SignLens

Warnings › Accounts given away

Owner changes: a signature that gives an account away

Published

On Solana an account's owner can be changed. The token program's SetAuthority hands a token account to a new owner; the system program's Assign hands a whole wallet account to a program. Neither moves a token when you sign, so a balance preview shows no change at all. From then on the new owner can take everything in the account, and you cannot take it back.

How it is used

A phishing site asks you to sign what looks like a claim, a mint or a login, with an owner change inside. In one academic study of Solana phishing (SolPhishHunter, 2025), owner transfers were 2,171 of 8,058 phishing transactions but 73.85% of the $1.1 million in losses it measured. In December 2025 SlowMist reported a November case: a victim who lost over $3 million this way after a preview that "showed no fund changes": see the case, read by SignLens.

What SignLens shows

An owner change of your own account is a critical finding, so SignLens blocks the request unless you choose "Continue anyway". A constructed example, the token program's SetAuthority on the signer's USDC account:

Blocked

Give the owner authority over ARX9…Evfz to DbRK…ERgS

What SignLens found

What this does

Full text, as the engine prints it
Give the owner authority over ARX9…Evfz to DbRK…ERgS
BLOCKED BY DEFAULT (1 critical finding)

Findings:
  [CRITICAL] Gives YOUR token account to DbRK…ERgS; the new owner controls every token in it and you cannot get it back (instruction 1)

== Give away token account | Token program
  Account or mint: Your token account (ARX9…Evfz)
  Authority: owner
  Current holder: Your wallet (BqHR…Tx9A)
  New holder: DbRKJvepcS1YEmpBNX3Kc67kjQmyMm3RYovaAVk9ERgS

== Signers
  Fee payer: Your wallet (BqHR…Tx9A)

== Fee
  Total: 0.000005 SOL
  Base: 0.000005 SOL

== Validity
  Expires: in about a minute (recent blockhash)

Effects:
  - Give the owner authority over Your token account (ARX9…Evfz) to DbRKJvepcS1YEmpBNX3Kc67kjQmyMm3RYovaAVk9ERgS
  - You pay a fee of 0.000005 SOL
  - Valid for about a minute (recent blockhash)

Raw: solana legacy (173 bytes)
  digest: 45eea612c30cc4b034df107bd6b105f795bcc6c90073de130df72cd30f4518d4
A constructed transaction, built to show this case; it was never sent. Explained for BqHR…Tx9A as the signer, by the SignLens engine 0.3.0, on 2026-11-01. How to read this.

Drainers often hide the owner change inside a program of their own, as in the November 2025 case. SignLens cannot name what such a program does, but it blocks any program it has no reviewed description of, which is what happened there: the case, read by SignLens, is blocked with a critical finding for each call to that program.

What to do

Reject it. No dapp needs to own your token account or your wallet to trade, lend, stake or claim.

Other warnings: spending rights, signatures that never expire, lookalike addresses, programs it does not know, multisig approvals you cannot see, a swap paying someone else.

Try it: install SignLens for Chrome or Firefox.

Sources