Mint & Freeze Authority on Solana: The Two Rug Signals to Check

On Solana, the fastest rug check isn't the chart or the holder list — it's two fields on the token's mint account. Mint authority decides whether the supply can be inflated under you; freeze authority decides whether your sell can be switched off. Both should be revoked. It's the first thing an experienced trader looks at, and once you know where to look it takes about ten seconds.

The SPL token model in one minute

Almost every token you trade on Solana is an SPL token — issued by Solana's shared Token Program rather than a bespoke smart contract written per coin. Each token has a single mint account on-chain that stores its core facts: how many decimals it uses, the current total supply, and — the part that matters here — two optional authority fields.

An authority is just an address that holds a specific power over the mint. Each of the two fields can either contain an address (someone holds that power) or be empty — on-chain it reads null, and explorers show it as None or N/A. Empty means the power has been permanently given up. That single distinction — an address versus null — is the whole check. Two fields, two possible red flags.

Mint authority: the supply-inflation rug

The mint authority is permission to create new tokens. Whoever holds it can mint more of the token at will — there's no cap and no vote. Every new token minted dilutes everyone already holding: your slice of the supply shrinks, and if the creator mints aggressively into the market, the price they're selling into is your exit price. It's a quiet rug that doesn't need to touch the liquidity pool at all.

When the mint authority is revoked — set to null — the supply is fixed forever. No one, including the creator, can ever mint another unit. That's the state a serious token wants to be in, and most reputable projects revoke it at or shortly after launch specifically to earn that trust. If you are minting your own token, the create-a-token walkthrough shows exactly where in the process you revoke both. An active mint authority isn't always a scam, but it is always a live dilution vector, and it's exactly the kind of hidden power that turns into the anatomy of a Solana rug pull once the chart runs.

Freeze authority: the honeypot switch

The freeze authority is permission to freeze any individual token account for that mint. A frozen account can't transfer or sell — the tokens are locked in place until the authority chooses to unfreeze them. Read that again slowly, because it's the mechanic behind most Solana honeypots: the creator lets buyers pile in, the chart looks great, and then holders discover their sell simply won't go through.

This is the difference between a rug and a honeypot. A rug lets you sell into nothing; a freeze lets you buy and then blocks the exit entirely. We break the trap down in detail in how to spot a honeypot token, but the pre-buy signal is the same one field: if the freeze authority still holds an address, someone can freeze your account at will. Revoked to null means nobody — not even the creator — can ever freeze you.

How to check both authorities, concretely

You don't need a node or a script. Three tools cover it, and they agree with each other, so cross-checking takes seconds:

• A block explorer (Solscan). Paste the token's mint address and open its page. In the token overview you'll see Mint Authority and Freeze Authority listed plainly. If either shows a base58 wallet address, that power is live. If it shows None / N/A / a dash, it's revoked. That's the whole read — full walkthrough in how to use Solscan.
• DexScreener. On a token's chart page, the token-info and audit panel typically surfaces mint and freeze status as quick badges (for example "Mint disabled" / "Freeze disabled"). Handy for a glance, but treat it as a summary and confirm anything ambiguous on the explorer.
• A scanner (RugCheck). RugCheck.xyz grades a token and lists the freeze and mint authority state alongside liquidity, holder concentration, and Token-2022 flags. Read the individual line items, not just the headline score — a friendly-looking grade can still sit on top of an active authority.

Two things trip people up. First, the fields are independent: a token can revoke its freeze authority and quietly keep mint authority, or the reverse — a green check on one says nothing about the other, so read both every time. Second, revoking is one-way. Once an authority is set to null it can never be restored, which is exactly why an honest project is willing to do it — and why "we'll renounce it later" is a promise you can't verify, not a state you can confirm today.

The one habit worth building: when a field shows an actual address, don't rationalize it. On a fresh memecoin, an address in the mint or freeze field is a red flag until the project gives you a concrete, verifiable reason it's there.

Beyond the two: Token-2022's hidden powers

The classic mint and freeze fields belong to the original Token Program. A newer program, Token-2022 (Token Extensions), adds optional features that can behave like extra, less obvious authorities. Most projects using it are perfectly legitimate — but a few of the extensions are exactly what a scammer wants, and they won't show up in the two classic fields:

• Permanent Delegate. An address with standing permission to transfer or burn anyone's tokens without their signature. It is the most dangerous extension by far — effectively a master key over every holder's balance.
• Transfer Hook. Custom code the creator attaches to run on every transfer. It can add conditions to a move — or block it — which makes it a potential sell-blocker hiding one layer deeper than a freeze.
• Transfer Fee. A fee skimmed on every transfer. Set high enough, it makes selling pointless because most of what you move is eaten on the way out.

You don't have to audit Token-2022 by hand. The practical move is to notice whether the token uses Token-2022 at all — RugCheck and most wallets flag it — and, if it does, to check for these extensions specifically before you treat "mint and freeze both revoked" as the all-clear.

The honest nuance: context decides

Revoked-is-safer is the rule, but it isn't absolute. Some legitimate tokens keep an authority on purpose. Regulated stablecoins are the textbook case: issuers keep freeze authority so they can respond to fraud, theft, or sanctions — expected there, alarming on a dog coin. A young project mid-rollout might temporarily retain mint authority for a scheduled emissions or liquidity-incentive program it has documented publicly. The signal isn't "authority exists, therefore scam" — it's "authority exists, so where's the stated reason, and does it match what this token claims to be?"

Where a token came from is part of that context. A coin that launched through a bonding curve on a mainstream launchpad usually follows that platform's standardized authority handling, which is a different starting point from a mint someone hand-rolled and still controls. None of it replaces the check — it just tells you how suspicious to be when a field isn't null. For a random, hours-old memecoin with no such story, the honest default is simple: expect both revoked, and let an active mint or freeze authority veto the trade. Fold that into a repeatable routine with the Solana token due diligence checklist so you never skip it in a hurry.

How MoonHydra fits

MoonHydra is a non-custodial Solana trading bot on Telegram — your keys are encrypted with AES-256-GCM, trades route through the Jupiter aggregator, and the fee is a flat 1% per trade on buys and sells with no subscription. It runs no custom token contracts of its own. The tie-in to this article is its optional RugCheck integration, which is off by default: when you switch it on, it surfaces exactly these signals — mint and freeze authority status, plus Token-2022 flags — at the moment of the buy, and can gate the trade before it goes through. It's a guardrail, not a guarantee; scammers iterate and no automated check is infallible, so the manual read above still matters. Using separate Hydra Head wallets keeps any single bad token boxed into the funds in one wallet.

Bottom line

Two fields on the mint account carry most of the early rug risk on Solana. Mint authority should be revoked so the supply can't be inflated under you; freeze authority should be revoked so your sell can't be switched off. Revoked shows as null / None; an address means the power is live. Confirm both on an explorer or a scanner, and if the token uses Token-2022, check its extensions before you call it clean. On a random memecoin, expect both revoked and treat anything else as a red flag until proven otherwise — the check costs seconds and saves positions you'd never be able to close.

Next: work through the token due diligence checklist, learn the sell-blocking traps in how to spot a honeypot token, and see how these signals play out in the anatomy of a Solana rug pull.