Whitelist

A whitelist is a list of approved items, such as users, wallet addresses or websites, that are allowed to do something everyone else is not. In crypto the word has two main meanings. In token sales and NFT launches, it is the list of addresses allowed to buy or mint early, often at a lower price. In account security, it is the set of addresses a user has pre-approved as destinations for withdrawals from an exchange or wallet.

Many organisations now prefer the neutral term "allowlist" (and "denylist" or "blocklist" for the opposite), and both words appear in crypto. The opposite of a whitelist is a blacklist: a list of addresses that are blocked, such as those frozen by a stablecoin issuer; see stablecoin freezing. Whitelists are a tool, not a guarantee of fairness or safety, and both kinds have known weaknesses.

Think of a guest list at the door of a party. If your name is on the list, you get in early and perhaps get a free drink; if not, you queue with everyone else or are turned away. A sale whitelist is that list: a set of names allowed in before the crowd.

A withdrawal whitelist is more like telling your bank, "only ever send my money to these three accounts". Even if a thief gets into your online banking, they cannot send the money anywhere new without passing extra checks and waiting.

Projects launching a token or an NFT collection often run a whitelist phase before the public sale. Places are typically awarded for:

• Community activity. Joining chat groups, inviting others or completing tasks, sometimes through a bounty campaign.
• Holding other assets. Owning tokens from an earlier collection, as with many profile-picture NFT projects.
• Investor checks. In regulated offerings, passing KYC and eligibility checks, for example to exclude residents of certain countries.
• Raffles. A random draw among applicants, used when demand exceeds places.

Whitelisted buyers can take part in a token pre-sale, an IDO on a launchpad, or an early NFT mint, often with a guaranteed allocation and lower gas competition. Storing thousands of addresses directly in a smart contract is expensive, so many projects store only the root of a Merkle tree built from the list. Each buyer submits a short proof that their address is included, and the contract checks it before allowing the mint. Others use signatures issued by the project's server.

Whitelist rounds are often combined with limits on how much each address may buy and with the overall hard cap of the sale. Some launchpads require applicants to hold or stake a minimum amount of the launchpad's own token, which critics say favours large holders, or whales. Because one person can control many addresses, per-address limits are easy to get around unless the list is tied to verified identities.

Many centralised exchanges and custody providers let users switch on a withdrawal whitelist. Once enabled, funds can be sent only to addresses on the user's approved list. Adding a new address normally requires extra verification, such as an email confirmation and two-factor code, and may trigger a waiting period before the new address can be used.

This protects against account takeover: an attacker who obtains a user's password, or takes over their phone number through SIM swapping, cannot immediately move funds to their own address. It also reduces the risk of sending to a wrong or poisoned address, a tactic behind the address poisoning scam. Institutional custody platforms and multi-signature wallets use similar allowlists as policy controls, sometimes combined with approval by several people.

Whitelisting also appears in compliance. Under the travel rule, some providers require customers to register or verify ownership of self-hosted wallets before sending funds to them.

• Insider advantage. Sale whitelists can be filled with insiders and friends, who then sell to the public at higher prices on launch, a pattern seen in some pump-and-dump schemes.
• Bots and fake accounts. Projects that award places for social activity attract automated accounts, and sniper bots target the first moments of public trading.
• Phishing. Fake "whitelist" offers in chat groups and social media lure users to malicious sites that drain wallets; see identifying crypto scams.
• Smart contract bugs. Errors in whitelist checks have let non-listed addresses mint, or let listed buyers mint more than allowed.
• False confidence. A withdrawal whitelist helps only if the email account and devices used to change it are also secure.

• ethereum.org: Introduction to smart contracts