How can you check (programatically) that an SPL token has not been extended or modified beyond the standard custom parameters such as Symbol, Name and Supply etc available in an SPL token.

I want to be able to check if a token is using the stock code, or has custom code that could potentially be malicious.

1 Answer 1


On Solana, state and program logic are separated into different accounts, so just about everyone uses the same SPL token program deployment for their tokens. As long as the account's owner is TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA, you can be sure that it hasn't been modified.

The token-2022 program allows for certain "extensions" to exist on token accounts and mints. If you don't want mints to have certain extensions, then you can check and block those as you want, ie:

            let mint_data = mint_info.try_borrow_data()?;
            let mint = StateWithExtensions::<Mint>::unpack(&mint_data)?;

            for extension in mint.get_extension_types()? {
                if extension == ExtensionType::<PUT_THE_EXTENSION_HERE> {

You can learn more about spl-token at https://spl.solana.com/token and spl-token-2022 at https://spl.solana.com/token-2022

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.