Making a Solana SPL token immutable permanently locks its on-chain metadata. Once a token is set to immutable, no key, creator wallet, or program can ever modify the token name, symbol, logo, description, or official links stored in its Metaplex metadata account.
For token creators, making metadata immutable is one of the clearest signals of transparency. Major token scanners like DexScreener, RugCheck, and Birdeye flag mutable tokens as potential security risks because a mutable token allows a rogue creator to change the project name or image after launching.
What Immutability Actually Means on Solana
When an SPL token is created with metadata, a Metaplex Metadata Account is initialized alongside the token mint. This account contains a specific field called updateAuthority and a boolean flag named isMutable.
- Mutable State (
isMutable: true): The address stored in updateAuthority can submit a transaction to rewrite the token name, symbol, logo URI, and social links.
- Immutable State (
isMutable: false): The update authority is set to null (or address 11111111111111111111111111111111). The metadata account state is locked forever at the protocol level.
Immutability does not affect token transfers, trading, or wallet balances. It specifically locks the identity and metadata of the token so traders know the project assets cannot be altered post-launch.
Official protocol mechanics for Metaplex accounts are detailed in the Metaplex Metadata Documentation.
Why Security Scanners Flag Mutable Tokens
Decentralized exchanges and security audit bots check metadata authority status automatically:
- Immutability Risk: If a creator retains update authority, they could theoretically rename a popular token to mimic another project or change the logo to mislead buyers.
- DexScreener & Birdeye Badges: Platforms display a warning badge or reduce safety scores for tokens that remain mutable after pool creation.
- Trader Confidence: Buyers and automated trading bots prioritize tokens where all three core authorities (Mint, Freeze, and Update) are fully revoked or managed.
When Should You Make Your Token Immutable?
Before revoking update authority, verify that every piece of token metadata is completely accurate:
- Verify Token Image: Ensure the image file is hosted on permanent, high-availability storage (like Arweave or IPFS) and renders clearly at 512x512 pixels.
- Confirm Social Links: Double check that website, Telegram, and X (Twitter) URLs in the JSON metadata are correct and active.
- Check Symbol and Name: Ensure there are no typos in the ticker symbol or display name.
Once update authority is revoked, any typo or dead link in the metadata becomes permanent and unfixable.
Step-by-Step Guide: Making Your Token Immutable with PumpBolt
PumpBolt provides a non-custodial, no-code route to revoke update authority in a single transaction.
Step 1: Connect Your Authority Wallet
Visit the PumpBolt Security Hub and connect the wallet address currently listed as the token update authority.
Step 2: Select the Make Immutable Mode
Navigate to the Make Immutable tab. PumpBolt inspects your connected wallet and displays all SPL tokens where your wallet holds update rights.
Step 3: Select Your Token
Choose the token you want to lock. The interface will fetch the current Metaplex metadata and confirm your wallet’s authority status.
Step 4: Confirm and Execute Revocation
Review the safety warnings. Click Make Immutable and approve the transaction prompt in your wallet. PumpBolt submits the revocation instruction to the Solana mainnet.
Step 5: Verify on Solscan and RugCheck
Copy your token mint address into Solscan. Under the Metadata tab, verify that isMutable now reads false and Update Authority is cleared.
Summary Checklist Before Revoking Update Authority
| Pre-Lock Requirement |
Verification Action |
Status |
| Logo Display |
Image renders correctly on Phantom and Solscan |
Required |
| Metadata JSON |
All social links and website URLs are live |
Required |
| Name & Ticker |
Spelling and capitalization are 100% verified |
Required |
| Wallet Authority |
Connected wallet holds active update authority |
Required |
| Network Buffer |
Wallet has at least 0.01 SOL for network fee |
Required |
Revoking update authority completes the security triad alongside revoking mint and freeze authorities, providing traders with permanent proof of project integrity.