Know before you sign, or before you get drained
solcheck reads a Solana transaction and tells you, in plain English, whether it is an irreversible drain. It catches the patterns Phantom and Blowfish simulations miss, the ones that show no balance change until your funds are already gone.
where do I get this?
- A link: copy the claim, airdrop, or Blink URL from the post or DM. Do not open it first; paste it here.
- A signature: from your wallet's activity list, or the transaction URL on Solscan or Solana Explorer.
- A base64 transaction: advanced, the raw payload a dApp is asking you to sign.
This only checks the domain against known drainers, without opening the link. To inspect the actual transaction behind a Blink or claim link, paste it into the scanner above.
solcheck will never show a green "safe". A simulation can be spoofed, and an ownership reassignment shows no balance change, so no tool can promise a transaction is harmless. The best it can say is "no critical patterns detected", and that still means read carefully before you sign.
Ownership reassignment
SetAuthority on AccountOwner, or the System program assign instruction, hands control of your account to an attacker with no balance change. Your wallet shows nothing moved. It is not reversible.
Durable nonce time-bomb
A durable nonce lets an attacker hold your signed transaction and execute it weeks later, optionally after upgrading a program it calls. This is the vector behind the Drift drain.
Hidden drain bundles
Lookup tables and inner cross-program calls hide the real destination behind an index. One signature can bundle every token transfer in your wallet into a single sweep.
Paste a base64 transaction, a transaction signature, or a claim or Blink link. solcheck resolves the lookup tables and Blinks, decodes every instruction including the inner cross-program calls, and ranks what it finds in plain English. Nothing about you or your wallet is stored. The delegate revoker and the incident-response playbook are below.