Mint & freeze authority on Solana, explained: the two switches that decide if a token can rug you
Every SPL token on Solana is governed by a small account called the mint, and that account carries two permission fields that matter more than anything else on the token: mint authority and freeze authority. If you understand what these two switches do — and check them before every buy — you eliminate the two most common mechanical rugs on Solana. This guide explains what each one does, how to verify them in 30 seconds, and the edge cases that fool most token scanners.
1Mint authority: the money printer
Mint authority is the address allowed to create new tokens. When a token launches, the deployer holds it. If it's never revoked, that wallet can mint additional supply at any time — straight into its own account — and dump it into the liquidity pool.
Concrete example: a memecoin launches with 1 billion supply, all of it seemingly accounted for. Two hours later the deployer calls mintTo and prints another 5 billion tokens to a fresh wallet, then market-sells them into the pool. Your holdings don't move — but your share of the supply just went from 1/1,000,000,000 to 1/6,000,000,000, and the price collapses as the new supply drains the liquidity. From the outside it looks like a normal dump; on-chain it's a dilution attack.
2Freeze authority: the sell button killer
Freeze authority is nastier because it's targeted. The holder of this authority can freeze individual token accounts — including yours. A frozen account can't move its tokens at all. You can buy the token, watch it pump, and discover at the exact moment you try to sell that your account has been frozen. Everyone else seems to be selling fine; you can't.
This is the classic Solana honeypot: the chart looks healthy because frozen victims never show up as sell pressure. Some ruggers freeze buyers selectively (only wallets above a size threshold), which makes the trap even harder to spot from the chart alone.
3How to check them yourself in 30 seconds
Option A — any explorer. Paste the token's mint address into Solscan or SolanaFM. The token page lists "Mint Authority" and "Freeze Authority". You want both to read null / "revoked".
Option B — CLI (what the explorers read). If you have the Solana CLI and SPL token CLI installed:
spl-token display <MINT_ADDRESS> # Look for: # Mint authority: (not set) # Freeze authority: (not set)
The mint account's raw data encodes these as optional public keys; "(not set)" means the option flag is zero — cryptographically revoked, not just a promise. A website or Telegram bot claiming "renounced" is marketing; a null field in the mint account is fact.
4The verdict table
| Mint authority | Freeze authority | Verdict |
|---|---|---|
| null | null | Supply fixed, accounts can't be frozen. Proceed to the next checks (LP, holders). |
| set | null | Unlimited dilution risk. Hard pass for any size. |
| null | set | Honeypot mechanism armed. Hard pass. |
| set | set | Deployer has total control. This is a rug with extra steps. |
5Edge cases that fool scanners
Token-2022 extensions. Newer tokens use the Token-2022 program, which supports extensions like transfer fees and permanent delegate. A token can show null mint/freeze authority yet still carry a permanent delegate that can claw tokens from any account, or a transfer fee authority that functions like a sell tax. Checking the two classic fields is necessary but no longer sufficient for Token-2022 mints — read the extension list too.
"Revoked at launch" timing. Some deployers revoke authorities in a later transaction, not the launch transaction, hoping early scanners cache the "dangerous" state — or the reverse: they revoke to look clean, then the real trap is in the extensions above. Always read the current state, not the launch state.
Multisig authorities. Occasionally the authority is a multisig (e.g. 2-of-3) presented as "safer". It isn't revocation — it's just a slower printer. For a trading token, treat any non-null authority as a fail.
6Why revoked ≠ safe
Null authorities only remove the two mechanical attacks. They say nothing about unlocked liquidity, bundled insider holdings, or a deployer who simply market-sells a large pre-mine. Think of authority checks as the first filter in a pipeline: they reject the obvious scams in seconds so you can spend your real diligence time on LP lock, holder concentration, and sell simulation.
RUGSHIELD reads the mint account, Token-2022 extensions, LP state and holder distribution in one call — and returns a safety verdict with the evidence behind it. Free tier credits, no card required.
Get free scan credits →