Audits
Token Security Audits
What a security audit does and does not tell you about a token, what you can verify yourself for free in a couple of minutes, and how projects launched with MoonSol can list an independent audit here.
Submit your audit
Projects launched with MoonSol can list an independent audit here. Send us the report, the auditing firm, and your mint or contract address so the audited code can be matched to the deployed token.
Contact usWhat you can verify yourself, free, in two minutes
Before anyone thinks about an audit, most of the questions a buyer will ask are already answered on a block explorer. Open your token on Solscan, Etherscan, BscScan, or the Sui explorer and check these:
- Mint authority or mintability — can more supply be created? On Solana the mint authority field should read null for a fixed-supply token; on EVM the contract should be non-mintable or ownership renounced; on Sui the TreasuryCap should be destroyed.
- Freeze authority, pausing, and blacklists — can the issuer stop you from selling? Live freeze authority on Solana also blocks Raydium pool creation.
- Metadata mutability — can the name, symbol, or logo be swapped after you buy?
- Liquidity depth — is there enough in the pool that a normal trade does not move the price wildly?
- LP token status — are the LP tokens held by the deployer, timelocked, or burned? This is the single strongest indicator of whether liquidity can be pulled.
- Holder distribution — does one wallet hold a share of supply large enough to end the market on its own?
None of this requires a paid report, and a token failing these checks will not be rescued by one.
What an audit adds — and what it does not
What it covers
An audit is a review of the code you deployed against the behaviour you claim. Auditors look for logic errors, access-control mistakes, reentrancy and arithmetic issues, upgradeability and admin risks, and discrepancies between documentation and implementation. For anything with custom logic — taxes, vesting, staking, a bespoke contract — that review has real value.
What it does not cover
An audit is not a guarantee of safety and says nothing about whether the team will behave well. It does not stop a deployer pulling liquidity, does not assess the business, and is a snapshot of one code version at one point in time. Audited projects have failed for reasons entirely outside the audited code.
When it is worth paying for
- Your token has custom logic beyond a standard mint — taxes, reflections, vesting, staking, or a protocol around it.
- You hold user funds in a contract, which raises the cost of a bug from embarrassing to catastrophic.
- A listing venue, launchpad, or investor requires one as a condition.
- Your contract is upgradeable, so holders need to understand what an admin could change.
For a plain fixed-supply token deployed from standard code, your money usually does more for the project in the liquidity pool than in an audit report.
Token audit FAQ
01Does MoonSol audit the tokens created on it?
No. MoonSol deploys standard token code — SPL mints with Metaplex metadata, OpenZeppelin-based ERC-20 contracts, and standard Move coin packages — but it does not audit individual projects, and an audit is not implied by launching here. Anyone claiming a launch platform audits its tokens is misrepresenting what a launch platform does.
02Do I need an audit for a simple token?
Usually not. A plain fixed-supply token deployed from standard code has very little custom logic to audit. An audit becomes worthwhile when you add custom behaviour — taxes, vesting, staking, a bespoke contract — or when a listing venue or investor requires one.
03What does a token audit actually cost?
It varies by scope and firm, from a few hundred dollars for a short review of a standard contract to five figures for a complex protocol. Beware of very cheap 'audits' that are automated scanner output with a logo on top — they carry no assurance and reviewers recognise them.
04What can I verify myself without paying anyone?
Most of what buyers care about. Authority and ownership state, supply, metadata mutability, liquidity depth, and whether LP tokens are held, locked, or burned are all public on a block explorer. Check those before you consider paying for a review.
05How do I list my audit here?
Contact us on X (@moonsol) with the audit report, the firm that produced it, and your token's mint or contract address so it can be verified against the audited code.