How to check if a Solana token's mint and freeze authority are revoked (and why it matters)

November 4, 2026 · 6 min read · by the Rugsight team

Two fields on a Solana token decide whether its creator can still print new supply or lock your tokens in place: the mint authority and the freeze authority. Both are public, both take seconds to check, and both should be the first thing you look at before buying an unfamiliar token. This guide explains what each one does, how to read them yourself, and what else to look at on Token-2022 tokens.

If you're looking at a pump.fun coin specifically, see how to check if a pump.fun token is a rug after this. For the full checklist, read how to check a Solana token for rug-pull risk.

What a mint account is

Every SPL token has one mint account. Its address is what people call "the mint" or "the contract address". The mint account stores the token's total supply, its decimals, and two optional authorities. It's owned by one of two programs:

• the original SPL Token program, TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA
• the newer Token-2022 (Token Extensions) program, TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb, which supports the same authorities plus optional extensions

What mint authority allows

The mint authority is the address allowed to create new tokens of that mint. Whoever holds it can mint any amount, at any time, into any token account, with no limit other than the maximum value of the supply field.

That's the "infinite mint" rug: the creator prints a large amount and sells it into the pool, and existing holders are diluted instantly.

If the mint authority is revoked (set to none), nobody can ever mint more. Revoking is permanent: there's no instruction to set it back. The supply can still go down through burns, but it can't go up.

Some legitimate tokens keep a mint authority on purpose, for example stablecoins or tokens with a published emission schedule. In those cases the question becomes who holds it (a known issuer, a multisig, a program) rather than whether it exists.

What freeze authority allows

The freeze authority is the address allowed to freeze individual token accounts of that mint. A frozen token account can't send or receive that token until the freeze authority thaws it.

That's the classic honeypot: you can buy, but your account gets frozen before you can sell, while the creator's own accounts stay free.

As with mint authority, revoking freeze authority is permanent. Regulated stablecoins usually keep a freeze authority for compliance reasons, which is a known, disclosed trade-off. On an anonymous new token there's no good reason for it.

How to check on an explorer

Open the mint address on an explorer such as Solscan or the official Solana Explorer (explorer.solana.com) and look at the token overview:

• Mint Authority: should be empty, shown as none or not set. If it shows an address, someone can still mint.
• Freeze Authority: same. An address here means someone can still freeze accounts.
• Owner program: tells you whether it's SPL Token or Token-2022. If it's Token-2022, the explorer also lists the extensions on the mint; read them (see below).

Make sure you're looking at the mint address, not a token account, a pool or a wallet. On an explorer, the page should say it's a token or mint, and it should show supply and decimals.

How to check with the spl-token CLI

If you have the Solana CLI tools installed:

spl-token display <MINT_ADDRESS>

The output includes the program, supply, decimals and the two authority lines. Revoked authorities are shown as not set. For Token-2022 mints it also prints the extensions. Use --url mainnet-beta (or -um) if your CLI isn't already pointed at mainnet.

How to check with a getAccountInfo RPC call

Any Solana RPC endpoint can answer this. Ask for the mint account with the jsonParsed encoding:

curl -s https://api.mainnet-beta.solana.com -X POST -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"getAccountInfo","params":["<MINT_ADDRESS>",{"encoding":"jsonParsed"}]}'

In the response, look at result.value.owner (the token program) and result.value.data.parsed.info:

• mintAuthority: null means revoked; an address means active.
• freezeAuthority: null means revoked; an address means active.
• supply and decimals: the raw supply and how many decimals to apply.
• On Token-2022 mints, an extensions array lists each extension and its settings.

If parsed.type isn't mint, you queried the wrong kind of account.

If you read the raw bytes instead: in the base mint layout, the mint authority is an optional public key at the start of the account (a 4-byte flag followed by 32 bytes), and the freeze authority is a second optional key after supply, decimals and the initialized flag. A flag of zero means none. The parsed encoding saves you from doing this by hand.

Token-2022 extensions that add similar risks

Revoked mint and freeze authority are not the whole story on Token-2022. Some extensions give an address comparable power:

• Permanent delegate: one address can transfer or burn tokens from any holder's account, without their signature.
• Transfer hook: every transfer calls a custom program chosen by the creator. That program can make transfers fail, so selling can be blocked even with freeze authority revoked.
• Transfer fee: a percentage is withheld on each transfer. Check the current rate and whether an authority can raise it.
• Default account state: new token accounts can start frozen by default, which only matters if a freeze authority exists to thaw them.
• Non-transferable: the tokens can't be transferred at all.
• Pausable: an authority can pause all transfers of the token.

Each of these has its own authority field. Treat any of them, on an unknown token, as seriously as an active freeze authority.

Red flags

• Mint authority still set on a new token with no explanation of who holds it and why.
• Freeze authority still set on anything that isn't a disclosed, regulated asset.
• A token that claims "authorities renounced" in its marketing while the chain says otherwise. The chain wins.
• Token-2022 with a permanent delegate, a transfer hook, a pausable config, or a high or changeable transfer fee.
• The authority is held by a fresh wallet that also created the pool or holds a large share of supply.

What revoked authorities don't tell you

Revoked mint and freeze authority remove two specific tricks. They say nothing about who holds the supply, whether the liquidity can be pulled, or whether the people behind the token will sell. Most rugs on tokens with revoked authorities happen by plain selling. Check holder concentration and liquidity next; the pump.fun guide shows what that looks like in practice. To verify whether the pool itself can be pulled, see how to check if a Solana token's liquidity is burned or locked.

The token's metadata (name, symbol, image) usually has its own update authority, separate from the two above. An active update authority can change how the token looks in wallets, which is a smaller risk but worth knowing about.

Checking it with Rugsight

If you'd rather not read raw fields, Rugsight checks mint authority, freeze authority and Token-2022 extensions such as permanent delegate, transfer hook, transfer fee, non-transferable and pausable, along with holder concentration and liquidity, and returns a free score. Paste the mint on the site, or call the API directly:

curl https://rugsight.rugsight.workers.dev/api/score/<MINT_ADDRESS>

It's free and needs no sign-up. Use it as a quick first pass, and still look at the explorer yourself for anything you're about to put real money into.

Rugsight is an automated technical tool. Nothing here is financial advice.