Is NIULAI safe? Run the rug check yourself

$NIULAI is a plain SPL token with both authorities revoked, no transfer fee, and a burned launch LP. Every part of that sentence is a field on a public account, so do not take it from this page — the commands to check each one are below, and they take about a minute.

Then read the second half, which is the part most "is it safe" pages leave out: everything these four checks do not cover. A clean rug check means the contract cannot do specific things to you. It says nothing about whether the token is worth holding, and a page that blurs those two is selling something.

Is NIULAI safe?

The contract-level checks pass: mint authority is revoked, there is no freeze authority and there never was one, the mint is the classic SPL Token Program so a transfer fee is not possible, and the launch LP tokens were burned. That means supply cannot be inflated, your balance cannot be frozen, your trades cannot be taxed, and the launch liquidity cannot be withdrawn. It does not mean the price will hold, and a memecoin can still go to zero for reasons that have nothing to do with the code.

The four checks that matter

Run against the $NIULAI mint, 9Z9wf8iSq8EpkF5fHzaKExHCvZ9BdSiVn1razYhRZuVh:

One command reads the first three:

spl-token display 9Z9wf8iSq8EpkF5fHzaKExHCvZ9BdSiVn1razYhRZuVh

The two empty authorities got there by different routes, and the difference is worth knowing. The mint authority was revoked: it existed, it was used once to mint the supply, and it was then set to null in a transaction you can open. The freeze authority was never set at all — spl-token create-token only creates one when asked with --enable-freeze, and the launch script never asks. So there is no freeze-revocation transaction to link, because there was nothing to revoke.

That matters when you are checking someone else's token too. An authority that was taken away and one that never existed both read as null on the mint account, and they are not equally reassuring: the first had a window in which someone could have used it, and the second never did. The account alone cannot tell you which you are looking at. The launch script can, which is why this project publishes one.

How do I check the authorities without installing anything?

Ask a public RPC node directly and read the two fields. Any machine with curl can do this, and the answer comes from the chain rather than from an explorer's index of it.

curl -s https://api.mainnet-beta.solana.com -X POST \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"getAccountInfo","params":["9Z9wf8iSq8EpkF5fHzaKExHCvZ9BdSiVn1razYhRZuVh",{"encoding":"jsonParsed"}]}'

You are looking for four things in the reply. mintAuthority and freezeAuthority should both be null. supply should be 1000000000000000 — that is 1,000,000,000 tokens at six decimals, and the raw figure is 1,000,000,000,000,000 base units. And owner should be TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA.

That last field is the one most checklists skip, and it is load-bearing. It is the address of the classic SPL Token Program. A transfer fee on Solana is a Token-2022 extension, and Token-2022 is a different program with a different address. A mint owned by the classic program cannot carry a transfer fee, cannot have one added later, and cannot have a transfer hook — not because nobody has enabled one, but because the program has nowhere to put it.

How do I know the liquidity was really burned?

Read the supply of the pool's LP token. When liquidity is added to a pool, the depositor receives LP tokens representing their share; burning them destroys the claim on the deposit. If the LP supply is zero, no LP tokens exist, so no position exists that could withdraw the pool.

One honest correction to the usual wording. You will see projects claim "LP authority revoked". That is not what this shows and it is not what happened. The LP token's mint authority is not empty — it is GpMZbSM2GgvTKHJirzeGfMFoaZ8UR2X7F4v8vHTvxFbL, which is the Raydium CPMM program's authority. It has to be, or nobody could ever add liquidity to the pool again. That address is program-derived rather than a key someone holds, and the claim that actually matters is the one above it: the LP supply is zero, so the tokens minted at launch were destroyed rather than parked.

Burning rather than locking is deliberate, and it costs something. A lock is a promise with an expiry and a counterparty; a burn is arithmetic. The price is that the liquidity can never be migrated to a better pool and the project gives up any ability to rebalance. That trade is worth stating rather than presenting a burn as free.

What do these checks not cover?

Everything that is not the token contract, which is where most people actually lose money. A clean mint is a floor, not a verdict.

• The front end. This site publishes the mint address. Someone who compromised the domain could publish a different one. This is the main thing you are trusting, which is why the address is also on explorers and aggregators — cross-check before a large buy.
• Similarly named tokens. Anyone can mint a token with any name on Solana in one command, and an unrelated 牛来 token on another chain is larger and better known than this one. Ticker search cannot tell them apart. Paste the mint address.
• Malicious approvals. A swap needs authority over the tokens you are swapping and nothing else. Read the transaction preview and reject anything requesting more than the trade you asked for.
• Thin liquidity. The pool was seeded once and is small. Slippage on a trade of any size will be worse than you expect, and being able to buy is not evidence you can sell the same amount at the same price. Look at the live depth, not the market capitalisation.
• The market. There are no cash flows, no revenue share, no staking yield and no treasury backing anything. It is a joke about a bull, and its value is whatever the market decides that is worth on a given day, which may be nothing.

Has NIULAI been audited?

No, and there is nothing custom to audit. The mint is the standard SPL Token Program, which is audited, and this project deploys no program of its own — no distributor, no vault, no staking contract, no claim contract. The absence of an audit here reflects the absence of custom code rather than a corner cut, but do not read a standard mint as a guarantee of anything beyond what the four checks above show.

Related

• There is no NIULAI airdrop — why every claim page is fraudulent
• How to buy NIULAI on Solana — using the mint, not a ticker
• Security — the full list of what is enforced and what is trusted