How to verify a Solana token contract address

November 9, 2026 · 7 min read · by the Rugsight team

On Solana, the mint address is the only stable identity of a token. The name, ticker and logo are just metadata anyone can copy. Fake and lookalike tokens succeed when someone pastes a ticker into a swap UI, or copies an address from a reply under a post, and never compares it to a trusted source. This guide shows how to verify a Solana token contract address before you buy, with live side-by-side examples of a real mint and a copycat that shares the same ticker.

For what to check after you have the right mint, see how to check a Solana token for rug-pull risk. If the coin claims to be from pump.fun, also read how to check if a pump.fun token is a rug.

What a "contract address" is on Solana

People coming from other chains often say contract address or CA. On Solana the equivalent is the mint account address: a base58 pubkey, usually 32–44 characters, that points at the single on-chain account storing that token's supply, decimals and authorities.

Everything else is optional branding:

• Symbol / ticker (BONK, WIF, TRUMP) — not unique.
• Name (Bonk, dogwifhat, OFFICIAL TRUMP) — not unique.
• Logo / social links — off-chain metadata anyone can clone.

Two different mints can show the same symbol and almost the same name in a wallet or a DEX search. Only the full mint address tells them apart.

Step 1: get the mint from a source you already trust

Before you open a scanner, lock down which mint you mean:

1. Prefer a link the project itself published (its site, a pinned post, or an official docs page), not a reply under that post.
2. On explorers and launchpads, copy the address from the token page URL or the mint field, not from chat.
3. For a pump.fun coin the mint is in the URL: pump.fun/coin/<mint>. Most real pump.fun mints end in pump, but that suffix is a vanity ending anyone can grind — it is not proof.
4. Compare the entire address, not the first four and last four characters. Lookalike addresses are rare, but truncated paste checks miss ordinary copycats that share only the ticker.

If a stranger DMs you a mint "to buy before it runs", treat that mint as untrusted until it matches a source you already follow.

Step 2: never search by ticker alone

DEX search boxes and wallet "add token" flows rank by name and liquidity. A copycat with a familiar ticker can appear above, or next to, the real one. Searching BONK or TRUMP and tapping the first result is how people buy the wrong mint.

Safer patterns:

• Paste a full mint into the swap or checker.
• Paste a token page URL from DexScreener, Birdeye, Solscan, Jupiter, pump.fun, GMGN and similar sites — Rugsight's input box extracts the mint from those links.
• For a short list of well-known tokens, Rugsight also resolves curated symbols such as BONK, WIF or TRUMP to the Jupiter-verified mint we list on /tokens. That shortcut is for known majors, not for a brand-new launch you saw in a chat.

Step 3: confirm the mint on an explorer

Open the mint on Solscan, SolanaFM or a similar explorer and check:

• Symbol and name match what you expected (still not proof — copycats match these on purpose).
• Token program: classic SPL Token vs Token-2022. A coin that markets itself as a normal pump.fun launch but sits on Token-2022 with extra extensions deserves a closer look (Token-2022 guide).
• Mint authority and freeze authority: revoked vs active (mint and freeze authority guide).
• Created / first activity time: a "BONK" minted last week is not the 2022 memecoin.

For a field-by-field walkthrough of that Solscan token page (authorities, holders, metadata, extensions), see how to read a Solana token on Solscan.

None of those fields prove legitimacy by themselves. They catch the common case where the copycat reuses the brand but keeps dangerous authorities or almost no sellable liquidity.

Step 4: run the same checks you would on any mint

Once the address is the one you intended, the usual risk checklist still applies: authorities, Token-2022 extensions, holder concentration, liquidity, and whether you can actually sell. Verifying the mint is the gate; it does not replace those checks.

Live examples (verified 2026-11-09, re-checked 2026-11-10)

These numbers were re-checked from Rugsight's free score on 10 November 2026 at 23:18–23:38 America/Fortaleza (11 November 2026, 02:18–02:38 UTC). Same ticker does not mean same mint. They will change; open the linked token page for the live figure.

Real BONK vs a same-ticker copycat:

Paste either mint into Rugsight and you get those results in seconds. Paste only the ticker BONK and Rugsight resolves the curated real mint above — which is why a curated symbol shortcut helps for majors, and why it must not be how you identify a new launch.

Official TRUMP vs a same-ticker copycat:

Seeing the same freeze authority on two unrelated copycat tickers is a useful reminder: branding is cheap to clone; the mint and the authorities are what you can actually verify.

Same ticker, different product — WIF:

• Real dogwifhat (EKpQGSJtjMFqKZ9KQanSqYXRcF8fBopzLHYxdM65zcjm): grade A, score 85 (free check). Mint and freeze revoked; main pool LP burned.
• A pump.fun mint using the WIF ticker with name catwifhat (Hjj93YiyaFYY8zY2EW6FM2i2gd4rxzhoLCLFabrRpump): grade B, score 83, liquidity under $10k. Authorities look fine; it is simply not dogwifhat. A ticker search that stops at WIF can land you here.

What Rugsight shows

On the free check:

• You can paste a mint, a curated symbol for known majors, or a token URL from common Solana sites; we extract and resolve the mint (including DexScreener/Photon pair links when needed).
• The score then evaluates that mint: authorities, Token-2022 extensions, wallet holder concentration, liquidity bucket, pool age and related flags.
• Popular majors also have stable pages such as /token/bonk so you can bookmark the mint you mean.

The paid report (1 USDC for people, or 0.03 USDC per call for agents via x402) adds the holder table, liquidity-lock detail, launch-bundle heuristic on young tokens, and plain-English flag explanations. The free BONK sample shows the layout for the real mint.

Limits, stated plainly:

• Rugsight does not certify that a project is "official" or endorsed. Matching a curated major (BONK, WIF, TRUMP, …) only means we mapped that symbol to the Jupiter-verified mint we list.
• We do not detect every impersonation in social feeds. If you paste a copycat mint, we will score that mint honestly — including a green-looking authority set on a low-liquidity lookalike.
• Metadata (name, symbol, logo) can be changed or spoofed off-chain; the mint address cannot.

Warning signs, summarised

Summary

Verify the full mint address from a source you trust before you buy. Tickers and names are not unique on Solana; copycats reuse them on purpose. Paste the mint (or a token URL) into an explorer and into Rugsight, and only then read authorities, holders and liquidity. A free check takes seconds once you have the right address — and scores the wrong address just as confidently if you skip this step.