© 2026 Della Group. All Rights Reserved.
Verifying Solana tokens? Okay, first off, it's not just one thing. People mean different stuff. Sometimes it's checking if a token's real and not a scam. Other times, it's digging into program builds or signatures for devs. But you're here to learn how to use it practically, right? So I'll hit the big ones: spotting legit tokens as a trader, verifying program code if you're building, and even signature checks for airdrops. In my experience, most folks just wanna avoid rug pulls. We'll start there. Super quick. Then go deeper.
Look, you find a hot new token on Pump.fun or Dexscreener. Pumped 10x. Hype everywhere. But is it safe? Don't buy blind. Here's my daily routine.
First, grab the token address. That's the mint address, like a unique ID for the token. Every Solana token has one - it's owned by the SPL Token Program. Paste it into Solana Explorer. Solscan or Explorer.solana.com. Both work fine. I usually hit Solscan cuz it's faster.
Why does this matter? Rug pulls happen when mint auth lives and devs dump. Seen it a hundred times. Okay, next - metadata. Click the metadata tab. Name, symbol, image URL legit? Image not stolen from Google? Hover it. Right click save. If it's blurry PNG from 2010, lol bye.
Takes 2 minutes. Saved me thousands. But wait, Jupiter verification? That's community thing now.
So Jupiter Exchange added this community verify. Not official endorsement, but signal it's the right token. How? Go to jup.ag, search the token. If unverified, hit "like" on the page. Through Twitter. Boom. Enough likes, it gets checkmark. I did this for a few degen plays. Works pretty quick.
Thing is, it's not foolproof. Scammers game it. But combined with explorer? Solid start. Fees on trades? Like 0.3% on Jupiter, tiny. Gas? Solana's ~0.000005 SOL per tx. Negligible.
Honest talk: No tool 100% safe. But this stack? 95% rugs dodged. Now, if you're holding SPL tokens, check balances too. SPL Token CLI rocks for that.
Got Phantom? Cool for UI. But CLI? Power move. Install Solana CLI first. Then SPL Token.
sh
solana keygen new # if no wallet
spl token accounts # lists all your tokens
spl token balance <TOKEN_MINT> # specific one
I usually run this after big trades. Shows UI amount, decimals adjusted. Like, 1.5 tokens if decimals=6 means 1,500,000 raw. Mismatches? Hack alert. Happened to a buddy once - drained fast.
Okay, shift gears. You're a builder? Verifying Solana programs means proving onchain code matches your GitHub source. Why? Trust. Explorer shows "Verified" badge. Users love it.
In my experience, skip this early - tests fail cross systems. Use Docker always. Here's the flow.
cargo install solana verify. Ellipsis Labs maintains it.solana verify build. Docker spins up. Deterministic hash.solana program deploy target/deploy/myprogram.so. Use the verified .so!solana verify verify from repo <PROGRAM_ID> --git url https://github.com/user/repo --commit hash abc123 --mount path ./solana verify remote get job status <JOB_ID>.Pass? Explorer badges it. Fail? Hashes mismatch. Usually wrong Docker or non deterministic build. I chased one for hours - forgot --mount path.
Pro tip: Pin CLI version. cargo install solana verify --version 0.2.3 or whatever latest. Solana program deps like solana program = "2.1.0". Match network.
| Step | Command | Gotcha |
|---|---|---|
| Build | solana verify build | Must be in Cargo.toml root |
| Verify Repo | solana verify verify from repo <ID> | Add --commit hash for locks |
| Remote | --remote flag | Takes 10-30 mins |
Once verified, PDA onchain holds git URL, commit, args. Public proof. Explorer, SolanaFM, Solscan all show it. Dune dashboards too. Ecosystem healthier.
Now this? Underrated. For airdrops, logins, token gating. Solana's Ed25519Program verifies sigs onchain. No storage needed. Genius for cheap.
Picture: Team signs offchain (recipient, amount). You claim onchain. Program verifies sig before transfer. Cost? One instruction. ~0.000005 SOL.
Why bother? Store all eligibles onchain? Insane rent. Sigs = offchain list, onchain verify. Scalable.
Grab Anchor. anchor init airdrop distribution. Edit lib.rs. Here's the meat - claim fn verifies prior Ed25519 ix via sysvar introspection.
bits: Load instructions sysvar. Check prev ix was Ed25519Program (Ed25519Program::id()). No accounts. Parse header (16 bytes: sig count=1, offsets). Extract sig (64b), pubkey (32b), msg (40b: recipient 32b + u64 amount). Rebuild msg, match expected distributor pubkey and recipient. Boom.
rust
// Snippet from real code
let edix = ixsysvar::loadinstructionatchecked((currentixindex - 1) as usize, &ixsysvar_account)?;
require!(edix.programid == ed25519_program::id(), AirdropError::BadEd25519Program);
// Parse offsets, validate bounds, reconstruct pubkey & msg..
let distributorpubkey = Pubkey::newfromarray(pkarr);
if distributorpubkey != ctx.accounts.expecteddistributor.() { return err!(AirdropError::DistributorMismatch);
}
Full accounts: recipient (mut signer), expecteddistributor (unchecked), instructionsysvar (fixed ID), system_program.
Client side? Sign message [recipient][amount] with distributor. Tx: Ix1 Ed25519 verify (sig, pubkey, msg). Ix2: Your claim (introspects Ix1). Network runs verify first, then claim checks it passed.
Issues? Offsets wrong - use u16::MAX for "this ix". Bounds fail? Data too short. Distributor mismatch? Wrong. Test heavy - Anchor test suite mocks it.
I built one for a project. Claimed 10k users. Zero failed verifies. Magic.
One more trader tip. SPL tokens live in token accounts. Associated Token Account (ATA) is standard: derive from wallet + mint. Check balance: spl token balance <TOKEN_ACCOUNT>.
Ledger? Verify tx on device. Portfolio > Tokens. Matches explorer? Good. Wrong? Abort.
Track activity? Helius Orb or Backpack wallet search. Holders, volume, tx history. Mark unverified metadata as risky in UI.
© 2026 Della Group. All Rights Reserved.