Solana Token Security Best Practices
Protect your SPL token with proper authority management, wallet security, and risk mitigation strategies. Essential guidance for token creators.
Security Fundamentals
Token security on Solana involves protecting private keys, managing authorities correctly, and understanding on-chain risks. Poor security can result in loss of control, theft, or reputational damage.
Core principle: You are responsible for your private keys and authority management. Blockchain transactions are irreversible.
Wallet Security
Your wallet holds the mint and freeze authorities. Protecting it is paramount.
Secure Your Seed Phrase
- Write your seed phrase on paper and store it in a secure location (safe, safety deposit box).
- Never store your seed phrase digitally (screenshots, cloud storage, password managers).
- Never share your seed phrase with anyone, including customer support.
Use Hardware Wallets for High-Value Tokens
For tokens with significant value or responsibility, use a hardware wallet (Ledger, Trezor) instead of browser extensions.
- Private keys never leave the hardware device.
- Protects against malware and phishing on your computer.
- Requires physical confirmation for every transaction.
Consider Multi-Signature Wallets
For team-managed tokens, use multi-signature wallets (e.g., Squads Protocol) that require multiple approvals for critical actions like minting or authority changes.
Enable Wallet Security Features
- Set a strong wallet password or PIN.
- Enable auto-lock after inactivity.
- Review transaction details carefully before approving.
Authority Management
SPL tokens have three authorities: mint, freeze, and update. Managing these correctly is critical.
| Authority | Purpose | Security Recommendation |
|---|---|---|
| Mint Authority | Create new tokens and increase supply | Revoke if supply is fixed. Otherwise, use multi-sig or secure wallet. |
| Freeze Authority | Freeze individual token accounts | Revoke for community tokens. Retain only for compliance use cases. |
| Update Authority (Metadata) | Update token name, symbol, image | Retain to fix errors. Transfer to DAO or revoke if immutability is desired. |
When to Revoke Mint Authority
Revoking mint authority permanently sets the supply. This builds trust but is irreversible.
Revoke if: Fixed supply is a core promise, and you have no future minting plans (no staking rewards, vesting, etc.).
Retain if: You plan to mint for staking rewards, future unlocks, or treasury allocations.
When to Revoke Freeze Authority
Most community tokens revoke freeze authority to signal decentralisation and user freedom.
Retain if: Your token requires compliance controls (e.g., regulated securities, KYC restrictions).
Transfer Authority to a DAO
For mature projects, transfer mint or update authority to a DAO (Decentralised Autonomous Organisation) controlled by token holders. This distributes control and reduces single-point-of-failure risk.
Common Security Threats
Understand the risks to protect your token and users.
Private Key Compromise
Threat: Attacker gains access to your wallet's private key or seed phrase.
Impact: Complete loss of control. Attacker can mint unlimited tokens, freeze accounts, or drain funds.
Mitigation: Use hardware wallets, never share seed phrases, store backups securely offline.
Phishing Attacks
Threat: Fake websites or wallet interfaces trick you into approving malicious transactions.
Impact: Unauthorised transfer of authority or token drains.
Mitigation: Always verify URLs, bookmark official sites, review transaction details in your wallet before approving.
Smart Contract Vulnerabilities
Threat: If your token interacts with custom smart contracts (vesting, staking), bugs can be exploited.
Impact: Loss of tokens, incorrect supply, or unauthorised access.
Mitigation: Audit all smart contracts by reputable security firms. Use established frameworks where possible.
Social Engineering
Threat: Attackers impersonate support staff, team members, or partners to gain access.
Impact: Disclosure of private keys or approval of harmful transactions.
Mitigation: Verify identities through official channels. No legitimate support will ask for private keys.
Post-Launch Security
After creating your token, ongoing vigilance is required.
-
Monitor on-chain activity
Use Solscan or Solana Explorer to watch for unexpected mints, authority changes, or large transfers.
-
Set up alerts
Use services like Helius or QuickNode to receive notifications for on-chain events (mints, burns, authority updates).
-
Audit smart contracts
If your token uses custom programs (staking, vesting), hire a reputable auditor (Halborn, OtterSec, Trail of Bits) before mainnet deployment.
-
Communicate authority decisions
Clearly document whether mint or freeze authorities are revoked. Publish this information on your website and social channels.
-
Back up authority wallets
If you retain authority, ensure multiple secure backups of the wallet controlling it. Loss of the wallet means permanent loss of control.
Pre-Launch Security Checklist
Complete these steps before launching your token publicly:
- Seed phrase stored securely offline (paper backup in safe location)
- Hardware wallet configured for high-value authority wallet
- Multi-signature wallet set up for team-managed authorities
- Mint authority decision finalised (retain, revoke, or transfer to DAO)
- Freeze authority decision finalised and communicated
- Token metadata (name, symbol, image) verified and correct
- On-chain monitoring tools configured (Solscan, Helius alerts)
- Smart contracts (if any) audited by reputable firm
- Authority status documented publicly on website or GitHub
- Team trained on phishing, social engineering, and wallet security
Incident Response
If you suspect a security breach:
-
1
Secure Your Wallet
Move funds and authorities to a new, secure wallet immediately. Do not delay.
-
2
Revoke Compromised Authorities
If the attacker gained mint or freeze authority, revoke it immediately if you still have access.
-
3
Communicate with Community
Alert token holders via official channels. Be transparent about what happened and steps taken.
-
4
Document and Report
Preserve evidence (transaction signatures, wallet addresses). Report to Solana security teams and relevant authorities if fraud occurred.
-
5
Review and Strengthen Security
Identify how the breach occurred. Implement additional safeguards (hardware wallet, multi-sig, stricter access controls).
Security Resources
-
Solana Security Documentation
Official guides on wallet security, transaction verification, and best practices.
-
Audit Firms
Halborn, OtterSec, Trail of Bits, Neodyme for smart contract audits.
-
Community Resources
Solana Discord, Stack Exchange, and security-focused communities for advice.