Solana’s token safety advice has been stable for years. Check the mint authority. Check the freeze authority. Check whether the liquidity pool is burned. That checklist worked because the original SPL token program only had those levers.

Then Token-2022 arrived, and the checklist quietly stopped covering the mint.

Token-2022, formally the Token Extensions Program, is a second token standard on Solana. It keeps the same account model but adds optional features called extensions, enabled when the mint or token account is created. Most extensions cannot be added later, which is the part that matters for you as a buyer: what you see on the token page is what the token is (Solana docs).

Some of those extensions are pure product features. Transfer fees let an issuer take a cut on every trade. Confidential balances hide amounts. Metadata lives on the mint instead of a separate program. Others are governance powers, and governance powers held by someone you do not know are the same thing as risk.

The five extensions that change your downside

Read these as questions to ask about a mint, not as a list of exploits. Each one is legitimate. Each one can also be pointed at holders.

Permanent delegate. The mint can name an authority that can authorize transfers and burns for any token account of that mint. It acts as a global delegate, and token account owners cannot revoke it. The mint authority can rotate it later using SetAuthority with the PermanentDelegate type (Solana docs). In plain terms: the delegate can empty your balance without your signature, and rotating the delegate address does not require your consent.

This is where the old freeze-authority habit fails. A freeze authority stops you from moving your tokens. A permanent delegate moves them for you. Burning your own mint authority does not remove an existing permanent delegate, because the delegate is its own authority.

Transfer hook. The mint can require a program call on every transfer. If the hook rejects the transfer, the transfer does not happen (Solana docs). The docs are explicit that the sender’s signer privileges do not extend to the hook program, which is a good design decision, but it does not help you: a hook can still be written to allow buying and reject selling for wallets it does not like. That is a honeypot implemented at the token standard level, and no approval list will show it.

Default account state. This extension sets the state of every new token account for the mint. If the default is frozen, a new holder receives tokens into a frozen account and cannot transfer them until the freeze authority thaws the account. Buyers see a balance in their wallet and a working price chart. The exit is controlled by someone else.

Pausable mint. A pause authority can pause the entire mint, which makes the token program reject transfers, mints, and burns. Resume restores normal operation (Solana docs). This is a legitimate compliance feature. It is also a switch that can be flipped while you are holding.

Transfer fee. The mint can withhold a fee on every transfer, with the rate and maximum set by a fee authority. The money is deducted from what arrives, not from a separate balance. A high enough rate makes a trade economically pointless even when the chart says there is liquidity. There is also a non-transferable variant, which is self-explanatory and occasionally appears on tokens that are marketed as tradable.

There are more, including confidential transfers that hide amounts, interest-bearing balances, and metadata pointers. The five above are the ones that decide whether your position can be moved, frozen, or made unsellable.

Why “authorities are revoked” is not enough

A revoked mint authority means nobody can print more supply. A revoked freeze authority means nobody can freeze your account directly. Neither statement says anything about a permanent delegate, a transfer hook, or a default-frozen mint.

They are separate authorities on separate extensions. The common rug checklist looks at the base mint and the pool, and reports “safe” for a token that carries a mint-level transfer hook with a sell block for anyone outside an allowlist.

That is not a theoretical gap. The whole point of extensions is that they let an issuer enforce rules at the token layer. When the issuer is honest, those rules are the product. When the issuer is not, the rules are the trap, and the on-chain data looks identical in both cases. The difference lives in who controls the authority and what the hook program does.

How to check a Token-2022 mint before buying

You need three data points: which program owns the mint, which extensions are enabled, and who holds each authority.

  1. Owner program. On Solscan or Solana Explorer, open the mint address and look at the owner. Classic SPL tokens are owned by TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA. Token-2022 mints are owned by TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb. If it is the second one, keep reading.
  2. Extensions list. The token page shows the enabled extensions. With the Solana CLI installed, spl-token display <MINT> prints the same state, including extension data, from your own RPC connection.
  3. Authorities. For each extension that has one, note the address. Permanent delegate, pause authority, freeze authority, fee authority, transfer hook program. Then ask a simpler question: is any of them a wallet you cannot identify, or one that can be rotated without notice?

If a mint has a permanent delegate held by an address you do not recognize, the honest reading is that someone can take your balance. You do not need to prove intent. You need to price the possibility.

What this does to your usual defenses

Approval hygiene does not help here. Revoking token approvals is about allowances: a contract can pull up to the amount you approved. A permanent delegate does not need an allowance. A transfer hook is not a spender. Pausable mints do not ask your wallet for anything. You can have zero approvals and still be unable to sell.

Wallet warnings do not help either. Your wallet displays what it is asked to sign. If the trap is in the mint’s configuration, the transaction you sign is an ordinary swap, and it is the token program that enforces the block.

The defenses that do work are boring. Position sizing on new tokens. A separate wallet for anything with an unfamiliar mint. Reading the extensions before the first buy, not after the price drops. And treating “mint authority burned” as one checked box rather than the whole audit.

A short pre-buy checklist

  • Owner program is Token-2022? Then open the extensions list, not just the holders tab.
  • Permanent delegate present? Find out who holds it. If the answer is “the team”, you are trusting the team with your balance.
  • Transfer hook present? Look up the hook program. If you cannot read what it enforces, assume the worst case and size accordingly.
  • Default account state frozen? Your first buy may be a one-way deposit.
  • Pausable? Someone can stop trading at a moment of their choosing, including the top.
  • Transfer fee? Calculate what arrives after the fee, not what the chart shows.
  • Liquidity still matters. A clean mint with $20,000 of liquidity is still a position you cannot exit.

None of this makes Token-2022 a bad standard. It makes it a standard where the token’s rules are part of the token’s risk, and where the old three-check ritual is incomplete.

If you want the base-layer version of that ritual, our Solana token safety guide covers mint authority, freeze authority, and pool checks. This piece is the layer above it: what the mint can do to you after those three boxes are ticked.

For the wallet side of the same problem, the mechanics of token approvals and how to verify a token before buying still apply. They just do not cover powers that live in the mint.

Sources

Frequently Asked Questions

What is Token-2022 in one sentence?

Token-2022 is Solana's Token Extensions Program, a second token standard that adds optional features to a mint or a token account, including permanent delegates, transfer hooks, transfer fees, confidential balances, and pausable transfers.

How do I know if a Solana token uses Token-2022?

Check the token's owner program on Solscan or Solana Explorer. Classic SPL tokens are owned by TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA. Token-2022 mints are owned by TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb, and the token page lists the enabled extensions. The Solana CLI shows the same thing with spl-token display <mint>.

Can a project steal my tokens with a permanent delegate?

A permanent delegate is a mint-level authority that can authorize transfers and burns for any token account of that mint, and account owners cannot revoke it. Whoever holds that delegate can move your balance without your signature. The mint authority can also rotate the delegate later, so the address can change after you check it.

Does revoking approvals protect me from these extensions?

No. Approval revocation limits what a contract can pull through an allowance. A permanent delegate does not use an allowance at all, and a transfer hook is part of the transfer path itself. With Token-2022, the mint's configuration matters as much as your wallet's permissions.

Is Token-2022 itself a scam?

No. It is an official Solana token program used by serious issuers for real features like transfer fees, compliance controls, and confidential balances. The problem is that the same features are indistinguishable from a trap when you are looking at a token page and cannot tell who holds the authority.

What should I do if I already hold a token with a permanent delegate or active pause authority?

Treat the position as revocable by a third party. If you can sell into liquidity, decide whether the price is worth the risk. If the mint is paused or your account is frozen, there is no on-chain exit. Do not buy more to average down.