Token-2022 Risks: Permanent Delegate, Transfer Fees and Hooks
Solana's Token-2022 extensions add powerful features — and new scams. Learn how permanent delegate, transfer fees and transfer hooks can be abused and how to check.
TRENCHSCORE RESEARCH··3 MIN READ
Most Solana tokens use the original SPL Token program. Token-2022 (also called Token Extensions) is a newer program that lets a token add optional features — fees, interest, confidential transfers, custom transfer logic. Those features exist for real use cases like regulated assets and payments. In the wrong hands, a few of them are perfect scam tools.
//Permanent delegate
The permanent delegate extension gives one address unlimited authority over every holder's balance of that token. Solana's own documentation describes it as unrestricted delegate privileges over all token accounts for the mint, able to burn or transfer tokens without limit. The stated purpose is things like recovering mistaken transfers or sanctions compliance for regulated tokens.
For a memecoin, it means the creator can take or burn your tokens whenever they like. In September 2024, members of Jupiter's community reported a scam in which a token's permanent delegate burned buyers' tokens around seven seconds after their swaps — the purchase showed in their history, but the balance was gone.
Verdict for memecoins: a permanent delegate is a walk-away signal.
//Transfer fee
The transfer fee extension charges a percentage on every transfer and holds it for the fee authority to withdraw. It works like a buy/sell tax on EVM tokens. A small, fixed fee can be legitimate. Check two things: the size of the fee, and whether the fee authority can raise it.
//Transfer hook
A transfer hook calls a separate program on every transfer. It can enforce rules — for example, royalties or allowlists. It can also be used to block sells or add conditions only the creator can satisfy. Because the logic lives in another program, it's harder to read. Unless you know exactly what the hook does, treat it as a reason for caution.
//Other extensions worth knowing
| Extension | Legitimate use | Risk if abused |
|---|---|---|
| Permanent delegate | Compliance, recovery | Tokens taken or burned from any wallet |
| Transfer fee | Protocol revenue | Hidden or raised tax on every move |
| Transfer hook | Royalties, allowlists | Sells blocked or conditioned |
| Default account state (frozen) | Gated / KYC tokens | New holders frozen until approved |
| Non-transferable | Soulbound credentials | Can't be traded at all |
| Metadata pointer / update authority | Updating branding | Name and logo changed to impersonate another token |
//These sit on top of the usual checks
Token-2022 tokens still have mint and freeze authorities. Check those first — see mint and freeze authority explained — then check extensions, then liquidity and holders as usual.
//How to check a token's program and extensions
- 01Open the mint address on a Solana explorer. The token's program is listed — "Token-2022" or "Token Extensions" means you should look at the extensions list.
- 02On TrenchScore, Solana token pages run a contract audit that surfaces Token-2022 risks, including transfer fees and other dangerous configurations. Critical issues lower the TrenchScore sharply or exclude the token from the Trench 100.
//Bottom line
Token-2022 isn't bad — it powers real products. But memecoins rarely need any extension, and the ones scammers like (permanent delegate, transfer hooks, adjustable fees) give the creator power over your wallet's balance. Check before you buy, every time. Pair this with the full rug pull red-flag list.
//Frequently asked questions
What is a permanent delegate on Solana?+
It's a Token-2022 extension that gives one address unlimited authority to transfer or burn any holder's balance of that token. It has compliance uses, but on a memecoin it lets the creator take your tokens.
Is Token-2022 a scam?+
No. It's an official Solana token program with useful features. The risk comes from specific extensions — permanent delegate, transfer hooks and changeable transfer fees — that can be abused by token creators.
How do I know if a token uses Token-2022?+
Look up the mint address on a Solana explorer; the token program is shown on the overview. If it's Token-2022, review the listed extensions before buying.
// Sources
Educational content, not financial advice. Crypto assets are highly risky and most new tokens lose most of their value — always do your own research.