← Directory

Solana

Seal for Solana: onchain band B. Not claimed by the project.
Transparency score · worst track · not a security audit

solana.com · Layer 1 · Solana · data checked 2026-10-20 19:44 (Stockholm)

Contact route: not found

Not claimed Automated from public data

Automated score · 2026-10-20 · method v0.2.6 · How this score is made
Produced automatically from public data on 2026-10-20 (method v0.2.6). It shows how much of this project’s control structure, code and contact information could be checked from public sources. No person selected or adjusted it, and nothing a project does or pays changes it. It is not a security audit.

Beta: the method is still being calibrated, so this automated score may contain errors. Send a correction.

Transparency score, not a security audit. Scores are generated automatically from public data (Solana RPC, OtterSec build registry, GitHub, project websites). Projects are not involved unless a page is marked “Claimed”, and claiming never changes a score. Nothing here says a project is safe. How scores are made → · Corrections, right of reply & opt-out →

B
Onchain track · onchain v0.2.6
74/100 · Band B
coverage 94 % · 17 of 18 decided
1 unknown (−1.5 pts) · 0 not read (no points lost, lowers coverage) · 3 not built yet (excluded)

Something wrong on this page? Dispute a check or send a correction · opt-out. We re-run the check and correct the page.

What was checked: addresses & sources

Website solana.com · GitHub solana-program/token. Addresses are used only if they appear verbatim on an official project page.

Onchain track covers the SPL Token program (core Solana program library) only, not the validator client.

Onchain track

Contract control weight 3030/30
  • ✓ Met

    Upgrade authority Tokenk…

    Upgrade authority is revoked: program is immutable. Address taken from official source: https://spl.solana.com/token
    spl.solana.com ↗Explorer ↗Explorer ↗RPC call (getAccountInfo) checked 2026-10-20 sha256 f9a7104de7a4… sha256 f82caba2457b…
  • ✓ Met

    Build matches source (OtterSec registry) Tokenk…

    OtterSec registry reports a build from public source that matches the on-chain program (https://github.com/solana-program/token/tree/a94dd19750dc3b2409f73e15bb74754935b2a489).
    OtterSec registry ↗ checked 2026-10-20 sha256 e80f9f50793d…
  • – N/A

    Mint/freeze authority

    No token mint submitted.
    source: calculated from the other checks checked 2026-10-20
Audits weight 150/15
  • ✕ Not met

    Audits found at official sources

    No audit found in the sources we searched (GitHub solana-program: 41 of 41 non-fork repositories file-listed via GitHub API | solana.com: 18 audit/security page address(es) fetched (docs sub-domains and homepage audit links included)). This is not proof that no audit exists: reports may be hosted elsewhere, e.g. on an auditor's own site. If the project has one, point us to it: info@recheckable.com.
    GitHub ↗solana.com ↗api.github.com ↗GitHub ↗ checked 2026-10-20 sha256 cf5dff86e2eb… sha256 e1ce045928d9…
    What would show up as met
    • Link each audit report from an official page: your docs, your website or an audits folder in your GitHub repository.
    • Tell us the page through the corrections form so it can be added. The check only confirms that the document is reachable. It does not assess the audit’s quality or whether it covers the current code.

    How we check: Audit links come from official pages found for the project, not from a search of the web. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.

Code openness weight 1515/15
  • ✓ Met

    Public repository

    solana-program/token public, created 2024-04-29, 43 contributor(s) (count only).
    GitHub ↗api.github.com ↗api.github.com ↗ checked 2026-10-20 sha256 77aa49b034c0… sha256 3c0afed65d6e…
  • ✓ Met

    Licence

    SPDX: Apache-2.0.
    GitHub ↗api.github.com ↗api.github.com ↗ checked 2026-10-20 sha256 77aa49b034c0… sha256 3c0afed65d6e…
  • ✓ Met

    Activity last 90 days

    Last push 2026-10-16 (4 d ago).
    GitHub ↗api.github.com ↗api.github.com ↗ checked 2026-10-20 sha256 77aa49b034c0… sha256 3c0afed65d6e…
  • ✓ Met

    On-chain program source public

    1/1 own program ID(s) found in public source: Tokenk… in https://github.com/solana-program/token. Repos searched (shallow clone, text search for the program ID): https://github.com/solana-program/token. Does not prove the deployed binary matches (see the build check).
    GitHub ↗ checked 2026-10-20 sha256 47296d859a40…
Onchain history weight 1010/10
  • ✓ Met

    Last deploy Tokenk…

    Last deploy 2026-05-13 (160 d ago).
    Explorer ↗RPC call (getAccountInfo)RPC call (getBlockTime)OtterSec registry ↗ checked 2026-10-20 sha256 f9a7104de7a4… sha256 f82caba2457b…
  • ○ Not built

    Program age / upgrade count Tokenk…

    Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.
    Explorer ↗RPC call (getAccountInfo)RPC call (getBlockTime)OtterSec registry ↗ checked 2026-10-20 sha256 f9a7104de7a4… sha256 f82caba2457b…
Team & contact weight 15 · 1 unknown5/15
  • ✕ Not met

    Security contact (security.txt)

    No valid security.txt at /.well-known/security.txt or /security.txt (404).
    solana.com ↗ checked 2026-10-20 sha256 68c46fd3ee21…
    What would show up as met
    • Publish a text file at https://your-domain/.well-known/security.txt (or /security.txt) with a Contact: line, for example Contact: mailto:security@your-domain.
    • RFC 9116 also asks for an Expires: line. We look only for Contact:, but add Expires: too so the file stays correct.

    How we check: We fetch the two standard locations over HTTPS. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.

  • ? Unknown

    Bug bounty programme linked

    No bug-bounty link found on homepage (raw + rendered), sitemap or security.txt. Not checked deeper (docs sites, Immunefi search) — counted as unknown, not as missing. Also checked: Immunefi public list: no active programme matched; no on-chain security.txt in Tokenk….
    solana.com ↗solana.com ↗solana.com ↗solana.com ↗ checked 2026-10-20 sha256 21bdfff1bcdf… sha256 68c46fd3ee21…
    What would show up as met
    • Link your bug bounty (for example an Immunefi, HackerOne or Cantina page, or a /bug-bounty page of your own) from the homepage, the sitemap or your security.txt.
    • “Unknown” here means we found no link. It does not mean you have no programme.

    How we check: We look at the homepage links (also as rendered in a browser), sitemap.xml and security.txt, and at Immunefi’s public list for on-chain security.txt names. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.

  • ℹ Status only

    Claimed / not claimed

    Status only, not scored: claiming proves control of an authority, domain or GitHub organisation and never changes a score. The status is shown in the page header.
    source: calculated from the other checks checked 2026-10-20
  • ○ Not built

    Team declared (voluntary, with consent)

    Team declaration + consent flow not built — excluded.
    source: calculated from the other checks checked 2026-10-20
  • ℹ Status only

    Components declared complete by the project

    Status only, not scored (it used to be scored, which made pages that are not claimed systematically lower; removed 2026-10-15). Other programs/packages may exist that were not submitted.
    source: calculated from the other checks checked 2026-10-20
  • ✕ Not met

    Program embeds security.txt

    0/1 own program(s) embed a solana-security-txt block with contacts.
    Explorer ↗RPC call (getAccountInfo) checked 2026-10-20 sha256 9fa178db340b…
    What would show up as met
    • Embed a security.txt block in the program with the solana-security-txt crate: name, project_url, contacts and policy. Redeploy to publish it.
    • This also tells us which programs belong to you, and which are shared programs that do not.

    How we check: We read the program account on Solana (public RPC). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.

  • ✓ Met

    Official program address list

    Tokenk… published on project domain (https://spl.solana.com/token).
    spl.solana.com ↗ checked 2026-10-20 sha256 bcb996570615…
Domain weight 55/5
  • ✓ Met

    HTTPS

    https://solana.com answered HTTP 200 over TLS.
    solana.com ↗solana.com ↗solana.com ↗solana.com ↗ checked 2026-10-20 sha256 21bdfff1bcdf… sha256 68c46fd3ee21…
  • ✓ Met

    Security headers

    Present: HSTS, CSP, X-Content-Type-Options, X-Frame-Options. Missing: none.
    solana.com ↗solana.com ↗solana.com ↗solana.com ↗ checked 2026-10-20 sha256 21bdfff1bcdf… sha256 68c46fd3ee21…
  • ✓ Met

    Domain age

    Registered 1993-04-16 (~12240 d), source: RDAP (rdap.org). Registrant data ignored.
    RDAP ↗ checked 2026-10-20 sha256 3bf0fb38b15d…
  • ✓ Met

    Domain ↔ components consistency

    Linked: address Tokenk… published on solana.com (https://spl.solana.com/token); GitHub org name matches domain (weak)
    source: calculated from the other checks checked 2026-10-20

Snapshot hash of monitored fields: 38f6492b2211ffce

AI summaries

Generated with Grok 4.7 (xAI), Claude sonnet-5-5 (Anthropic) and GPT-6.1-sol (OpenAI) via their APIs. xAI, Anthropic and OpenAI have not reviewed, approved or sponsored Recheckable. AI-generated text; models see only extracted check results, never project-supplied text or personal names. They do not affect the score. Some text on this site (summaries and reports) is AI-generated and labelled where it appears. Scores and check results come from fixed code, not from AI. Scores are produced automatically from public data and are not reviewed by hand before they are shown; cases that the automatic checks flag are held for a person.

Template summary (deterministic)

Onchain track: band B (74/100, coverage 94 %, onchain v0.2.6). Strongest: Contract control, Code openness, Onchain history, Legal documents, Domain. Weakest: Audits, Team & contact. 1 check(s) unknown (each costs 1.5 points); 0 not read (no points lost, lowers coverage); 3 not built yet (excluded).

Grok (xAI)

Placeholder — no API key configured for this model in the PoC.

Claude (Anthropic)

Placeholder — no API key configured for this model in the PoC.

GPT (OpenAI)

Placeholder — no API key configured for this model in the PoC.

Regulatory information

The project has not declared any regulated-activity types, so no rules are listed.

Law firms (free listing, alphabetical, no ranking)

  • Delphi — Stockholm, Blockchain law (self-described)
  • Gernandt & Danielsson — Stockholm, Fintech (self-described)
  • Magnusson — Stockholm, Fintech (self-described)
  • Mannheimer Swartling — Stockholm, Fintech (own practice page to be confirmed) (self-described)
  • Setterwalls — Stockholm, Fintech (self-described)
  • Vinge — Stockholm, MiCA (own practice page to be confirmed) (self-described)

Recheckable has no financial relationship with the listed firms and receives no fee per contact. Paid placements, if ever introduced, are marked “Ad” and never shown next to low scores.

Score history

Automated score at each published review, newest on the right. The line steps at the date of a review; between reviews the score is unchanged.

Score historyTransparency score by published review for Solana. onchain track: 2026-10-15 74/100, 2026-10-17 74/100, 2026-10-19 74/100, 2026-10-20 74/10002550751002026-10-152026-10-20

◆ 2026-10-17: the scoring method changed from v0.2.1 to v0.2.5. A score change at that point can come from the method and not from the project.

◆ 2026-10-19: the scoring method changed from v0.2.5 to v0.2.6. A score change at that point can come from the method and not from the project.

Data table
ReviewTrackScoreGradeCoverageMethod
2026-10-15onchain74/100B94 %v0.2.1
2026-10-17onchain74/100B94 %v0.2.5
2026-10-19onchain74/100B94 %v0.2.6
2026-10-20onchain74/100B94 %v0.2.6

No check changed its result between the published reviews.

History

  1. 2026-10-20 19:44
    Forced fresh run (same result; fresh evidence snapshots): onchain B (74, coverage 94 %)
  2. 2026-10-19 14:23
    Forced fresh run (same result; fresh evidence snapshots): onchain B (74, coverage 94 %)
  3. 2026-10-17 06:35
    Nightly re-run: onchain B (74, coverage 94 %)
  4. 2026-10-15 10:16
    Method 0.2.1: the scope declaration and claim status are status-only (never scored). Re-scored from the stored checks, no new fetch. Before: B 72 (cov 89 %); after: B 74 (cov 94 %).
  5. 2026-10-15 07:18
    Initial review (operator-run): onchain B (72, coverage 89 %)

Project's own statements and reply

No reply published. Claimed projects can add their own statements and a reply next to any check — dispute a check or reply. These statements are shown beside the automated score and never change it.
Does your team control the upgrade authority, official domain or GitHub organisation of this project? Claim this page (free, about a minute; it never changes a score).

For project owners: badge

Recheckable: onchain band B, Active

Status: Active. The badge says “no changes since review”, never “safe”.

Badges are for claimed projects. The embed code is available after the page has been claimed (free, about a minute; claiming never changes the score). Claim this page

Re-checks are rate-limited (once per 10 minutes). Restoring a grey badge requires a full review.