Logo officiel du MASTR MASTR Soutenir le travail
Sommaire
← Accueil du wiki

Wallets & security

Token-2022: read every authority, not just the ticker

A familiar token name can hide a different set of controls.

Research guide · 9 September 2026 · 1 min read

Les enquêtes et les fiches de référence sont publiées en anglais. La navigation est disponible en sept langues.

Personnes et projets

Dans cet article
  1. Establish the programme and mint Record the network, full mint address and owning programme before interpreting any authority field. Read the mint extensions and the relevant account extensions. An empty field in a dashboard is not evidence that an extension is absent; it can also mean the interface does not decode it.
  2. Turn configuration into an exposure statement Ask which party can change the rules, which actions affect holders and whether those powers can be removed. Separate current parameters from the authority to modify them. A fee set to zero today and an irrevocably absent fee mechanism are different configurations.
  3. Keep the conclusion bounded Document the block or slot, source and decoding method. Describe the observed control rather than applying a blanket scam label to an entire token standard. Legitimate applications also use configurable token behaviour. The useful finding is who controls what, whether buyers were told and how that control changes their ability to transfer or exit.

Token-2022 supports optional extensions on Solana mints and token accounts. That matters because a scanner designed around the original token programme may give an incomplete picture. The logo, ticker and price chart do not describe the instructions the token actually permits.

Establish the programme and mint Record the network, full mint address and owning programme before interpreting any authority field. Read the mint extensions and the relevant account extensions. An empty field in a dashboard is not evidence that an extension is absent; it can also mean the interface does not decode it.

Turn configuration into an exposure statement Ask which party can change the rules, which actions affect holders and whether those powers can be removed. Separate current parameters from the authority to modify them. A fee set to zero today and an irrevocably absent fee mechanism are different configurations.

Keep the conclusion bounded Document the block or slot, source and decoding method. Describe the observed control rather than applying a blanket scam label to an entire token standard. Legitimate applications also use configurable token behaviour. The useful finding is who controls what, whether buyers were told and how that control changes their ability to transfer or exit.

Sources

Solana documentation · extensions

Technical reference checked 9 September 2026. The review questions are editorial analysis, not findings about a named project.

Lectures associées

Portefeuilles et sécurité

Delegatecall authority

Delegatecall runs another contract's code in the caller's storage context.

MASTR

Soutenir la recherche indépendante

Les enquêtes, les preuves originales et les guides sont en accès libre. Les dons volontaires contribuent au financement de la recherche et au maintien des outils MASTR.

Ouvrir le portefeuille