A technical security assessment of the $GHS stack — token, site, backend and rewards. Every claim below is re-verifiable on-chain.
Assessment dated 3 Sep 2026 · scans are live.
$GHS is a standard Solana Token-2022 with no custom, fund-moving smart contract in the trading path. Authorities are renounced, the token has no tax / hook / delegate, and the site and backend follow a non-custodial, signature-authenticated, least-privilege design.
| Control | Result |
|---|---|
| Mint authority (inflation) | Renounced (null) ✓ |
| Freeze authority (blacklist / freeze) | Null ✓ |
| Metadata update authority | Null — immutable ✓ |
| Buy / sell tax | 0% ✓ |
| Transfer hook | None ✓ |
| Permanent delegate | None ✓ |
| Token royalties | 0% ✓ |
| Standard / extensions | Token-2022, metadata only ✓ |
The classic red flags — open mint, freeze, hidden tax, transfer hook, permanent delegate — are all absent. Full method & live re-check on the Transparency page.
• Private keys never leave your wallet (Phantom / Solflare). The site holds no keys and takes no custody.
• The 3D church authenticates you with a read-only signed message, never a transfer approval — connecting cannot move funds.
• The owner funding tool signs its transaction inside your own wallet; no key or secret is ever sent to a server.
• Authenticated privileged actions — admin/broadcast commands are verified server-side with Ed25519 signatures, a single-use nonce (anti-replay) and a ±120s freshness window. They cannot be forged, replayed, or issued from a browser.
• Server-side RPC proxy with a method allow-list — RPC credentials stay on the server, never in client code.
• Least-privilege database — Row-Level Security: public data is read-only; all writes go through authenticated Edge Functions.
• Transport & browser hardening — CSP, HSTS, X-Frame-Options, and related headers enforced.
• Responsible disclosure — /.well-known/security.txt (RFC 9116); continuous secret scanning & dependency monitoring in CI.
Weekly Manna is distributed as a strictly equal share to the verified congregation, with the distribution's Merkle root recorded on-chain for independent verification. The mechanism runs on an immutable on-chain program (manna_vault) where the equal-split rule is enforced by the program itself and each distribution emits an on-chain proof. The program is validated on devnet ahead of mainnet, with source published for open review.
| St. Jude recipient (Pump.fun) | DApXFR4nXGp2Es1SJDkVSRX34bNiVMqXK65iAr2CUYhG |
| Proof transaction (30 Aug 2026) | 5Qnx…RvWQQ ↗ |
50% of creator fees route to St. Jude via Pump.fun fee-sharing. $GHS is not affiliated with St. Jude.
Independent automated checks on the mint — one click each:
Read the full Security Assessment ↗ SECURITY.md ↗ Source on GitHub ↗
| Axis | Rating |
|---|---|
| Token authorities renounced (mint/freeze/metadata) | Strong ✓ |
| No tax / hook / permanent delegate | Strong ✓ |
| Non-custodial design (sign-message only) | Strong ✓ |
| Backend access control (Ed25519 + anti-replay + least-privilege) | Strong ✓ |
| On-chain verifiability & transparency | Strong ✓ |
| Rewards integrity (equal split + on-chain Merkle) | Strong ✓ |
A website can be cloned. Protect yourself:
• The only official contract address (CA): 3T4gdB2D4FbnPkh2vELdUrnRcZKAzB5z9QUpFechpump — copy it only from @GodHatesSolana or this site.
• Official site: godhatessolana.netlify.app · Official X: x.com/GodHatesSolana · Official GitHub: github.com/GodHatesSolana
• The official wallets are listed on the Transparency page. Any other "official" address is impersonation.
Full transparency & live checks →
$GHS / GodHatesSolana is a satirical, community, entertainment token with no intrinsic value and no promise of return. Nothing here is financial, legal, or spiritual advice — do your own research and verify on-chain. Not affiliated with Solana, any religion, or St. Jude.