Candy Machine v2 is a Metaplex smart contract that lets creators launch and sell an NFT collection on Solana in a controlled, fair way, instead of dumping every token into one wallet at once. It manages the mint: taking payment, releasing one NFT per transaction, and enforcing whatever rules the creator sets, from a start time to a bot tax.
Here’s the short version: v2 is the second release of Metaplex’s Candy Machine program, built in late 2021 after a flaw in the first version let attackers drain live mints. It’s since been superseded by newer versions, but understanding how it worked still explains most of what a Solana NFT drop actually is. This guide moves from the plain definition to the mechanics, the incidents that shaped it, and where the program stands today.
What Is Candy Machine v2?
A Solana candy machine is a program deployed by a creator, loaded with a fixed batch of NFT metadata, and then opened to the public at a set time. Buyers send a transaction, the program checks it against the rules in place, and — if everything clears — mints one NFT to the buyer’s wallet and moves the payment to the creator’s treasury.
Candy Machine (Metaplex): an on-chain Solana program that manages the sale and distribution of an NFT collection, handling payment, minting, and access rules in a single automated flow. See Metaplex’s own documentation for the current program reference.
The name is literal. Metaplex describes it as “a temporary structure which is first loaded by creators and then unloaded by buyers” — you fill it with items, open it, and it empties out one mint at a time until the supply runs out. That’s a useful mental model even now that most new launches don’t run on this exact version.
Metaplex’s own scale gives a sense of how central this program became to Solana NFTs: over 500 million NFTs and 3 million fungible tokens have been created through its protocols since 2021, according to a 2025 ChainCatcher interview with Stephen Hess, Chairman of the Metaplex Foundation. By September 2022, 78% of all NFTs minted on Solana had gone through a Candy Machine, per Metaplex’s own documentation.
Why Was Candy Machine v2 Built?
The metaplex candy machine concept didn’t start at v2. The original version launched in 2021 and quickly became the default way to run a Solana NFT drop, but it shipped with a bug that eventually cost creators real money.
The flaw was a reinitialization issue: the program didn’t check whether an account had already been set up before accepting new instructions against it. An attacker could inject a pre-initialized account and use that gap to take control of a live candy machine mid-transaction.
The January 2022 Exploit
On January 4, 2022, someone used exactly that bug. Over roughly 52 minutes, the attacker targeted 4,410 of the 14,800 candy machines active at the time and fully drained 3,470 of them, according to a technical writeup by developer JonLuca.
The stolen funds — 1,027 SOL — were converted to about 155,000 USDC and moved off-chain before most creators even noticed. Metaplex patched the vulnerability at 6:20 a.m. EST, in the middle of the attack, which is the only reason it didn’t drain every machine on the network.
That incident is the practical reason v2 exists. Nearly 4,000 projects losing funds to the same exploitable pattern is not something a minting platform can leave unfixed, and v2 rebuilt the account-initialization logic to close that specific hole while keeping the same creator-facing workflow.
Who Uses Candy Machine v2?
The program was built for anyone launching a Solana NFT collection rather than minting a single one-off piece. A few groups made up most of its actual usage:
- PFP and generative art projects — the 10,000-piece profile-picture collections that defined the 2021–2022 Solana NFT wave, where uniform mint pricing and a hard supply cap mattered most.
- Gaming studios — teams distributing in-game items or characters as NFTs, often paired with hidden settings to reveal traits after the mint closes.
- 1-of-1 artists — individual creators running smaller, curated drops who still wanted whitelist access and bot protection without building custom infrastructure.
- Event and community projects — allowlist-gated drops for an existing token or NFT holder base, using v2’s whitelist settings to restrict who could mint before the public window opened.
What ties these together is scale and fairness, not just the act of minting. A single artist selling one piece doesn’t need a queue system or a bot tax; a project selling 10,000 identical-priced NFTs to an anonymous crowd does.
How Does Candy Machine v2 Work?
Setting one up means configuring a handful of on-chain settings before the mint goes live, then uploading the collection’s metadata to storage — typically Arweave, accessed through Solana’s arweave-sol storage option.
| Setting | What it controls |
|---|---|
price | Cost per mint, in SOL |
number | Total NFTs available in the collection |
solTreasuryAccount | Wallet that receives mint proceeds |
goLiveDate | Timestamp when public minting opens |
whitelistMintSettings | Early or discounted access for a specific token/NFT holder list |
gatekeeper | CAPTCHA-style bot check before a mint transaction is accepted |
hiddenSettings | Ships all NFTs with placeholder metadata, revealed after the sell-out |
endSettings | Defines when the mint window closes, by date or supply |
noRetainAuthority / noMutable | Whether the creator keeps update authority or metadata can still change post-mint |
Once these are set and assets are uploaded, the candy machine account holds the full configuration on-chain. Every mint transaction is checked against it in real time — there’s no separate approval step or manual review once the drop is live.
Guards and Bot Protection
The gatekeeper setting is the direct product of a second incident, separate from the January exploit. On May 1, 2022, bots targeting a live candy machine mint generated 4 million transaction requests and 100 gigabits of data per second, according to CoinDesk’s reporting at the time — enough to push validators out of consensus and halt the network for roughly seven hours.
Metaplex’s response was a 0.01 SOL “botting penalty”: a small charge applied to failed or excessive mint attempts, making it expensive for bots to spam the same transaction thousands of times per second. That penalty, alongside the CAPTCHA gatekeeper, became the baseline anti-bot toolkit that later versions expanded on.
Stephen Hess described the pace of that period plainly in the ChainCatcher interview: “after its release, there was huge demand for Candy Machine, and we were racing against user demand almost every week, striving to keep up with the evolution and demand of the market.” Bot resistance wasn’t a feature added in advance — it was built under the pressure of the network actually breaking.
Is Candy Machine v2 Still Used Today?
No, not for new launches. Metaplex’s current documentation marks the whole Token Metadata–era Candy Machine line — v1 through v3 — as deprecated, directing creators to Core Candy Machine instead.
| Version | Status | NFT format | Notes |
|---|---|---|---|
| Candy Machine v1 | Deprecated | Token Metadata | Retired after the January 2022 exploit |
| Candy Machine v2 | Deprecated | Token Metadata | Added bot protection and whitelist/gatekeeper settings |
| Candy Machine v3 | Deprecated, unmaintained | Token Metadata | Introduced ~21 configurable guards |
| Core Candy Machine | Current | MPL Core Assets | 23+ guards, cheaper single-account NFT model |
The practical difference between v3 and Core Candy Machine is the underlying NFT format. Token Metadata NFTs — what v1 through v3 all mint — spread a token’s data across several linked accounts, while Core Assets, Metaplex’s newer standard, store everything in one account. Fewer accounts means less rent and lower transaction costs per mint, which is the main reason Metaplex steers new projects toward Core Candy Machine rather than patching the old line further.
None of that erases what v2 did. It’s still the version most tutorials and case studies from 2022 reference, and the guard-based logic it pioneered — pay, verify, mint, one gate at a time — is exactly what Core Candy Machine’s guard system does today, just applied to a different account model.
Candy Machine vs. Ethereum NFT Standards
Readers coming from Ethereum sometimes look for a Candy Machine equivalent to ERC-721 or ERC-1155, but the comparison doesn’t map cleanly. ERC-721 and ERC-1155 are token standards — the interface a smart contract implements. Candy Machine is a distribution program that sits on top of Solana’s own NFT standard, Token Metadata (or Core, for newer collections).
The practical difference shows up at mint time. An Ethereum drop typically calls a mint function directly on the collection’s own contract, while a Solana drop mints through the candy machine program, which then hands the resulting token off to the buyer. It’s an extra layer, but it’s what makes features like the gatekeeper and whitelist settings possible without every project writing that logic from scratch — something our guide to minting an NFT covers in more depth across both ecosystems.
What Infrastructure Does a Candy Machine Mint Need?
Every mint transaction against a candy machine — checking the price, verifying a gatekeeper token, confirming supply is left — is a read or write against the Solana blockchain. At any real scale, that’s a constant stream of RPC calls, not an occasional lookup.
A team running its own Solana validator to handle that traffic takes on real operational weight: hardware, uptime, and keeping pace with network upgrades. A provider such as NOWNodes offers RPC access to Solana and 120-plus other networks, letting a minting site or marketplace send and read transactions through an API instead of syncing and maintaining its own node.
That infrastructure layer matters most in exactly the moments Candy Machine v2’s history highlights — a launch going live to a crowd that includes bots as well as buyers is precisely when connection reliability gets tested hardest.
Risks and Limitations of Using Candy Machine
The biggest risk isn’t unique to v2, but the exploit history makes it concrete: any program holding creator funds and controlling access to a scarce asset is a target, and code that hasn’t been independently reviewed is a real liability. Projects deploying custom guards or forks of the program should treat an independent smart contract audit as standard practice, not an optional step.
Bot competition is the second practical limitation. Even with a gatekeeper and botting penalty in place, a popular drop still draws automated buyers trying to grab a disproportionate share of supply — the same dynamic covered in our look at Solana sniper bots, which occasionally target NFT mints alongside token launches.
Finally, using v2 (or v3) specifically today means building on a program Metaplex has stated it will not actively maintain going forward. New security patches or feature updates aren’t coming to the deprecated line, so any new project is better served starting on Core Candy Machine instead.
Conclusion
Candy Machine v2 solved a specific problem: letting creators sell a large, uniform NFT collection fairly, without the account bugs and bot floods that hit the first version. Its whitelist settings, gatekeeper checks, and botting penalty became the template every later version, including Core Candy Machine, still follows.
It isn’t the version to build on now — that’s Core Candy Machine, running on Metaplex’s cheaper Core Asset format. But understanding how v2 worked, and what it took to build in response to two network-shaking incidents, is still the fastest way to understand what a Solana NFT drop actually does under the hood.
FAQ
Is Candy Machine v2 the same as Candy Machine v3?
No. Both mint Token Metadata NFTs and share the same core mint-and-guard workflow, but v3 replaced v2’s fixed setting list with roughly 21 composable guards, giving creators more granular control over access rules and payment types.
Can I still deploy a new NFT collection with Candy Machine v2?
Technically the program still exists on-chain, but Metaplex has marked it deprecated and unmaintained. New projects should use Core Candy Machine, which supports more guards and runs on a cheaper NFT account model.
How much does it cost to mint through a candy machine?
The mint price is whatever the creator sets in the price field, paid in SOL, plus Solana’s network fee, which typically runs a fraction of a cent. There’s no fee charged by Metaplex itself for using the program.
What happened during the Candy Machine bot attack in May 2022?
Bots targeting a live mint sent roughly 4 million transaction requests per second, pushing Solana’s validators out of consensus and halting the network for about seven hours. Metaplex responded with a 0.01 SOL botting penalty to make repeated bot transactions costly.
Does Candy Machine work on blockchains other than Solana?
No. Candy Machine is a Solana-specific program built on Metaplex’s NFT standards. Other chains use their own minting patterns — Ethereum-based drops typically mint directly from an ERC-721 or ERC-1155 contract instead of a separate distribution program.
