Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Jito Safe?

JTOSolana
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 22, 2026 · 2 audits on record
SummaryAI Copilot

The JITO (JTO) SPL token mint has its mint and freeze authorities revoked, indicating a fixed supply and unfreezable accounts.

Read the full analysis
What raised the score
  • Top-10 concentration > 30%
  • LP lock status UNKNOWN — the pool's LP could not be read
  • 1 Low finding(s) from audit
Exact factors
  • Top-10 concentration > 30% (48.0% total → 48.0% effective; 48.0% in EOAs, 0.0% in contracts — moderate)
  • LP lock status UNKNOWN — the pool's LP could not be read
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 223 of 4 checks passed
Contract verifiedVerified
MintNo mint
Liquidity lockUnknown
UpgradeabilityFixed code

Holders

as of audit · Sep 22, 2026
48.0%Top 10 holders52.0%Everyone else
48.0%Top 10 holders52.0%Everyone else
Top 10 holdersEveryone elseBubble area = share of supply
48.0%of supply sits with the top 10 holders
  • Top 10 holdersthe ten largest balances48.0%
  • Everyone elsethe rest of the supply52.0%

Holder balances as recorded by the audit of Sep 22, 2026

Liquidity

as of audit · Sep 22$1.79M across 29 pairs
LP tokensUnknown

Whether the LP tokens are locked could not be determined.

Analysed pool$1.35MShare of depth75.6%

Security Findings

1 Low
Low

Mutable Metadata

The metadata_mutable: True flag indicates that the token's name, symbol, or image can be changed post-launch. This allows the issuer to alter the token's branding without holder consent.L-01

Issue

The metadata_mutable: True flag indicates that the token's name, symbol, or image can be changed post-launch. This allows the issuer to alter the token's branding without holder consent.

Fix

Verify metadata against off-chain expectations before trusting branding.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 22
Executive SummaryWhat the contract is and what the review found

The JITO (JTO) SPL token mint has its mint and freeze authorities revoked, indicating a fixed supply and unfreezable accounts. However, the token's metadata is mutable, allowing changes to its name, symbol, or image post-launch. Holder concentration data was unavailable from chain-native RPC, preventing a full assessment of distribution risks.

Technical10/10Low risk

The JITO (JTO) token is implemented using the classic spl-token program. Both the mint authority and freeze authority have been revoked, ensuring that no new tokens can be minted and no existing token accounts can be frozen. The token has 9 decimals and an initialized supply of 986,522,993.378826880 raw units. Core token behaviors like balance_mutable, closable, freezable, default_account_state_frozen, non_transferable, transfer_fee_upgradable, and transfer_hook_upgradable are all set to False, indicating standard token functionality without these advanced Token-2022 extensions.

Governance7/10Low risk

The token exhibits healthy liquidity with $1,455,394 USD and a 24-hour trading volume of $913,572 USD, resulting in a normal Volume/Liquidity Ratio of 0.63. The DEX pair has been active for 950 days, providing a substantial track record. Information regarding holder concentration was unavailable, preventing an assessment of potential whale risks, though a third-party risk registry flagged "Single holder ownership" as a signal.

Upgrades9/10Low risk

The JITO (JTO) token mint has its mint and freeze authorities revoked, meaning its core parameters related to supply and account freezing cannot be changed. As a classic SPL token, it does not utilize Token-2022 extensions like permanent delegates or transfer hooks. However, the token's metadata is mutable, allowing for changes to its name, symbol, or image after launch, as indicated by the metadata_mutable: True fact and a third-party risk registry signal.

Final RecommendationWhat to do about this score

Before relying on the token's branding, verify its current name, symbol, and image against official sources, as these can be altered due to mutable metadata.

Monitor for any changes to the token's metadata that could impact its perceived identity or legitimacy. If holder concentration data becomes available, assess the distribution to understand potential market manipulation risks from large holders.

Contract & Record

2 audits on record
TypeSPL Token v3
NetworkSolana
Token age2y
Contractjtojto…9mCL
Badge for your website
Jito security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 22, 20263Low
  2. Jul 23, 202643Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the JTO contract address?

The Jito (JTO) contract on Solana is jtojtomepa8beP8AuQc6eXt5FriJwfFMwQx2v2f9mCL. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Jito a scam?

Quantum Audit's risk score for Jito is 3/100 (Low risk) as of Sep 22, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: No mint; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Who holds JTO?

As of Sep 22, 2026, the 10 largest holders own 48.0% of the supply. The Holders section on this page shows who they are by holder type.

Would You Like a More Detailed Audit of Jito?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page