Security
What DustJar can and cannot do
DustJar reads wallets and reclaims Solana rent. It holds nothing, runs no program of its own, and every transaction it builds is made of standard instructions you can read on this page and verify on chain.
Scanning is read-only
You can paste any address, including one you do not own. Scanning asks public indexers and the chain itself what a wallet holds. Nothing is signed and no wallet needs to be connected.
What a claim asks you to sign
Only these, all from the standard Solana programs. There is no DustJar program.
- SPL Token CloseAccount on token accounts with a zero balance. The rent deposit goes to you. Nothing is destroyed: the account was empty.
- SPL Token WithdrawExcessLamports on accounts holding more than today's rent-exempt minimum. The excess goes to you; the account and its tokens stay exactly as they were.
- SPL Token BurnChecked, then CloseAccount, only if you tick the burn option, and only for tokens that no aggregator will buy and that are worth under one dollar. This is the one irreversible action and it is off by default.
- One System Transfer of our 1.5% fee, taken from what the same transaction recovers, to
Gc47q655NzLQLZUzjviCRfNmjeaepYSPk7RVSamS3zDr. If the batch recovers nothing, there is no fee.
What it never asks for
- No token approvals, delegates or SetAuthority. Nothing can move a token you keep.
- No SOL transfer other than the fee above, unless you choose a destination wallet, in which case what was recovered is sent there in the same transaction.
- No message signing, no session keys, no "verify your wallet" prompts.
- No custody. Nothing passes through an address we control except the fee.
How to check for yourself
Your wallet simulates every transaction before you approve it. A DustJar claim shows a single change: SOL in. If you ever see a token leaving, or SOL going anywhere other than the fee wallet or the destination you chose, do not approve it and tell us.
First live transaction, 5 September 2026: 4zT1L78dyZpR… on Solscan (20 WithdrawExcessLamports, one fee transfer, owner received 0.0036 SOL).
Why your wallet may warn you
dustjar.xyz was registered on 5 September 2026. Wallets flag new domains, and rightly so. The warning is about the age of the domain, not about what the transaction does; the transaction is what to read.
Reporting
Found something wrong? Email help@dustjar.xyz. Our security.txt carries the same contact.