, sell, or transfer their tokens. The tokens are still in the wallet, but they are locked.
This is not a theoretical risk. In 2024, multiple Solana tokens used freeze authority to trap buyers: the token pumped, new buyers rushed in, and then the creator froze every wallet except their own. Buyers watched their tokens become untradeable while the creator sold from exempt wallets.
To check on Solscan:
- Look for “Freeze Authority” in the token overview
- It should show “Disabled” or “None”
| Freeze Authority Status | Risk Level | What It Means |
|---|---|---|
| Burned / Disabled | Low | No one can freeze your token account |
| Active, held by deployer | Critical | Creator can prevent you from selling |
| Active, held by multisig | Moderate | Multiple signatures required, but still a risk |
Legitimate stablecoins (USDC, USDT) retain freeze authority for regulatory compliance — they can freeze addresses associated with sanctioned entities or court orders. For any other token type, an active freeze authority is a red flag. If a memecoin can freeze your wallet, it is not a memecoin — it is a trap.
Step 4: Verify the Liquidity Pool Authority
On Solana, liquidity pools work differently from EVM chains. On Raydium or Orca, liquidity is provided to an Automated Market Maker (AMM) pool controlled by a pool authority. If the pool authority is not burned or removed, the creator can withdraw all liquidity from the pool at any time.
This is the Solana equivalent of an unlocked liquidity provider token on Ethereum. The mechanics are different but the outcome is the same: the team drains the pool and the token becomes untradeable.
To check:
- Find the token’s primary liquidity pool on DexScreener or Raydium
- Copy the pool address
- Check on Solscan whether the pool authority has been burned
- Look for an “Authority Burned” indicator
Alternatively, use RugCheck — it automatically checks LP burn status for the token’s primary pools.
LP lock on Solana: Unlike EVM chains where LP tokens can be locked in timelock contracts, Solana’s standard practice is to burn the pool authority entirely. There is no widely used timelock mechanism for Solana LP tokens. If the authority is not burned, the pool is effectively unlocked. There is no partial protection — it is either burned or it is not.
Step 5: Analyze Token Holder Distribution
Go to the token’s “Holders” tab on Solscan. The same distribution analysis that applies to EVM chains applies here, but Solana’s low transaction costs make concentration patterns even more dangerous — a whale can dump in a single transaction that costs $0.001.
| Distribution Pattern | Risk | Why |
|---|---|---|
| Top 10 holders < 15% | Low | Broad distribution |
| Top 10 holders 15–30% | Moderate | Some concentration |
| Top 10 holders > 40% | High | Few wallets control the majority |
| One wallet > 15% | Critical | Single holder can crash the price |
| Deployer holds > 10% | Critical | Creator can dump their allocation |
Also check for clustered wallets — multiple addresses that received tokens from the same source at the same time. These are often the creator’s wallets disguised as separate holders. On Solscan, click through to individual holder addresses and check their transaction history. If 10 wallets all received tokens from the same funding source and have similar balances, they are likely controlled by the same person.
Step 6: Run a RugCheck Scan
RugCheck is the definitive Solana token risk scanner — the equivalent of Token Sniffer and GoPlus combined, but built specifically for Solana.
Enter the token mint address and RugCheck provides:
- Mint authority status (active or burned)
- Freeze authority status (active or burned)
- Liquidity pool top holders and LP burn status
- Token supply distribution
- Market cap vs. fully diluted valuation
- Whether the token is flagged by community sources
- Social links verification
- Historical mint events (has the supply been inflated?)
A RugCheck score is displayed as a risk rating from “Low Risk” to “High Risk.” Treat any token rated “High Risk” or “Very High Risk” as uninvestable unless you have a specific, informed reason to believe otherwise. Even “Medium Risk” tokens warrant careful review of the specific risk factors flagged.
RugCheck also shows whether the token has been featured on known scam token lists and whether the social media links are verified. A token claiming to be from a known project (Jupiter, Pyth, Jito) should have verified social links — if they are missing or point to newly created accounts, the token is likely an impersonation.
Common Solana-Specific Scams
pump.fun Rug Pulls
pump.fun is a Solana platform that allows anyone to create a token with a bonding curve for less than $0.02. When the token’s market cap reaches a threshold (currently ~$69,000), liquidity is automatically deposited into Raydium. The problem: the creator retains mint authority and LP authority until they manually burn them. Most never do.
The typical pattern: a token launches on pump.fun, gains traction through social media, crosses the bonding curve threshold, gets listed on Raydium, and then the creator mints additional tokens or drains the pool. Because the entire lifecycle happens in hours (sometimes minutes), buyers who act on FOMO have no time to verify anything.
How to protect yourself: Before buying any pump.fun token that has graduated to Raydium, check the mint authority and LP authority on RugCheck. If either is not burned, the token is one click away from being worthless.
Fake SPL Token Impersonation
Solana’s SPL standard makes it trivial to create a token with any name and ticker. A scammer creates a token named “JUP” (impersonating Jupiter’s governance token) or “BONK” (impersonating the popular memecoin) and lists it on a DEX. The fake token has a different mint address, but the name and ticker are identical.
Users who search by name instead of verifying the mint address end up buying the fake. This is especially dangerous on Solana because transaction fees are so low that scammers can create thousands of fake tokens for a few dollars.
How to protect yourself: Always verify the mint address against the project’s official website or a trusted source. Never buy a token by searching for its name on a DEX — always use the exact mint address.
Drain-Through-Metadata Attacks
Some Solana tokens include malicious metadata in their token accounts. When a wallet like Phantom renders the token in your wallet interface, it fetches this metadata — which can include a phishing URL disguised as the project’s website. Clicking the link takes you to a fake dApp that prompts you to sign a transaction draining your wallet.
This is uniquely dangerous on Solana because token metadata is automatically fetched by wallets. You do not need to interact with the token — simply receiving it as an unsolicited airdrop is enough for the metadata to appear in your wallet interface.
How to protect yourself: Never click links from tokens that appear in your wallet unsolicited. Use Phantom’s “hide” feature to remove spam tokens. Do not interact with any token you did not explicitly purchase or claim from a verified source. For more on wallet-draining attacks, see our guide on how to spot wallet drainers.
Jupiter DEX Aggregator Spoofing
Jupiter is the most popular DEX aggregator on Solana. Scammers create fake Jupiter frontends (jupiterswap.io, jupiter-trade.pro, etc.) that look identical to the real jup.ag but route transactions to malicious programs. When users swap tokens through these fake sites, the transaction grants token approvals or transfers funds to the scammer.
How to protect yourself: Only use the verified Jupiter URL (jup.ag) and bookmark it. Check the URL before every transaction. For more on signature-based phishing attacks, see our guide on how to prevent wallet drainers.
Tools for Solana Token Verification
| Tool | What It Checks | Cost | Solana Support |
|---|---|---|---|
| RugCheck | Mint/freeze authority, LP burn, holders, supply history | Free | Native (Solana-only) |
| Solscan | Token holders, transactions, metadata, mint info | Free / Pro | Native |
| DexScreener | Real-time DEX data, liquidity, volume, price charts | Free | Full |
| Birdeye | Token analytics, holder analysis, social signals | Free / Pro | Full |
| Phantom Wallet | Built-in transaction preview, spam token detection | Free | Native |
| Solana Explorer | On-chain data, token accounts, authorities | Free | Native |
Recommended workflow: Start with DexScreener to find the token and get basic market data. Then run RugCheck for the comprehensive risk assessment. Cross-reference holder distribution on Solscan. Finally, verify the mint address against the project’s official channels. If RugCheck shows low risk and the mint/freeze authorities are burned, your risk is substantially reduced — though, as always, never zero.
Solana vs. Base vs. Ethereum: Risk Comparison
| Risk Factor | Ethereum | Base L2 | Solana |
|---|---|---|---|
| Architecture | EVM | EVM | Non-EVM (Sealevel) |
| Token standard | ERC-20 | ERC-20 | SPL Token |
| Deployment cost for scammers | $50–500 | <$1 | <$0.02 |
| Finality time | ~6 min (safe) | ~4 min (safe) | ~0.4s (instant) |
| Primary rug vector | Hidden contract functions | Hidden contract functions | Unburned mint/freeze authority |
| Primary verification tool | Etherscan + Token Sniffer | Basescan + GoPlus | RugCheck + Solscan |
| Wallet freeze risk | Very low | Very low | Built into SPL standard |
| Memecoin scam volume | Moderate | Growing | Highest in crypto |
| Recovery of stolen funds | Difficult | Very difficult | Extremely difficult (instant finality) |
The key insight: Solana’s instant finality means once a scam executes, the transaction cannot be reversed, front-run, or cancelled. On EVM chains, you might have seconds or minutes to react. On Solana, the window is zero. Prevention is the only defense.
Limitations: What Verification Cannot Catch
Even after running all five checks, some risks remain:
Social engineering. A token with burned mint authority, burned freeze authority, and burned LP can still be a pump-and-dump scheme where the team holds a large supply and coordinates selling into buying pressure. On-chain verification cannot detect whether a community is organic or manufactured.
Novel program exploits. Solana’s program model is still evolving. Token-2022, the next-generation SPL standard, introduces transfer fees, non-transferable tokens, and confidential transfers — each creating new attack surfaces that current tools may not fully evaluate.
DeFi composability risk. A clean token can become dangerous when paired with a malicious lending protocol, staking program, or yield farm. The token itself is safe, but the smart contract you interact with to earn yield on it may not be. Always audit the program you are depositing into, not just the token.
Cross-chain bridging. If you bridge assets between Solana and other chains, the bridge itself is an attack surface. Cross-chain bridges have been exploited for some of the largest losses in crypto history. Always use established bridges (Wormhole, deBridge) and verify bridge contract addresses independently.
For a broader understanding of on-chain risk methodology that applies across all chains, see our guide on the on-chain analysis workflow.
Frequently Asked Questions
Q: Is Solana more dangerous than Ethereum for buying tokens?
A: Solana is not inherently more dangerous, but its risks are different. Ethereum scams hide in smart contract code; Solana scams hide in token authorities (mint, freeze, LP). Solana’s ultra-low fees and instant finality make scams cheaper to execute and impossible to reverse once they happen. The verification process is different but equally thorough if you use the right tools (RugCheck, Solscan).
Q: Can I use Etherscan or Token Sniffer for Solana tokens?
A: No. Etherscan only covers EVM chains. Token Sniffer supports Ethereum and Base. For Solana, use RugCheck (rugcheck.xyz) and Solscan (solscan.io). Applying EVM verification logic to Solana tokens will miss the most critical risk factors — mint authority, freeze authority, and LP burn status.
Q: What is the safest way to buy tokens on Solana?
A: Only buy tokens where the mint authority is burned, the freeze authority is burned, and the LP pool authority is burned. Verify all three on RugCheck before purchasing. Use a hardware wallet (Ledger) connected to Phantom for large transactions. Never buy tokens directly from social media links — always verify the mint address on DexScreener or Solscan first.
Q: Are pump.fun tokens ever safe to buy?
A: Some pump.fun tokens that graduate to Raydium and have their authorities burned can be legitimate community tokens. However, the vast majority are speculative plays that go to zero. If you choose to buy pump.fun tokens, treat them as high-risk speculation, never invest more than you can afford to lose, and always verify that mint and LP authorities are burned after graduation.
Q: What should I do if I bought a scam token on Solana?
A: If you can still sell, sell immediately. If the token has freeze authority active and your account gets frozen, your tokens are locked permanently — there is no recovery mechanism. Do not interact further with the token contract. If your wallet was drained through a malicious approval, revoke the approval immediately in Phantom Settings > Connected Apps, and move remaining assets to a new wallet. For tracking stolen funds, see our guide on how to track stolen crypto.
Q: What is Token-2022 and does it change the risks?
A: Token-2022 is Solana’s next-generation token standard that adds features like transfer fees, permanent delegates, and confidential transfers. These features introduce new risk vectors — for example, a permanent delegate can transfer tokens out of any account at any time. RugCheck is being updated to handle Token-2022, but always check whether a token uses the new standard and review what extensions are enabled.
Key Takeaways
- Solana is not an EVM chain — the verification process is fundamentally different. You check token authorities, not contract source code.
- Mint authority is the #1 risk — if it is not burned, the creator can print unlimited tokens and dump them. Always verify it is revoked.
- Freeze authority is unique to Solana — it lets the creator lock your wallet from selling. Legitimate stablecoins need it; no other token should have it.
- LP authority must be burned — unlike EVM chains where LP tokens are locked in timelocks, Solana’s standard is to burn the pool authority entirely.
- Use RugCheck, not Etherscan — RugCheck (rugcheck.xyz) is the definitive Solana token scanner. Solscan is the primary explorer.
- Instant finality means no recovery — once a Solana transaction is confirmed, it is final in under a second. Prevention is your only defense.
- Low fees enable mass scam deployment — a scammer can create thousands of tokens for a few dollars. Always verify before buying.
- Never click links from unsolicited tokens — metadata in spam tokens can contain phishing URLs that drain your wallet.
For more on protecting yourself from token scams across all chains, see our guides on how to verify a token before buying, Base chain token safety, and how to check if liquidity is locked. You can also check any token or address risk in real time using our free address risk scoring tool.