How to check if a Solana token's metadata is mutable

November 11, 2026 · 10 min read · by the Rugsight team

The name, ticker and logo you see in a wallet are metadata, not the mint. On Solana those fields can stay editable after launch. That is a real capability, and it is also very common on well-known tokens. Mutable metadata is not a scam verdict, and frozen metadata is not a safety badge. This guide explains the two on-chain systems that store this data, how to read whether it can still change, and what a Rugsight free score does and does not include.

For the mint itself (which cannot be renamed), see how to verify a Solana token contract address. Mint and freeze authority are separate controls, covered in how to check Solana mint and freeze authority.

What "mutable metadata" means

Metadata is the record wallets use for name, symbol and a URI. The URI usually points at an off-chain JSON file that holds the image, description and links. If that record can still be updated, someone can change how the token appears in wallets without touching supply, freeze authority or liquidity.

That can be ordinary product maintenance (a new logo, a typo, a new docs URL). It can also be used to impersonate a different ticker after people have already bought, or to point the URI at a different file. The on-chain flag only tells you whether that change is still possible. It does not tell you whether anyone will use it.

Two independent systems show up in practice:

1. Metaplex Token Metadata, used by most classic SPL tokens. A metadata account is a PDA of the Token Metadata program (metaqbxxUerdq28cj1RbAWkYQm3ybzjb6a8bt518x1s), derived from the mint. According to Metaplex's Token Metadata overview and Updating Assets docs, the update authority can change name, symbol and URI with an Update instruction only while is_mutable is true. Setting is_mutable to false makes later data updates fail, and that flag can only be flipped from true to false, not back again. An update authority address may still be listed after that; it can no longer change those data fields.
2. Token-2022 metadata extensions, documented in Solana's Metadata Pointer and Token Metadata guide. The mint can store name, symbol, uri and update_authority in a TokenMetadata extension, and a MetadataPointer extension names the account that holds that metadata (often the mint itself). The same docs say the UpdateAuthority instruction "rotates the metadata update authority, or clears it entirely to make metadata immutable." The pointer also has its own authority, which can change which account the mint points to.

A token may use one of these, both, or (rarely) neither. Check the system that is actually present.

How to check it yourself

1. Copy the full mint from a source you already trust. Names and tickers are not unique.
2. Open that mint on Solscan or the official Solana Explorer. On Solscan, use the Metadata tab. For a Metaplex account you want two fields: whether metadata is mutable (is_mutable) and the update authority. For a Token-2022 mint, also open the extensions list and read tokenMetadata.updateAuthority and metadataPointer.authority.
3. Treat the fields as a pair:

- Metaplex: data can change only if is_mutable is true and an update authority still exists. If is_mutable is already false, name, symbol and URI cannot be changed even if an update authority address is still shown. - Token-2022: the metadata on the pointed-to account can change while updateAuthority is set. If that authority is cleared (null / none), those fields are immutable. If metadataPointer.authority is still set, the pointer itself can be moved to a different metadata account.

1. You can read the same facts over RPC. For Token-2022, getAccountInfo on the mint with jsonParsed encoding includes the extensions array:

curl -s https://api.mainnet-beta.solana.com -X POST -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"getAccountInfo","params":["<MINT>",{"encoding":"jsonParsed","commitment":"confirmed"}]}'

For Metaplex, fetch the metadata PDA (seeds metadata, the Token Metadata program id, and the mint) and decode update_authority and is_mutable from the account data. If you would rather not decode it, the explorer view is enough.

1. Look at the URI host. Metaplex's overview notes that the off-chain JSON can be stored on a permanent system such as Arweave, and that combining that with is_mutable = false is how you keep both the on-chain pointer and the file from changing. A https:// URL on ordinary web hosting can still have its contents replaced even when the on-chain URI string is frozen.

The off-chain file still matters

Immutable on-chain metadata only freezes the string stored for the URI. If that string points at a file the operator can overwrite, wallets can start showing a new image or a new link without any on-chain update. A content-addressed Arweave or IPFS URI is harder to silently replace; a mutable website is not. This is why "metadata frozen" on an explorer is not the same as "the logo can never change."

Live examples (verified 11 November 2026)

These figures come from two sources, both checked on 11 November 2026 between 15:36 and 15:40 America/Fortaleza (18:36–18:40 UTC): Rugsight's own free score (GET /api/score/{mint}) for the grade and flags, and a direct mainnet read of the Metaplex metadata account or Token-2022 extensions for mutability. They will change; open the linked token page for the live score.

Same grade, opposite metadata state (Metaplex):

BONK and WIF had the same free grade and the same two holder flags in this window. Rugsight now shows metadata mutability as information on the token page and in the API; it is not scored, so these two states still share a B / 82. BONK's URI is already on Arweave, but because is_mutable is true the on-chain URI can still be pointed somewhere else. On WIF, is_mutable is false, so name, symbol and URI cannot be updated through the Token Metadata update instruction.

Immutable Metaplex, higher grade:

• Goatseus Maximus (GOAT) (CzLSujWBLFsSjncfkh59rUFqvafWcY5tzedWJSuypump): grade A, score 90 (free check). Flag: TOP10_ELEVATED. Metaplex is_mutable was false.
• Pudgy Penguins (PENGU) (2zMMhcVQEXDtdE6vsFS7S7D5oUodfJHE8vd1gnBouauv): grade A, score 90 (free check). Flag: TOP10_ELEVATED. Metaplex is_mutable was false.

An A here still means only "no technical trap on the checks we run." It is not caused by frozen metadata, and frozen metadata is not what produced the A.

Token-2022, update authority cleared:

• Pump (PUMP) (pumpCmXqMfrsAkQ5r49WcJnRayYRqmXz6ae8H7H9Dfn): grade C, score 65 (free check). Flags: TOP10_HIGH, TOP1_WHALE. The Token-2022 tokenMetadata.updateAuthority and metadataPointer.authority were both cleared. Immutable metadata did not prevent a C from holder concentration.
• Anonymous Cat (ZCAT) (HcRLc9VDgjLeK154xDawfb1dmVJ98DoSqcwTHGqiDeJR): grade A, score 96 (free check). Flag: TRANSFER_FEE (a configured fee under 5%). Both Token-2022 metadata authorities were cleared. Frozen metadata and a transfer-fee extension can coexist; for that extension see how to check Token-2022 permanent delegate and hooks.

Metadata still updatable, including issuer-controlled tokens:

• USD Coin (USDC) (EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v): grade IC, technical score 50 (free check). Flags: MINT_AUTHORITY_ACTIVE, FREEZE_AUTHORITY_ACTIVE, HOLDERS_UNAVAILABLE. Metaplex is_mutable was true and an update authority was set. That matches how an issuer-controlled stablecoin is operated; see what issuer-controlled means.
• PayPal USD (PYUSD) (2b1kV6DkPAnxd5ixfnxCpjxmKwqjjaYmCZfHsFu24GXo): grade IC, technical score 0 (free check). Flags: MINT_AUTHORITY_ACTIVE, FREEZE_AUTHORITY_ACTIVE, PERMANENT_DELEGATE, TOP10_EXTREME, TOP1_WHALE. Token-2022 tokenMetadata.updateAuthority and metadataPointer.authority were both set. Rugsight labels this an issuer-controlled stablecoin (Paxos, for PayPal) because of mint, freeze and a permanent delegate — not because of metadata.
• ai16z (AI16Z) (HeLp6NuQkmYB4pYWo2zYs22mESHXPQYzXbB8n4V98jwC): grade C, score 55 (free check). Flags: MINT_AUTHORITY_ACTIVE, TOP10_ELEVATED, LIQUIDITY_MODERATE. Token-2022 tokenMetadata.updateAuthority was set; the metadata-pointer authority was cleared. Rugsight shows that as mutable metadata information. The C is from mint authority and the other flags; mutability is not scored.

What Rugsight shows

On the free check and at GET /api/score/{mint}:

• the usual mint authority, freeze authority, Token-2022 control, holder, liquidity and age flags;
• the display name and symbol, which may come from on-chain metadata or from market data;
• a short informational line for metadata mutability (for example, "Metadata: mutable (update authority set)" or "Metadata: immutable"), plus a metadata field in the JSON (mutable, updateAuthority, standard). This is shown as information and is not yet scored, so it does not change the grade.

The paid report (1 USDC for people, or 0.03 USDC per call for agents via x402) adds market numbers, the top-holder breakdown, and a launch-bundle / sniper heuristic on tokens up to 7 days old. It includes the same metadata information and also does not score it. The free BONK sample shows the layout.

That is why BONK and WIF can share a B / 82 in the same window with opposite metadata states: the states are visible, but they do not affect the score. Letter grades are explained in how to read a Solana token risk score.

Warning signs, summarised

FAQ

What does mutable metadata mean on a Solana token?

It means the on-chain name, symbol and metadata URI can still be updated. On Metaplex that requires is_mutable to be true and an update authority that can sign; on Token-2022 it requires a metadata updateAuthority (and, separately, a metadata-pointer authority can move the pointer). It does not mint supply, freeze wallets or pull liquidity.

How do I check if a Solana token's metadata is immutable?

Open the mint on Solscan or the Solana Explorer and read the metadata fields. For Metaplex, is_mutable must be false to freeze name, symbol and URI. For Token-2022, the metadata update authority should be cleared, and you should also confirm the metadata-pointer authority is cleared. Then check whether the URI itself is a content-addressed Arweave or IPFS link, or a website whose file can be overwritten.

Does Rugsight flag mutable metadata?

It is shown as information, not as a scored flag. The free token page, the free score JSON, and the paid report include a metadata field (mutable or immutable, the update authority, and whether the record is Metaplex or Token-2022). That field does not change the grade. On 11 November 2026, BONK (mutable) and WIF (immutable) both scored B / 82 with the same holder flags. Paste the mint into Rugsight to see the score and the metadata line.

If metadata is immutable, is the token safe to buy?

No. Immutable metadata only restricts changes to name, symbol and the URI string. A token can still have an active mint authority, concentrated holders, thin liquidity or a transfer fee. In the same check window, PUMP had both Token-2022 metadata authorities cleared and still scored C / 65 because of holder concentration.

Why do established tokens leave metadata mutable?

Issuers often keep the ability to fix a typo, replace a logo or update a docs URL. USDC, checked on 11 November 2026, is a clear case: grade IC, Metaplex is_mutable true. That is consistent with an issuer-controlled product, not a hidden extra trap on top of the mint and freeze authorities the IC grade already describes.

Summary

Ask two questions of a token's metadata: can the on-chain name, symbol and URI still be changed? and if the URI is frozen, can the off-chain file it points to still be replaced? On Metaplex, is_mutable is the switch for data updates. On Token-2022, look at the metadata update authority and the metadata-pointer authority. Rugsight shows those fields as information and does not yet score them, so two tokens can share a grade with opposite metadata states. Paste the mint into Rugsight for the score and the metadata line, then read mint authority, holders and liquidity as usual.

Rugsight is an automated technical tool. Nothing here is financial advice.