Solana's Token-2022 standard shipped powerful extensions — and most traders have no idea that one of them lets a token authority seize tokens out of your wallet without ever freezing anything.
I scanned real mints this week while adding Token-2022 support to my open-source scanner, and the dangerous patterns are live on mainnet right now — including in tokens you'd never suspect.
The extension that should change how you think: permanentDelegate
The permanentDelegate extension grants one authority the power to transfer tokens from ANY holder's account, at any time, without approval and without freezing anything.
Read that again: not "the dev can block sells" (freeze authority — well understood). Not "the dev can mint more" (mint authority — well understood). The dev can move your tokens out directly.
Live example: PayPal's PYUSD on Solana is a Token-2022 mint whose account carries permanentDelegate alongside mintCloseAuthority. PYUSD is almost certainly fine — it's PayPal, with everything to lose. But the same extension is available to anonymous deployers launching "the next 100x" at 3 AM, and most buyers have no idea it exists.
The other four to check
| Extension | Risk | Why it matters |
|---|---|---|
defaultAccountState: frozen |
honeypot | Every new wallet receives frozen tokens — you can buy but never sell |
transferFeeConfig |
hidden tax | On-chain transfer fee baked into the token itself, changeable by authority |
transferHook |
gating | A program can intercept or alter every transfer |
mintCloseAuthority |
cleanup risk | The mint account itself can be closed |
How to check any token in 30 seconds
The extensions are visible in the mint account's parsed JSON via any Solana RPC:
import json, urllib.request
body = {"jsonrpc": "2.0", "id": 1, "method": "getAccountInfo",
"params": ["<MINT_ADDRESS>", {"encoding": "jsonParsed"}]}
req = urllib.request.Request("https://api.mainnet-beta.solana.com",
data=json.dumps(body).encode(), headers={"Content-Type": "application/json"})
with urllib.request.urlopen(req, timeout=15) as r:
v = json.loads(r.read().decode())["result"]["value"]
is_t22 = v["owner"] == "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb"
exts = v["data"]["parsed"]["info"].get("extensions", [])
print("Token-2022:", is_t22)
for e in exts:
print(" extension:", e["extension"])
Or use SolSniper (my open-source scanner, MIT): v0.3.0 detects Token-2022 mints and scores each dangerous extension — permanentDelegate +0.20, default-frozen +0.25, transfer fees +0.10 — with the usual context damping for established tokens. Full disclosure: I built it, it's free, no telemetry.
pip install git+https://github.com/ezequiellich44-cmd/SolSniper.git
solsniper scan <MINT>
The uncomfortable takeaway
Token-2022 adoption is growing because the extensions are genuinely useful — transfer fees fund treasuries, hooks enable compliance. But every capability is symmetric: the same permanentDelegate that lets a regulated issuer claw back stolen funds lets an anonymous deployer claw back yours.
Check the extensions before you ape. All of them.
Verified against PYUSD's live mint account (2b1kV6Dk…, carrying mintCloseAuthority + permanentDelegate + transferFeeConfig) and classic SPL tokens (BONK) as the negative control. Not financial advice.
