Just to clarify on this—the contract is legitimate and the dApp poses no threat. Everything here checks out from a security standpoint.

For reference, the official programs involved are:
- Metaplex Token Metadata Program (metaqbxxUerdq28cj1RbAWkYQm3ybzjb6a8bt518x1s)
- SPL Token Program (TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA)
- Associated Token Program

All three are standard Solana infrastructure components—no sketchy custom code, just the real deal from the ecosystem's official builders.