Skip to content

Check a coin yourself

Paste a coin's mint. This page derives the coin's vault addresses in your browser, reads them from the Solana RPC you choose, and tells you whether its creator fees and dev bag are behind a hash-based vault. After it loads, it asks our server for nothing.

A public mainnet endpoint is the default and is rate limited. If it refuses, a second public one is tried. Any RPC works, including your own node. The answer is only as honest as the RPC, so compare two if it matters.

Vault program and multisig

Every address on this page is derived from this id. Compare it with the one in the docs and on Solscan before you rely on a result.

If the program is upgradeable, the chain shows one authority address. With the multisig's address this page proves, by derivation, that the authority is that multisig's vault, then reads its signer threshold and time lock.

iWhat the checks mean

Sealed means three things are true on chain at once: the vault program holds a Launch record for the mint, that record names a real vault whose address commits to its public key, and pump.fun's fee-sharing config for the coin is locked with the vault's owner address receiving at least half of creator fees. That is the same rule the Hashlock site uses for its Sealed badge.

The dev bag, the program's upgrade authority and the one-time key count are reported next to the verdict. They do not change it, and they are never hidden inside it.

  • pass the chain shows it.
  • fail the chain shows the opposite. The verdict names the first failed check.
  • ? it could not be read. Nothing is assumed.
  • note and warn a fact you should weigh, such as an empty dev bag or a program that can still be upgraded.

iiWhat the result depends on

  • The RPC. It answers every read. A dishonest RPC can show accounts that do not exist. Use your own node, or run the check against two providers.
  • The program id. A Launch record under some other program proves nothing. The id is prefilled from this site when it can be, and you can type your own.
  • This page's code. It is two plain files, ent-verify.js and the program's client at /pq/client/ix.js. The docs list a dozen lines that do the same reads without this page.
  • pump.fun and the vault program. What a locked split and an upgrade authority mean for you is in the threat model.
Read the protocol Recovery page