// Research · 2026-09-28

The key does not say whose it is.

A rug check that refuses any token whose issuer can still mint, freeze, seize, pause or tax it fails 48 of Jupiter’s 100 most-traded Solana tokens. It fails 80 of 1,442 tokens whose first pool opened in a 40-minute window, 5.5%. On 2026-09-28 it refused the most-traded tokens at 8.65 times the rate of tokens that were minutes old.

Jupiter’s most-traded list leaves out stablecoins and other “generic” tokens. With them put back, 60 of 100 fail, including USDC (#2 by 24-hour volume), USDT (#3) and PYUSD (#24). All 21 tokenized stocks in the list fail. None of the 1,442 new launches had a live mint or freeze authority.

The rules come from real scams. In April 2024, BONKKILLER’s creator reportedly used the freeze authority so buyers could not sell. In a September 2024 post, a member of Jupiter’s Core Working Group reported that a buyer of a token called RED saw its permanent delegate burn the tokens seven seconds after the swap. The issuers of the most-traded dollars and stocks on Solana hold the same powers by design, and Circle, Tether and Paxos use them. The mint records the key. It does not record who holds it.

The measurement

We read three sets of tokens from Solana mainnet on 2026-09-28, between 16:06 and 16:42 UTC. The first is Jupiter’s toptraded/24h list, exactly as the API serves it. The second rebuilds that list without the API’s filter by adding back verified tokens, ranked on the same 24-hour volume. The third is a census of new launches from Jupiter’s recent endpoint: 1,442 tokens whose first pool opened between 16:00:49 and 16:40:49 UTC. Our polling missed two stretches of that window, 62 seconds from 16:09:11 and 10 seconds from 16:08:35. At the median rate of 34 launches a minute, that is roughly 40 launches we did not see.

A token fails if any one of eight rules holds. Each rule reads one field on the mint account.

The gap between the most-traded list and new launches is 42.5 percentage points (Newcombe 95% CI 32.8–52.2). With the filtered tokens restored, it is 54.5 points (44.6–63.6).

The two sides fail for different reasons. 41 of the 48 top-100 failures involve a live mint or freeze authority, and the other 7 fail on a transfer fee alone. None of the 80 new-launch failures involves either authority: 78 are transfer fees and 2 are transfer hooks.

What fails is what the market trades

We gave each of the 48 failing tokens a class. The evidence was Jupiter’s tags and launchpad field, the token’s on-chain metadata, the authority keys it shares with other mints, and issuer or press pages.

All 21 tokens that Jupiter tags stocks fail, and 19 of them fail four rules at once. Every one of the 41 live mint authorities and 27 live freeze authorities on the list belongs to a verified token. The six unverified failures fail on a transfer fee alone: five are StonkFun launches, and the sixth is AQUA, which we could not classify. On this list, Jupiter verification goes with failing the check, not with passing it.

The stablecoins are missing because Jupiter’s docs say its category endpoint “filters out generic top tokens like SOL, USDC, etc”. 23 verified tokens with at least as much 24-hour volume as the list’s #100 were absent, and 22 of them carry a stable, major, LST or yield tag. Re-ranking brings 19 of them into the top 100. 18 of those 19 fail. The one that passes is wrapped SOL. The restored failures include all seven fiat- or reserve-backed stablecoins in the set (USDC, USDT, USDG, PYUSD, USD1, CASH and JupUSD), Wormhole’s ETH and WBTC, and two liquid-staking tokens.

The tokens, and who holds the keys

The table lists the notable failures, the powers read from each mint, and the kind of account behind each key. “Wallet-type” means a key on the ed25519 curve, owned by the System Program, with no data, which is the same shape as an ordinary wallet. Volume is Jupiter’s 24-hour buy plus sell volume.

The issuers say why they hold these powers. PayPal calls PYUSD’s permanent delegate “critical for regulatory purposes, as it allows for seizing funds as required by law enforcement”. It says the transfer hook was “initialized for PYUSD for potential future use only” and describes the fee as “a fail-safe and initialized to 0”. The Solana Foundation’s xStocks case study says the delegate gives Backed “ongoing rights to transfer or burn tokens from any address without requiring user-level permissions”, and that pausing is for “emergencies, regulatory requirements, or security incidents”.

Bridged assets fail for a structural reason. The key that mints Wormhole’s SPX is the same program-derived address that mints Wormhole ETH and WBTC. The power belongs to the bridge.

What new launches carry instead

New launches are cleaner than blue chips on the mint, freeze, delegate and pause rules. 0 of 1,442 had a live mint authority, and 0 had a live freeze authority (upper 95% bound 0.27% for each). None had a permanent delegate, a pause switch, default-frozen accounts or a non-transferable flag. By the time we read them, 23 seconds to 23 minutes after their first pool, no launch had either authority. pump.fun produced 1,198 of the 1,442 launches and contributed no failures at all.

Almost every failure is a StonkFun “reward launch”: a Token-2022 mint that charges a fee on every transfer. 75 of the 76 have the same fee-config authority, WLHv2U…. It is an off-curve address with no account, so only the program that derived it can sign for it, and it also sets the fee on the one Raydium LaunchLab failure. All 76 send withheld fees to one wallet-type withdraw key, 5KXDF6…, which is also the withdraw key on the six StonkFun tokens in the top 100 and sets the fee on five of them. The fee is disclosed at launch, and whether a 1% fee is acceptable is the buyer’s call. What the rule does see correctly is that on 77 of the 78 fee failures, an address other than the holder can change the fee. The exception is the no-launchpad token, whose 500 bps fee has no authority and is fixed. On Token-2022, a new fee takes effect two epochs after it is set.

The two hook tokens are the sharper case. MOIN and RUPEE run a program on every transfer, and if the hook returns an error, the transfer fails. They share one hook authority. MOIN’s hook program is immutable, and RUPEE’s can still be upgraded. MOIN also shares its ticker, and nearly its name, with moin, a top-100 token that passes every rule. Jupiter’s token record shows mint and freeze disabled for both. That is accurate, and it says nothing about the hook. We did not analyse what either hook program does.

A check that reads only the mint and freeze authorities passes all 80 new-launch failures.

The powers are held, and used

None of this means the issuers’ powers sit idle. We counted frozen token accounts for USDC, USDT and PYUSD at about 16:03 UTC, and for USDG and three xStocks at 17:16 UTC.

The largest is a USDT account that received 27,549,942.07 USDT at 03:11:17 UTC on 2022-11-12. Tether’s 2-of-3 multisig froze it at 06:26:36 UTC, and it is still frozen with the full balance. Cointelegraph reported that day, citing the investigator ZachXBT, that Tether had blacklisted $27.5 million of USDT on Solana after FTX’s alleged hack. The amount matches.

USDC and USDT run on the classic SPL Token program, which can freeze a balance but cannot move it. PYUSD, USDG, CASH, sUSDai and 20 of the 21 tokenized stocks are Token-2022 mints with a permanent delegate. The Solana docs describe this as “a mint level authority that can authorize transfers and burns for any token account for that mint”, and holders cannot revoke it. On 2026-04-17 at 20:04:35 UTC, PYUSD’s delegate key was the only signer on a transfer of 450,030.24 PYUSD out of a holder's token account. The account’s owner did not sign. Seventy seconds later, the same key froze the emptied account. We found no public report of the case and do not know the reason for it. Paxos’s terms say seizure “may not occur under any circumstances absent such a legal directive”, and that seized funds go “to a segregated wallet address held by Paxos”.

Fee authorities act too. PreStocks’ ANTHROPIC token charged 100 bps from epoch 1039. Its fee authority raised that to 300 bps from epoch 1043, and we read it in epoch 1044.

What separates these holders from BONKKILLER’s creator is not written on the mint. It is written in their terms. Circle’s access-denial policy allows blocking where Circle determines, in its sole discretion, that the security, integrity or reliability of its network is threatened (its example is a compromised privileged key such as the minter key); to comply with legal orders from U.S., French or other authorities with jurisdiction over Circle; and for certain urgent law-enforcement, sanctions or national-security requests and court orders pending a Mutual Legal Assistance Treaty process. Paxos ties seizure to a legal directive, and freezes to a legal directive or “a formal notification by a Paxos partner according to previously agreed contractual terms”. Tether’s terms allow a freeze “as required by applicable Law or where Tether, in its sole discretion, determines it is prudent to do so”. Circle and Tether both reserve some discretion, Circle for threats to its network and Tether wherever it judges a freeze prudent. The conditions differ even among known issuers.

What the chain records about the holder

For a check to treat Circle’s freeze key differently from a stranger’s, something has to tell the two apart. We looked for it on-chain. The base mint layout is 82 bytes, and each authority slot is a 4-byte flag and a 32-byte key: no issuer and no reason. In the 82-byte base of USDC, USDT, PYUSD and three new mints, there is no field that records who holds a key or why. Metadata can name the token. PYUSD’s own Token-2022 metadata says “PayPal USD” and points to token-metadata.paxos.com, and USDC’s Metaplex metadata says “USD Coin”. But the holder of the update key writes that metadata, and for PYUSD that is 2apBGM…, the same key that freezes and seizes. Any new mint can carry the same name and point to the same URL, and nothing in the metadata says who holds the freeze or delegate key.

What can be read is the kind of account behind the key.

The multisigs behind USDC and USDT are a real difference in how the key is operated. They say nothing about who operates it, because anyone can create an SPL multisig for about 0.00245 SOL. Nor is the multisig the norm among issuers. Four of the seven stablecoins, PYUSD among them, hold their freeze authority on a wallet-type key, and PYUSD and USDG share theirs. PYUSD’s key also holds the permanent delegate, so freeze and seize sit on one wallet-type key. It is the same kind of key that 89 of the first 100 new-launch creators used.

No new launch in the window kept a freeze authority, so there was no direct specimen to set beside USDC. The comparison is between kinds of key. The kind of key tells you how a power can be exercised, but not who exercises it.

How existing scores tell them apart

Tools that grade tokens face the same problem. The ones we could query without a key appear to separate issuers by identity, not by their powers. RugCheck’s public API returned these results on 2026-09-28:

PYUSD and USDG have the same Token-2022 extensions, and the same key is the freeze authority and permanent delegate on both. One scores 1 with no risks. The other scores 81 with four danger flags, three of them for powers PYUSD also has, and two warnings (fee config, mutable metadata) that apply equally to PYUSD. The fourth danger flag is top-10 holder concentration. The difference is not in the powers, so it comes from something else, most likely a list of exempted tokens. It is not Jupiter’s strict tag alone: PYUSD is strict-tagged and USDG is not, but WETH and WBTC are strict-tagged and still flagged. We found no documentation of such a list and would welcome a correction from RugCheck.

GoPlus makes the distinction explicit. For the four tokens we queried, it reports the raw powers, USDC’s included, plus a separate trusted_token flag. Its docs define that flag as “If the token is a famous and trustworthy one”. It was 1 for USDC and PYUSD, and 0 for USDG and TSLAx.

Jupiter’s token record carries mintAuthorityDisabled and freezeAuthorityDisabled. Wherever those fields were present, they matched the chain: 1,501 mint and 1,515 freeze readings with no disagreement. Where an authority was live, the field was absent rather than false (41 mint and 27 freeze cases). A client that reads a missing field as true will score those tokens wrongly. The record has no field for a permanent delegate.

Method

Everything below runs against public endpoints with no API key.

# 1  most-traded, as served                      2026-09-28T16:01:35Z
GET https://lite-api.jup.ag/tokens/v2/toptraded/24h?limit=100
#    volume = stats24h.buyVolume + stats24h.sellVolume

# 2  restore what the endpoint filters out       16:02:51Z
GET https://lite-api.jup.ag/tokens/v2/tag?query=verified        # 3,704 tokens
#    union with (1), rank by the same volume, keep 100: 19 restored

# 3  new launches, first pool 16:00:49Z to 16:40:49Z
GET https://lite-api.jup.ag/tokens/v2/recent                    # always 30
#    74 responses: 2 initial calls 1 s apart (16:01:35Z),
#    12 polls 40 s apart (16:01:54Z-16:09:18Z), a 100 s pause,
#    60 polls 30 s apart (16:10:58Z-16:40:54Z); 73 usable, 1,442 mints
#    first-pool gaps: 16:08:35Z-16:08:45Z and 16:09:11Z-16:10:13Z
#    creator keys: the "dev" field of the first 100 new launches
GET https://api.geckoterminal.com/api/v2/networks/solana/new_pools?page=1..10
#    cross-check: 200 pools, 139 base tokens

# 4  on-chain: https://api.mainnet-beta.solana.com  (solana-core 4.3.0)
getMultipleAccounts(mints, {encoding: "jsonParsed", commitment: "confirmed"})
#    at most 100 per call, 1 s apart, back-off on 429/5xx; 1,676 mints
getEpochInfo                                  # epoch 1044: picks the live fee
getMultipleAccounts(keys, {encoding: "base64", dataSlice: {offset: 0, length: 0}})
getMultipleAccounts(multisigs, {encoding: "jsonParsed"})       # m-of-n
getMultipleAccounts(metadataPDAs)             # seeds: metadata, program, mint
#    isMutable = the byte after primarySaleHappened
getMinimumBalanceForRentExemption(355)        # SPL multisig: 2,453,640
getProgramAccounts(tokenProgram, {filters: [
  {memcmp: {offset: 0,   bytes: MINT}},
  {memcmp: {offset: 108, bytes: "3"}}]})      # state byte 2 = frozen
#    plus {dataSize: 165} on the classic program
#    USDC, USDT, PYUSD at ~16:03Z; USDG, TSLAx, AAPLx, SPYx at 17:16Z

# 5  the PYUSD and USDT transactions
getSignaturesForAddress("2apBGMsS6ti9RyF5TwQTDswXBWskiJP2LD4cUEDqYJjk")
getSignaturesForAddress("EdP6JNB26MrKzfsieCPz593VUgrDrpziQKstzCAFvNBP")
getTransaction(sig, {encoding: "jsonParsed", maxSupportedTransactionVersion: 0})
#    PYUSD transfer  2EoBhRCgGGo58z6tSnFQc7KJi6TyKNYXhnV7yZiQKdrs1d4UcqqrgwrAEwXye1Hnqs3ke7jWs5dM82DWhhZcwik
#    PYUSD freeze    4jcPKDW2otgJo8vKKSoqnpvwDEHdqNzQhoT9srkqLJYZ1iV2KN2YG6GfvNi6hW9XY3bsiVCMRT5Gm2hT8ZurZhL7
#    USDT deposit    3GagAe398nbLxSs1KhcRRbvPEkmrZmcDWJ1RpvP39hLPsBGCNcwnP3QZLSGDKCdiwryWgSShQJqRnWcZ1cdTz3kz
#    USDT freeze     5vQBXFxiSgufuLUpm6ugfxynd43P8tAa94SDeqtFvvvqzXa1DW8us4GRM3MS4QFnvcSHqD9DNPihuqnYJ9GbY7Qh

# 6  a token FAILS if any of these holds
mintAuthority != null
freezeAuthority != null
permanentDelegate.delegate != null
transferHook.programId != null
pausableConfig present                        # paused or not
defaultAccountState == "frozen"
nonTransferable present
transferFeeConfig current bps > 0

Two API behaviours change the answer if you miss them. Jupiter’s toptraded drops “generic” tokens, so a volume ranking built on it silently leaves out the tokens most exposed to issuer powers. Jupiter’s recent ignores limit and always returns 30 tokens, which covered 26 to 77 seconds of first-pool time per response (median 47). A census therefore has to poll, and consecutive polls have to overlap. Check the overlap against the first-pool times, not the poll schedule: ours looked continuous and was not. One of our 74 responses was rate-limited and skipped, and the polls on either side of it overlap. Separately, tag?query=stocks returned HTTP 200 with a 400 body (“Invalid tag provided.”) even though the docs list that tag, so we used each token’s own tags.

The on-curve test decompresses each key as an ed25519 point. A key on the curve can have a private key, and a key off it is a program-derived address. We validated the test on 258 creator signer keys, all on-curve, and on 37 Metaplex metadata PDAs derived with the same code, all of which exist. The current transfer fee is newerTransferFee if the current epoch is at or past its epoch, and olderTransferFee otherwise. We re-read all 1,676 mints at 16:41:33–16:41:56 UTC, and no authority, extension or verdict had changed.

Shares use Wilson 95% intervals, and differences between sets use Newcombe’s method 10. Each failing token’s class comes from Jupiter’s tags and launchpad field, its on-chain metadata URI, the authority keys it shares with other mints, and issuer or press pages found on 2026-09-28. RugCheck was read at api.rugcheck.xyz/v1/tokens/MINT/report and /report/summary, and GoPlus at api.gopluslabs.io/api/v1/solana/token_security.

Limits

The list as served has no stablecoins in it. We expected regulated stablecoins to lead the failures. On Jupiter’s list they are absent because the endpoint filters them out, and our first tally showed none among the 48 failures. That looks like a finding but is an artifact of the endpoint. The rebuilt list corrects for this, but it can only restore tokens in Jupiter’s verified list of 3,704. Unverified tokens the filter hides, if there are any, are still missing. The 19 restored tokens’ volumes come from a fetch 76 seconds later. For the 62 tokens in both fetches, volume differed by a median 0.04% and at most 3.8%.

The census has gaps. recent returns only the newest 30 tokens, so the census is complete only where consecutive polls overlap in first-pool time. Two boundaries did not overlap: 16:09:11–16:10:13, which fell in the 100-second pause between our two polling runs, and 16:08:35–16:08:45. Four more met with gaps of 0 to 3 seconds and could hide a few more tokens. At the median rate of 34 launches a minute, roughly 40 launches are missing. With 40 more tokens, the share would be 5.4% if none of them failed and 8.1% if all did. The census also covers only tokens Jupiter’s endpoint listed. We did not measure what the endpoint leaves out.

The ranking is inferred. Jupiter does not document what toptraded ranks by. Its order is non-increasing in 24-hour buy plus sell volume for all 99 adjacent pairs, so we used that. The filter’s rule is undocumented too. 22 of the 23 excluded tokens carry a stable, major, LST or yield tag, and xSOL does not.

One snapshot. The data covers one 24-hour window ending about 16:01 UTC, and a 40-minute census on a Monday afternoon UTC. pump.fun made 83% of the launches in that window, and both that mix and StonkFun’s share change from hour to hour. New tokens were first read 23 seconds to 23 minutes after their first pool (median 7 minutes) and re-read up to 41 minutes after it. Any changes after that were not observed.

Not random samples. Neither top list is a random sample, and the fresh set is a time-window census. The intervals therefore measure binomial noise, not sampling from a defined population.

Powers, not intent. The rules count what a key can do. “Pausable” counts the extension, and none of the 22 pausable mints in the top 100 was paused. Some powers sit outside the rules. 23 of the top 100 carry an empty transfer-hook slot with a live authority, so a hook can be added later. 28 of the 63 Token-2022 mints carry embedded metadata with a live update authority, and 24 of the 37 classic mints carry Metaplex metadata marked mutable.

Classification. Several class facts come from search-result summaries rather than primary pages: HYPE via Wormhole NTT, PEAQ via LayerZero, Tessera’s 0.2% fee, and StonkFun’s 1% and 3% reward-launch fees. We did not identify the bridge programs for Cake, XMR and PEAQ on-chain, and AQUA is unclassified. Calling USDT, USD1, CASH and JupUSD stablecoins rests on issuer and press descriptions, and we verified no licence. JupUSD’s issuer is a DeFi protocol with Ethena-managed reserves. isVerified values of null and false are pooled as not verified. We read published terms for Circle, Tether and Paxos, PayPal’s developer description of PYUSD, and the Solana Foundation’s case study on Backed’s xStocks, and nothing for the other issuers in the tables.

Third-party readings are dated. The RugCheck results cover the nine tokens listed above, and the GoPlus results cover four, all read on 2026-09-28. Scores can change, and the exemption list is our inference from their outputs. The frozen-account census is a snapshot and misses accounts that were frozen and later thawed or closed. The USDG and xStocks counts come from a recount at 17:16 UTC (slot 451,383,402), because the output of the first count was not kept. We did not analyse what the MOIN and RUPEE hook programs do. The keyless lite-api.jup.ag host we used is not the documented one (api.jup.ag, with a key), and it may change.

Why this matters

The authority rules in a typical rug check target the pattern behind the 2024 scams: a creator who kept the freeze key or set a permanent delegate. On new launches that pattern was absent. None of the 1,442 had a mint or freeze authority by the time we read them, and all 1,198 pump.fun launches passed every rule. A study of 100,063 tokens launched on Orca, Raydium and Meteora in the first half of 2025 labelled 76,469 as rug pulls, and 461 of those (0.6%) as freeze-authority abuse. In these sets, the powers sit on the tokens people trade most, and the largest stablecoin issuers among them publish when they will use them.

A floor that scores the power alone gets both sides wrong. Scoring every power refuses USDC, USDT, PYUSD and every tokenized stock in the top 100. Scoring only mint and freeze, which is what a token record’s two flags invite, passes every new-launch failure, including two tokens that run code on each transfer. The tools that avoid the first error appear to exempt tokens by identity, and at least one gives different verdicts to tokens with the same powers on the same key: PYUSD passes, USDG does not.

The same power means different things depending on who holds it, and nothing on the mint says who holds it. That information has to come from outside, as an identity claim bound to addresses: this mint is USDC, its freeze key is Circle’s, and Circle’s published policy says when it freezes. A check can then report who can do what, under which terms, and say which parts it measured and which it was told. It should not turn a known issuer into a pass. The same afternoon’s census found 62 frozen accounts across USDC, USDT and PYUSD, and PYUSD’s delegate has moved a balance its holder did not sign for. For a known issuer, the question changes from whether the token is a rug to whose rules the agent accepts by holding it.

Agent Wormhole’s own Solana launch scan reads a token’s name, symbol and metadata JSON as text. It does not read authorities or Token-2022 extensions, so it has no view on anything measured here.

Sources

Measured on 2026-09-28 from lite-api.jup.ag, api.geckoterminal.com and api.mainnet-beta.solana.com (solana-core 4.3.0; slots 451,367,125–451,375,862, plus a frozen-account recount at slot 451,383,402; epoch 1044). Confidence intervals are Wilson score at 95%, and differences use Newcombe’s method 10. Statements about named tokens, issuers and tools describe what their mints and APIs returned on that date, and we will correct any of them on evidence. Negative findings mean “not found with substantial effort”, never “proven absent”.