The manual

Tickers are costumes; anyone can launch a token named anything. The mint address — the long string — is the only identity a token has. Get it from at least two independent places the project controls (its website, its listing profile) and compare, character for character. If a project makes its mint hard to find, that is itself a finding.

Paste the mint into a block explorer like Solscan. Three things on the token page matter most. Mint authority: if it isn't revoked, someone can print more supply at will. Freeze authority: if it isn't revoked, someone can freeze your tokens in your own wallet. Supply: the real number, live — not the number any website quotes. Launchpads like pump.fun revoke these authorities at creation; for anything else, check rather than assume.

The token page names the wallet that created it. Click through and read its life: how old it is, what funded it, what else it launched. A wallet that has created twelve tokens in six weeks is telling you its business model. A dev who claims to hold and never sell has a wallet that either shows that or doesn't — holdings and sells are not matters of opinion.

The holder tab shows who owns what. Concentration is the question: a few wallets holding most of the supply can end the token whenever they choose. Read it with care, though — on bonding-curve launchpads, the curve's own custody account appears as a large holder, which is plumbing, not a person. Learn to tell infrastructure from insiders before drawing conclusions.

Liquidity is what lets you sell. If the team can pull it, everything else is decoration. The real check is where control of the pool actually sits, and there are three patterns: LP tokens at a burn address (burned — nobody controls it), a protocol-owned pool (the platform's machinery holds it — pump.fun's current model for graduated coins, per their docs), or a dev's wallet — and only the last one is the danger. A promise to burn or lock is a promise; the ownership record is on the chain. Check the record, not the promise.

Roadmaps are promises about the future; anyone can make them. What a project has already done, dated, is checkable. Read what it shipped, when, and whether its claims about the past survive contact with the explorer. A project that documents its own mistakes is rarer than one that documents its wins, and the difference is informative.

While you check all of the above, someone may be checking you. The short version, expanded on the Start page: a signature is free and proves ownership; a transaction moves things. Anything that asks you to approve a transaction, pay a fee, or reveal a recovery phrase in order to "verify," "claim," or "get help" is a robbery in progress, whatever logo it wears.

Verification is not paranoia; it's the ten minutes that makes trust unnecessary. This checklist works on every token on the chain, including the one whose website you are reading. That's the test of it. Start here.