Logo MASTR ufficiale MASTR Sostieni il lavoro
Indice
← Home della wiki

Wallets & security

Token-2022: read every authority, not just the ticker

A familiar token name can hide a different set of controls.

Research guide · 9 September 2026 · 1 min read

Gli articoli di ricerca e le schede sono pubblicati in inglese. La navigazione è disponibile in sette lingue.

Persone e progetti

In questo articolo
  1. Establish the programme and mint Record the network, full mint address and owning programme before interpreting any authority field. Read the mint extensions and the relevant account extensions. An empty field in a dashboard is not evidence that an extension is absent; it can also mean the interface does not decode it.
  2. Turn configuration into an exposure statement Ask which party can change the rules, which actions affect holders and whether those powers can be removed. Separate current parameters from the authority to modify them. A fee set to zero today and an irrevocably absent fee mechanism are different configurations.
  3. Keep the conclusion bounded Document the block or slot, source and decoding method. Describe the observed control rather than applying a blanket scam label to an entire token standard. Legitimate applications also use configurable token behaviour. The useful finding is who controls what, whether buyers were told and how that control changes their ability to transfer or exit.

Token-2022 supports optional extensions on Solana mints and token accounts. That matters because a scanner designed around the original token programme may give an incomplete picture. The logo, ticker and price chart do not describe the instructions the token actually permits.

Establish the programme and mint Record the network, full mint address and owning programme before interpreting any authority field. Read the mint extensions and the relevant account extensions. An empty field in a dashboard is not evidence that an extension is absent; it can also mean the interface does not decode it.

Turn configuration into an exposure statement Ask which party can change the rules, which actions affect holders and whether those powers can be removed. Separate current parameters from the authority to modify them. A fee set to zero today and an irrevocably absent fee mechanism are different configurations.

Keep the conclusion bounded Document the block or slot, source and decoding method. Describe the observed control rather than applying a blanket scam label to an entire token standard. Legitimate applications also use configurable token behaviour. The useful finding is who controls what, whether buyers were told and how that control changes their ability to transfer or exit.

Fonti

Solana documentation · extensions

Technical reference checked 9 September 2026. The review questions are editorial analysis, not findings about a named project.

Letture correlate

Wallet e sicurezza

Delegatecall authority

Delegatecall runs another contract's code in the caller's storage context.

MASTR

Sostieni la ricerca indipendente

Le indagini, le prove originali e le guide sono accessibili gratuitamente. Le donazioni volontarie contribuiscono a finanziare la ricerca e a mantenere disponibili gli strumenti MASTR.

Apri wallet