Solana Token Safety Checks Before You Buy

Most token safety advice is about reputation — who launched it, what the chat looks like, whether the site is real. ★None of that is checkable by a bot in the two seconds it has.★

What is checkable is the on-chain configuration, and it answers a sharper question: not "is this a scam" but "what can someone still do to me after I buy."

The Question That Organises Everything

★Every meaningful check is asking whether an authority still exists.★

An authority set to null is a permanent guarantee. An authority pointing at a key is a capability someone holds. The current state matters far less than who can still change it.

const mint = await getMint(connection, mintAddress);

const checks = {
  // ★null means nobody can ever mint more★
  mintAuthorityRevoked: mint.mintAuthority === null,
  // ★null means nobody can freeze your account★
  freezeAuthorityRevoked: mint.freezeAuthority === null,
  supply: mint.supply,
  decimals: mint.decimals,
};

One account read gives you both, and for classic SPL tokens that is most of the answer.

What Each Authority Actually Enables

★Freeze authority is the one that is consistently underrated.★ Mint authority dilutes you, which is bad. Freeze authority means someone can make your position unsellable at a moment of their choosing — and unlike dilution, there is no partial outcome.

If your checks pass and transactions still miss, a free BoltTx key is one line to test the submission path.

Liquidity Is Where the Actual Risk Lives

★A token with both authorities revoked can still be rugged, because the tokens are not the risk — the pool is.★

// The LP tokens represent ownership of the pool's liquidity.
const lpMint = await getMint(connection, lpMintAddress);
const lpSupply = lpMint.supply;

// ★Who holds them?★
const holders = await connection.getProgramAccounts(TOKEN_PROGRAM_ID, {
  filters: [
    { dataSize: 165 },
    { memcmp: { offset: 0, bytes: lpMintAddress.toBase58() } },
  ],
});

Three outcomes worth distinguishing:

Burned. LP tokens sent to a burn address or the supply is zero. ★Liquidity cannot be withdrawn.★

Locked. Held by a locker program with a time condition. Check when it unlocks — a lock expiring tomorrow is not a lock.

★Held by a wallet.★ ★Liquidity can be removed at any moment, which is the classic rug.★ Revoked mint and freeze authorities do nothing to prevent this.

Concentration Tells You About Exit

const accounts = await connection.getProgramAccounts(TOKEN_PROGRAM_ID, {
  filters: [
    { dataSize: 165 },
    { memcmp: { offset: 0, bytes: mintAddress.toBase58() } },
  ],
  dataSlice: { offset: 64, length: 8 },     // ★just the amount★
});

const balances = accounts
  .map((a) => a.account.data.readBigUInt64LE(0))
  .sort((a, b) => (b > a ? 1 : -1));

★dataSlice matters here — without it you transfer every holder's full account data to compute a sum.★

What to look for: a small number of wallets holding most of the supply. It is not proof of anything, but it bounds what an exit looks like — if one wallet can dump more than the pool can absorb, your exit price is their decision.

The Check That Requires Simulation

Configuration tells you about capabilities. ★It cannot tell you whether a sell will actually work.★

// ★Simulate the exit before taking the entry.★
const sellSim = await connection.simulateTransaction(sellTx, {
  replaceRecentBlockhash: true, sigVerify: false,
});
if (sellSim.value.err) return { tradeable: false, reason: "sell fails" };

A transfer hook that permits buys and rejects sells passes every configuration check. So does a token whose pool has no liquidity on the other side. ★Simulating the sell is the only check that catches a trap by its behaviour rather than its settings.★

For a fast sniper this is the expensive step, and skipping it is a real tradeoff rather than an oversight — you are trading a known risk for latency.

Ordering by Cost

Run them cheapest first so most tokens are rejected before you spend anything:

1. ★mint owner★ — one read, tells you classic vs 2022
2. ★mint authority + freeze authority★ — same read
3. extensions — same read, if 2022
4. pool reserves — one read, is there liquidity at all
5. LP status — a few reads
6. holder concentration — one heavy gPA call
7. ★sell simulation★ — the expensive one

★Steps 1 through 4 come from two account reads and reject most bad tokens.★ The expensive checks only run on candidates that already look reasonable.

What These Checks Do Not Cover

Worth being explicit, because a passing checklist creates false confidence:

Nothing about the team or intent. ★Revoked authorities and burned LP describe a token that cannot be rugged by those specific mechanisms — not a token that will go up.★

Nothing about future liquidity. A pool with liquidity now can be thin later through ordinary trading.

Nothing about the pool program itself. You are trusting whichever AMM holds the liquidity.

A snapshot, not a subscription. Authorities can be exercised between your check and your trade.

What Landing Looks Like

Real transactions through our delivery nodes: median confirmation 336ms — under one slot.

★Every check is latency, and latency is position in the queue.★ The tradeoff is real: a bot that checks everything arrives later than one that checks nothing, and the second one occasionally buys something it cannot sell.

Where BoltTx Fits

We handle submission. What you check before trading is entirely your decision.

Submissions route through our own delivery nodes in four regions with stake-weighted routing and no public mempool exposure, so a transaction is not observable in transit before it lands. Your safety checks keep whatever read endpoint you already use — the paths are independent, so heavy screening cannot exhaust the quota your sends need.

You sign locally. We never hold funds, never sign, and never modify transaction contents. The tip travels inside the transaction, paid on chain from your own wallet, and reverts with the transaction if it fails, because that is how Solana handles atomic transactions. You pay only on transactions that reach the chain.

Get a free API key. No monthly fee:

const sender = new Connection("https://la.bolttx.io/?api-key=YOUR_KEY");

FAQ

What should I check before buying a Solana token? Mint authority, freeze authority, extensions if it is Token-2022, whether the pool has liquidity, LP token status, holder concentration, and a sell simulation. The first four come from two reads.

What does revoked mint authority mean? Nobody can create more supply. It is a permanent guarantee once null, which is why the check is about whether the authority exists rather than what it has done.

Why does freeze authority matter? Whoever holds it can freeze your token account, making your position unsellable at a moment of their choosing. Unlike dilution, there is no partial version of this outcome.

Can a token be rugged if both authorities are revoked? Yes. The authorities govern the token, while the risk lives in the pool. If LP tokens are held by a wallet, liquidity can be withdrawn regardless of authority status.

How do I check if liquidity is locked? Look at who holds the LP tokens. Burned means the supply is gone or sent to a burn address, locked means a locker program holds them, and a plain wallet means removable at any time.

Is a time-locked LP safe? Only until it unlocks. Check the unlock time, since a lock expiring shortly is functionally the same as no lock at all.

How do I check holder concentration? Query token accounts for the mint with a dataSlice for just the amount, then sort. Without the slice you transfer every holder's full account data to compute a sum.

Why simulate a sell before buying? Because configuration checks cannot detect a transfer hook that permits buys and rejects sells. Simulation is the only check that tests behaviour rather than settings.

What Token-2022 extensions are dangerous? Permanent delegate lets someone take your tokens without your signature, and non-transferable prevents selling entirely. A live transfer fee authority can also introduce a fee later.

How much latency do safety checks add? The cheap checks are two account reads and reject most bad tokens. Holder concentration and sell simulation are expensive and only worth running on candidates that already pass.

Can I cache safety check results? Only the immutable parts, such as decimals and which token program owns the mint. Authorities can be exercised and liquidity can be removed, so those must be current.

Do passing checks mean the token is a good buy? No. They mean specific attack mechanisms are unavailable. Nothing on chain speaks to whether the price will go up or whether the team intends to keep building.

What is the minimum check for a fast sniper? Mint and freeze authority from the mint read you are already making, plus a non-zero pool reserve. That rejects a large share of bad tokens for almost no latency.

Should I check the metadata update authority? It is worth noting but low severity. It allows changing name and image, which is cosmetic compared to minting, freezing, or removing liquidity.

How do I check LP status programmatically? Read the LP mint's supply and query its token accounts to see who holds them. A zero supply or a burn address holding everything means the liquidity cannot be withdrawn.

Can authorities be exercised between my check and my trade? Yes. Every check is a snapshot, which is why the on-chain minimum output remains your actual protection at execution time rather than the pre-trade screening.

Related Reading

• Reading Solana Pool State
• Which Token Extensions Change Your Trading Code
• Solana getProgramAccounts Guide
• Solana Token Launch Sniping
• Solana Transaction Landing