Token Launch Security Checklist: Before Your TGE

By the Guardian team Updated November 2026 5 min read

Quick answer. Before a TGE, audit token, vesting and claim contracts, and put every mint and admin role on a timelocked multisig. Protect pool setup from front-runs, secure your frontend and DNS, and monitor mints and claims from day one.

Watch: Token Launch Security Checklist: Before Your TGE 1:41

Video transcript

A token launch puts new contracts, fresh keys and a new domain in front of attackers on day one. Tokens are liquid from the first block.

UXLINK shows what a mint role costs. An attacker hijacked its multisig, minted billions of tokens, and almost 18 million dollars left the treasury.

Prefer a fixed supply, or cap minting in code behind a timelocked multisig. Test pause both ways, and keep team tokens in the vester.

Claim contracts get hit too. Hedgey lost about 44.7 million dollars to unverified input. At ZKsync, a compromised admin minted 111 million unclaimed tokens.

Bind each Merkle leaf to an address, amount and chain. Allow one claim per address, give every signature a nonce, and put sweeps behind a multisig.

Verify every exchange and market maker address on the chain where tokens land. Skipping that check put 20 million OP in an attacker's hands.

Your claim site is a target. Lock the registrar with strong MFA, publish one official claim page, never ask for approvals, and alert on DNS changes.

At UXLINK, minting ran in more than one round. From day one, alert on every mint, role change and large claim, and check total supply against the cap on every chain.

Guardian audits token, vesting and claim contracts with competing manual and AI-driven teams. Read the full checklist, or talk to Guardian.

A token generation event (TGE) puts new contracts, fresh keys and a new domain in front of attackers on the same day. The tokens are liquid from the first block.

The incidents below needed no exotic bug. An admin key, a missing input check and a hijacked domain were enough.

This checklist covers what is specific to a launch. For deployment basics, use our pre-mainnet security checklist.

Token Contract Checks

Start with what the token itself allows. Any power in the contract is a power an attacker gets with the key.

Fixed supply, or a mint capped in code and held by a timelocked multisig.
Launch supply checks read the real totalSupply, so no init call can mint extra (Clanker, High).
Pause tested both ways: a contract that can never unpause is a bricked launch (Animecoin, Critical).
Fees, blacklists, rebasing or hooks checked against our weird ERC-20 checklist.

UXLINK shows what a mint role costs. In September 2025, an attacker hijacked its multisig and minted billions of tokens, Rekt reports.

Almost $18 million left the treasury and the price fell about 70%. UXLINK announced a swap to a new, fixed-supply contract.

Vesting and Lockup Checks

Vesting contracts often hold a large share of supply at TGE, for team, investors and ecosystem. Their math has to hold for years.

Every schedule field is initialized, including the last claim time (g8keep, Critical).
Lockups apply on every path in, including staking on someone else's behalf (Abracadabra Money, High).
Revoked schedules stay revoked when the vester is funded again (Magna, High).
Account transfers cannot inflate how much a user may vest (GMX, High).
Schedules sum to the tokens the vester holds, on every chain.
Team and investor tokens sit in the vester from the first block, not in a wallet.

Airdrop and Claim Checks

Claim contracts hold a large pool of liquid tokens, behind an admin and a public claim function. Both get attacked.

On April 19, 2024, Hedgey Finance lost about $44.7 million through its token claim contract. Rekt traces it to unverified user input, which let the attacker obtain token approvals.

On April 15, 2025, an attacker compromised the admin account of three ZKsync airdrop contracts. Calling sweepUnclaimed(), they minted 111 million unclaimed ZK, worth about $5 million, Cointelegraph reported.

Merkle leaves sum to the amount actually locked or funded onchain (Push Chain, Low).
Each leaf binds an address, an amount and a chain.
Each winner or address can claim only once (Zap, High).
Every signature carries a nonce (Sapience, Critical), the chain ID and the contract address.
Updating the root cannot brick earlier claimants (Aria, Low).
Daily limits cannot lock claims for good (Animecoin, Critical).
Sweep and admin functions sit behind a multisig, with a time window (ZKsync).
Every user-supplied parameter is validated (Hedgey).

Liquidity and Sniping Checks

On launch day, bots watch the mempool for your pool. Anything they can do before your transaction lands, they will try.

Only your launch contract can initialize the pool, so a front-run cannot brick the launch (Trueo, High; Gamma Strategies, High).
Valuation guards check the liquidity actually placed, not the starting price (Clanker, High).
Anti-sniping allocation windows cannot be closed early with a donation (Bigcoin, Critical).
Record who holds the LP tokens, and lock them if you promised to.
Verify every exchange and market maker address on the chain where tokens land.

Skipping that check put 20 million OP in an attacker's hands in June 2022. Wintermute, hired to provide OP liquidity for exchange listings, gave its Ethereum mainnet Safe address to receive the tokens on Optimism.

An attacker replayed Safe deployment transactions from mainnet on Optimism and took control of that address. Our deployment scripts guide shows the check.

Keys, Frontend and DNS Checks

Key and multisig setup is in our pre-mainnet checklist. A launch adds one more target: the site where users claim.

The registrar account protected with strong MFA and a registry lock.
One official page with the claim URL and contract addresses, live before the announcement.
A claim flow that never asks for token approvals, and a public note saying so.
Alerts on DNS changes and on changes to the served frontend.

Domains are a target too. In July 2024, Compound's hijacked domain showed a phishing page, one of several Squarespace-registered DeFi domains hit, BleepingComputer reported.

Listing and Day-One Monitoring

Exchange listing reviews

Exchanges increasingly have to review your contracts too. In California, a covered exchange must certify a risk assessment covering "code or protocol defects" before it lists a token.

In the UK, final FCA rules in PS26/9 require retail trading platforms' admission criteria to take known smart contract risks into account (CRYPTO 3.2.5R). They apply from October 25, 2027.

Have a listing file ready for each chain:

Audit reports for every deployed contract, with any open findings.
A bytecode match between deployed and audited code.
Each privileged role, with its holder, threshold and timelock.
Bridge setup, and anything changed since the audit.

Our post on California's listing certification covers what a reviewer will look for.

Day-one monitoring

At UXLINK, unauthorized minting ran in more than one round, Rekt reports. Alerts should catch the first.

Alerts on every mint, role change and ownership change.
Total supply checked against the cap, on every chain.
Alerts on large claims, sweeps and treasury transfers.

How Guardian Helps Before a TGE

Guardian audits token, vesting and claim contracts with two competing teams, one manual and one AI-driven, over an invariant fuzzing suite.

Its public reports include token launch and distribution work for Clanker, g8keep, Zap and Magna, and Animecoin's ANIME claimer.

An OpSec audit maps who can mint, upgrade, pause or move funds, and how those keys are held. Managed Security then reviews multisig transactions and deployments as they land.

See how Guardian works with onchain teams.

Frequently Asked Questions

What should a project audit before its TGE?

The token, vesting, airdrop or claim, and liquidity contracts, plus any bridge setup. Then review who holds each admin key, the frontend and DNS, and the monitoring that will watch mints and claims from day one.

How are airdrop claim contracts exploited?

Through admin keys and missing checks. At ZKsync, a compromised admin account minted 111 million unclaimed tokens. At Hedgey, missing input validation cost about $44.7 million. Guardian's public reports also show double claims and replayable signatures.

Who should hold the mint role at launch?

Ideally no one, with a fixed supply. If minting is needed, cap it in code and give it to a multisig behind a timelock, never the deployer. UXLINK's attacker minted billions of tokens after taking over its multisig.

Do exchanges review token contracts before listing?

Increasingly, yes. In California, a covered exchange must certify a risk assessment covering code or protocol defects before listing. From October 25, 2027, FCA rules require UK retail trading platforms to take known smart contract risks into account.

Sources

Launch your token with Guardian

Guardian audits your token, vesting and claim contracts and maps every key that can mint, upgrade or move funds before TGE.

Get a quote Security for onchain teams