How to check a Solana transaction before you sign

Every Solana transaction you sign is a set of instructions that your wallet will execute with your authority. Once it is on chain, nobody can reverse it. The wallet’s confirmation screen is the last moment you can check what you are agreeing to, and it is worth reading every time, on every site.

Before the wallet even opens

• Check the address bar. Phishing sites copy real ones down to the pixel. Use bookmarks for sites you use often.
• Never type your seed phrase into a website. No legitimate app asks for it, ever.
• Distrust urgency and free money. “Claim now”, surprise airdrops and links in token names are the classic lures (see spam tokens).
• Use a separate wallet for experiments. A wallet with little in it limits the damage of a mistake.

Reading the preview

Modern wallets simulate a transaction before showing it: they run it against the current state of the chain and show the result as balance changes. That is the most useful part of the screen. Ask three questions:

1. What leaves my wallet? SOL, tokens, NFTs. It should match what the site told you, to the cent.
2. What comes in? A reclaim, a swap or a withdrawal should show SOL or tokens arriving.
3. Is there a warning? Wallets flag known malicious sites and suspicious instructions. Do not click through them.

A simulation shows what happens now. Some instructions do their harm later, which is why the next list matters.

Red flags

Balance changes you did not expect

SOL or tokens leaving your wallet that the site never mentioned, or going to an address you do not know.

Approve (a delegate)

Gives another address the right to move your tokens later, without asking again. Nothing leaves your wallet at signing time, so the preview can look harmless.

SetAuthority

Hands control of a token account, a mint or its close authority to someone else. After that, they decide what happens to it.

Assign on your wallet

A System program instruction that makes another program the owner of your wallet account. It is a known drainer technique and has no legitimate use for a normal wallet.

Many unknown programs

A simple action that touches programs you cannot name. Legitimate apps tend to use few, well-known ones.

Most wallets let you open the instruction list. You do not need to read every byte; the program names and instruction names are usually enough to spot one of the above.

Programs you will see often

• System program: SOL transfers and creating accounts.
• Compute Budget: sets the compute limit and the priority fee. Harmless.
• Token program (TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA) and Token-2022 (TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb): transfers, closes, burns, approvals.
• Associated Token Account program: creates token accounts.

Example: a rent reclaim

A transaction that returns rent should contain little more than token instructions that send SOL to you: WithdrawExcessLamports for accounts that stay open, CloseAccount for empty ones, and BurnChecked only for tokens you chose to burn. No Approve, no SetAuthority, no Assign. Any service fee should be a separate, visible transfer. On UNRENT, the full instruction list is published and the security page lists the programs and audits involved.

If you signed something bad

• Move what is left to a fresh wallet with a new seed phrase, starting with the most valuable assets.
• Revoke delegates on token accounts that still hold tokens; wallets and explorers offer this.
• Stop using the old wallet. If its key leaked, every new deposit is at risk.

Sources

• Solana Docs: Fees ↗
• Solana Docs: Tokens ↗