Security
What is enforced by the chain and what is still a promise, in plain terms. NIULAI is a classic SPL token with no custom program on the mint, so most of this is checkable in one command:
spl-token display <MINT>
Do that yourself rather than trusting this page.
What nobody can do, including us
| Attack | Why it's impossible |
|---|---|
| Mint more tokens | Mint authority is revoked. There is no key that can create supply. |
| Freeze or seize your balance | Freeze authority is revoked. No account can be frozen. |
| Tax your trades | Classic SPL Token program, no transfer-fee extension. A transfer moves exactly what you sent. |
| Rename the token or swap its image | Metadata is set immutable after launch. |
| Pull the launch liquidity | LP tokens are burned, not locked. There is no position to withdraw. |
| Change the rules later | There is no program to upgrade. The mint is a standard account with no authorities. |
Note what is not claimed: there is no "ownership renounced" line, because there is no owner construct to renounce. Revoking mint and freeze authority is the Solana equivalent, and unlike an announcement it is a field on the mint account that anyone can read.
Verify before you buy, not after. Both authorities empty is the single check that separates this from the majority of tokens on Solana, and it takes ten seconds.
What is still trusted
Being honest about the parts that are not enforced by code:
The eligibility snapshot. The merkle root is fixed on-chain and every claim is checked against it, so nobody can claim a leaf that isn't theirs. What the root cannot tell you is whether the list was fair — that the snapshot was taken when it was said to be, and that it isn't seeded with addresses belonging to the people who built it. The mitigation is publication: the full snapshot goes out with the root, and anyone can rebuild the tree and check the root matches. This is the main thing you are trusting, and it is the thing to scrutinise hardest.
The claim program. The distributor holding 90% of supply is third-party software. Read its source and check it is the audited version.
The front end. This site publishes the mint address. If someone compromises the domain they could publish a different one — which is why the address is also on the explorer and the aggregators. Cross-check before a large buy or a claim.
That the burn actually happened. It is a transaction, so it is checkable, but it is checkable by you rather than guaranteed by the token. Look at it.
The claim phrase is not a security control
The interface asks you to type "WE, Niulai" before claiming. That is a confirmation step and a piece of community ritual — the same as typing a repository name before deleting it. It never leaves your browser, it is not checked on-chain, and it authorises nothing. Your wallet signature does that.
This is written down because the dangerous version of this pattern is people learning that typing a phrase into a website gets them tokens. No phrase, on any site, ever mints anything. If a page tells you otherwise, it is taking your wallet.
The threats this project cannot fix for you
Most people who lose money around a launch like this do not lose it to the token contract:
- Impostor mints. Anyone can create a token called "Niulai" on Solana in one command. Ticker search will show several. Paste the mint address from this site instead.
- Fake claim pages. The claim page is the most cloned artefact in crypto, and the clones ask you to approve a transaction that drains the wallet. Nobody from this project will ever DM you a claim link.
- Malicious approvals. A claim needs a signature, not blanket authority over your token accounts. Read the transaction preview. If it asks for more than the claim, it is not the claim.
Deployment hardening
- Create the mint with a hardware wallet (
usb://ledger?key=0). No hot key should ever hold mint authority, even for the minutes between creation and revocation. - Rehearse the whole sequence on devnet, including revocation, before mainnet.
- Revoke both authorities before anything trades, not after.
- Burn the LP in the same sitting as seeding the pool.
- Set metadata immutable. Mutable metadata is a rug that needs no key on the mint.
Audit status
Not audited, and there is no custom program on the mint to audit — it is the standard SPL Token program, which is. The part that would benefit from review is the claim distributor and the snapshot that feeds it, and that review will be published when it happens.
Do not read the absence of an audit as safety, and do not read a standard mint as a guarantee. Memecoins routinely go to zero for reasons that have nothing to do with the code.
Reporting something
Open a private security advisory on the repo, or contact the team directly. Please don't post an exploitable finding publicly before it is fixed.