Security

Check it,
don't trust it

Every Solana program your wallet will be asked to sign for, the contracts that are ours on EVM chains, the address the platform fee goes to, and the things we never receive. Each one is on-chain, so you can verify all of it without taking our word.

The short version

Your wallet signs, we never hold

There is no account to create and no key to hand over. Every action that moves a token or costs money is a transaction your own wallet builds a prompt for, shows you, and sends only if you approve it.

What we never receive. Your private key or seed phrase, at any point, for any reason. Nothing on this site will ever ask for either, and any page that does is not us. We also cannot move a token after you own it, cannot reverse a transaction you signed, and cannot sign anything on your behalf.

Approvals

How many prompts to expect

Worth knowing before you connect, because an unexpected extra prompt is indistinguishable from an attack.

Solana deployThree: the mint, the metadata, then your supply with the platform fee and any authorities you chose to give up. A pool made with the deploy adds up to two more: the pool, then its lock or burn
EVM deployOne signature, because the supply, the fee and the ownership renounce all happen in a single contract creation. A pool made with the deploy adds up to four more, listed on the Review screen
Network switchNot a transaction, and costs nothing
Read-only toolsNo wallet, no signature, no fee
If you stop partway through a Solana deploy, the token exists but is not finished: the metadata or the supply may be missing. Nothing is lost and the console can finish the remaining steps without charging the fee again, but do not treat a partial run as a completed one.

Program registry

The code that actually runs

8 of the 9 programs below were written by somebody other than us, and each card says who audited it where we can point to one. Paste any address into an explorer to confirm it is what we say.

SPL Token

Creates the mint, holds the authorities, and moves, mints, burns and freezes balances. A standard Solana token is this program and nothing else, which is why a deploy here involves no contract of our own.

Written bySolana
Audited byPart of Solana itself
ReportNone applicable
Reachable onmainnet and testnet
DocumentationOfficial docs

Token-2022

The extended token program. Used only where a tool needs an extension the original cannot express, such as the transfer fee behind the Tax Token creator.

Written bySolana
Audited byPart of Solana itself
ReportNone applicable
Reachable onmainnet and testnet
DocumentationOfficial docs

Associated Token Account

Derives the standard account a wallet holds a given token in. Every distribution tool uses it so tokens land where wallets already look.

Written bySolana
Audited byPart of Solana itself
ReportNone applicable
Reachable onmainnet and testnet
DocumentationOfficial docs

Metaplex Token Metadata

Writes the name, symbol and metadata link on-chain. This is the record wallets and explorers read to show your token's name and logo.

Written byMetaplex
Audited byNot listed here: see their documentation
ReportNot listed here
Reachable onmainnet and testnet
DocumentationOfficial docs

Jupiter Lock

Holds vested, locked and claimable tokens in escrow and releases them on a schedule. Used on Solana by Token Vesting, the Liquidity Locker and the Claim Site. Tokens locked through them leave the wallet you control and sit under this program until they unlock.

Written byJupiter
Audited byOtterSec and Sec3
ReportLink outstanding
Reachable onmainnet and testnet
DocumentationOfficial docs

Meteora Presale

Escrows presale contributions, refunds them in full if the minimum is missed, and releases them to the creator only after a successful sale. We never hold contributions and cannot release them.

Written byMeteora
Audited byOffside Labs and Sherlock
ReportLink outstanding
Reachable onmainnet and testnet
DocumentationOfficial docs

Raydium CPMM

Creates liquidity pools and adds or removes liquidity: Create Liquidity Pool, Add / Remove Liquidity and the deploy console's pool step. A pool's reserves sit under this program, not with us.

Written byRaydium
Audited byNot listed here: see their documentation
ReportNot listed here
Reachable onmainnet and testnet
DocumentationOfficial docs

OpenBook

Creates the order-book market an older Raydium pool type needs, for the OpenBook Market tool. The market is created with no authority over it, ours or anyone else's.

Written byOpenBook
Audited byNot listed here: see their documentation
ReportNot listed here
Reachable onmainnet and testnet
DocumentationOfficial docs

Our own code

The part that carries our risk, not theirs

Everything above is somebody else's program. This is ours, and it is held to a different standard because of it.

DeployAToken Staking

Our own staking program, and the only code on this list that we wrote. It holds stakers' tokens. Our review of 28 September 2026 found problems in it; the fixed version is tested on devnet before mainnet gets it, and the console refuses mainnet for it until then regardless of what this page says: see stakingAvailable() in lib/staking.ts.

Written byDeployAToken
Audited byNot yet audited
ReportNone applicable
Reachable ontestnet only
Not offered on mainnet yet. Our staking program holds other people's tokens, so the console keeps it to testnet until its fixes have run on devnet and the mainnet program has been upgraded to a build checked against its source. It is refused on mainnet in code, not by policy, and none of this is an independent audit.
On EVM chains the contracts are ours, and none has been independently audited. Every EVM token deployed here is our own token contract. Vesting on an EVM chain holds the locked tokens in our own lock contract, which pays out only to its recipient: nothing in it lets us, or anyone else, move them. The EVM Multisender sends through our own contract.

Where the money goes

One address per kind of chain, shown before you sign

On Solana the platform fee is a separate, clearly labelled instruction in the transaction. On an EVM chain it is sent with the contract's creation, as its value, and the review screen names the amount and the address it goes to. Either way it is never folded into the network fee estimate, and it is visible on-chain the moment it is paid.

Solana deploy fee0.5 SOL
Solana surcharges0.1 SOL for each authority given up in the deploy, 0.01 SOL for a chosen address
Creating the tokenAbout 0.02 SOL of rent and Metaplex's own fee, none of it ours
TestnetFree. The fee is zero and no transfer is built.
EVM mainnet deploysEnabled
Check the address character by character. Lookalike addresses that match at the start and end are a known attack on Solana, and ours has been targeted. The addresses above, one per kind of chain, are the only ones we use. If a page, a message or a support account gives you a different one, it is not us.

Data

What touches our servers

Token logo and metadata fileStored by us and served over HTTPS. Your token's on-chain record points at that link.
RPC callsProxied through our service so an API key is not exposed in your browser. It carries the request, not your keys.
Private keys and seed phrasesNever. There is no code path that receives one.
Custody of your tokensNever by us. Tokens you deliberately lock are held by a program or contract instead: on Solana, Jupiter Lock (Vesting, Liquidity Locker, Claim Site) and Meteora's presale program (Presale); on EVM chains, our own vesting lock contract (Vesting), which has not been independently audited.

Disclosure

Found something?

If you have found a way to lose someone else's money using this site, we want to hear about it before anyone else does. Please report it privately first and give us a chance to fix it.

A private reporting channel is not published yet. We do not run a paid bug bounty today, and saying so is more useful than implying one exists.

Rehearse it for free first

Flip the console to testnet and run the whole flow, wallet approvals included, before spending anything on mainnet.

Open Deploy →