Scam tokens on Solana are cheap to launch and easy to dress up. Here is a short checklist I run before trusting any token, using only read-only tools.

1. Verify the mint address, not the ticker

Tickers and names are not unique on Solana. Anyone can create a token called "USDC" or "BONK". The mint address is the only real identifier.

  • Copy the mint from an official source (project site, verified social, or a trusted aggregator listing).
  • Paste it into a block explorer (Solscan, Solana Explorer, SolanaFM) and confirm the address matches exactly.
  • Be careful of look-alike addresses that share the first and last few characters.

2. Check the authorities

On the mint account, look at:

  • Mint authority: if set, the owner can print unlimited supply. Ideally it is null (revoked).
  • Freeze authority: if set, the owner can freeze your token account. Ideally null too, unless it is a regulated asset.
  • Update authority (Metaplex metadata): can change name, image, and URI after the fact.

You can also check from the CLI:

spl-token display <MINT_ADDRESS> --url mainnet-beta

Look for "Mint authority: (not set)" and "Freeze authority: (not set)".

3. Look at holder distribution

On the explorer's holders tab:

  • Does the top wallet (excluding the LP and known burn/program accounts) hold a large share?
  • Do many top wallets look funded from the same source at the same time? That suggests one entity splitting supply.
  • Very few holders and a big deployer balance is a red flag.

4. Inspect liquidity (LP)

  • Find the pool on Raydium, Orca, or Meteora via the explorer or a DEX aggregator.
  • Is the LP token burned or locked? If the deployer holds the LP tokens, they can remove liquidity (a rug pull).
  • Check pool depth: a tiny pool means any trade moves the price massively and exits are hard.
  • Check the pool age and trade history for wash-trading patterns.

5. Simulate before you sign

  • Read the transaction preview in your wallet. Unexpected token approvals, delegate changes, or "set authority" instructions are red flags.
  • Try a tiny test amount first.
  • Use a separate burner wallet with a small balance for anything unknown.

6. Never connect a wallet just to browse

Reading data does not need a wallet connection. Explorers, charts, and holder lists all work without one. Treat any site that demands a wallet connection before showing basic token info as suspicious. Phishing sites rely on a quick "connect and sign" click. Also:

  • Never share your seed phrase, ever.
  • Revoke old token delegations periodically.
  • Bookmark the sites you use instead of following links from DMs or replies.

Tools

Explorers and aggregators cover most of this. Some community-run tools, such as solspin.net, are also worth a look for Solana-related browsing, but always apply the checklist above independently and never rely on a single source.

TL;DR

Mint address over ticker, revoked authorities, sane holder spread, burned or locked LP, and no wallet connection just to look. This is not financial advice. Always do your own research.