Name and metadata can be changed
The update authority can still rewrite the token name, symbol and image.
Why it matters
A token can be renamed into an impersonation of something reputable after people have bought it.
- Severity in our model
- Warning
- Applies to
- Solana
- Where we read it
- Contract analysis (GoPlus Security)
- Tokens we found it on
- 412 tokens of 5,361 checked
Tokens where we found this
From the tokens we have checked, most traded first. A finding on this list is a property of the contract or the pool — read the token's page for the full picture before drawing a conclusion.
- cbBTCCoinbase Wrapped BTCSolana · $8.83MSome risk
- KMNOKaminoSolana · $1.94MSome risk
- CARDSCollector CryptSolana · $4.1MSome risk
- PRIMEPRIMESolana · $9.8MSome risk
- USD1World Liberty Financial USDSolana · $9.9MSome risk
- NVDAxNVIDIA xStockSolana · $3.06MSome risk
- EURCEURCSolana · $566.5kSome risk
- SISuper InuSolana · $678.8kSome risk
- BPBackpackSolana · $5.87MSome risk
- JLPJupiter Perps LPSolana · $2.22MSome risk
- JUPJupiterSolana · $2.05MSome risk
- AUTOHastra AUTOSolana · $3.57MSome risk
- STRKSTRKSolana · $695.1kSome risk
- PYTHPyth NetworkSolana · $429kSome risk
- HOOKEDHookedSolana · $108.3kSome risk
- JTOJITOSolana · $1.2MSome risk
- SPCXxSpaceX xStockSolana · $1.03MSome risk
- BonkBonkSolana · $327.4kSome risk
- RENDERRender TokenSolana · $422.3kSome risk
- 2ZDoubleZeroSolana · $709.7kSome risk
- ENAEthenaSolana · $111.5kSome risk
- ANTHROPICAnthropic PreStocksSolana · $389.6kSome risk
- SPXSPX6900 (Wormhole)Solana · $1.97MSome risk
- mSOLMarinade staked SOL (mSOL)Solana · $1.83MSome risk
- WBTCWrapped BTCSolana · $430.4kSome risk
Who holds this power, and when it matters
This is a capability, not an event: nothing has happened to the token because of it. What it means is that a specific address can decide something about your holding later. On a regulated issuer — a stablecoin, a bank-issued token — that power is usually disclosed policy, used to comply with court orders, and the issuer has a name and an address. On an anonymous token it is the piece that turns a normal-looking launch into a trap once enough money is in. The question worth asking is not "does the power exist" but "who holds it, and what do they lose by using it".
What to check next
Look at whether ownership has been renounced, and whether it can be taken back. A renounced contract with no hidden owner cannot use owner-only powers at all — we mark that on the token page when it applies. Then look at how the supply is distributed: a power in the hands of someone who also holds most of the tokens is a much shorter path to a loss than the same power held by an issuer with a business to protect.
How to check it yourself
Everything we report can be verified without us. Open the contract on the block explorer for its chain, read the verified source if there is one, and look at the holders tab: who holds the supply, whether the pool tokens sit in a lock contract or a personal wallet. For market data, compare the pool size with how much actually trades — a pool nobody trades in is a number, not an exit.
If you are about to buy, the cheapest test is the smallest one: buy a tiny amount, then immediately try to sell it. A contract that blocks selling will tell you so for a few dollars instead of everything you were about to put in.
Related checks
- Custom transfer hook Every transfer calls custom code before it completes.
- Trading cooldown The contract enforces a waiting period between trades for the same wallet.
- More tokens can be minted The supply is not fixed: an authority can create new tokens at will.
- Upgradeable contract (proxy) The contract is a proxy: the logic behind it can be replaced later.
- Maximum trade size can be changed The owner can change the limit on how much can be traded in one transaction.
- Transfer fee on every move The token charges a fee on each transfer, held by the token extension.
Questions
What does "Name and metadata can be changed" mean on a token?
The update authority can still rewrite the token name, symbol and image. A token can be renamed into an impersonation of something reputable after people have bought it.
Does it mean the token is a scam?
No. It is a property of the contract or a fact about the market, read from a public source at a point in time. On its own it does not stop you selling. It is context, and it matters most alongside the other findings on the token page.
Where do you read it from?
From contract analysis (GoPlus Security), which reads the deployed contract and its authorities directly on chain.
All checks · how the verdict is calculated · tokens we have checked