DEV Community

Eze
Eze

Posted on

Token-2022's permanentDelegate Can Seize Your Tokens — Most Traders Don't Know It Exists

#solana #web3 #blockchain #security

Solana's Token-2022 standard shipped powerful extensions — and most traders have no idea that one of them lets a token authority seize tokens out of your wallet without ever freezing anything.

I scanned real mints this week while adding Token-2022 support to my open-source scanner, and the dangerous patterns are live on mainnet right now — including in tokens you'd never suspect.

The extension that should change how you think: permanentDelegate

The permanentDelegate extension grants one authority the power to transfer tokens from ANY holder's account, at any time, without approval and without freezing anything.

Read that again: not "the dev can block sells" (freeze authority — well understood). Not "the dev can mint more" (mint authority — well understood). The dev can move your tokens out directly.

Live example: PayPal's PYUSD on Solana is a Token-2022 mint whose account carries permanentDelegate alongside mintCloseAuthority. PYUSD is almost certainly fine — it's PayPal, with everything to lose. But the same extension is available to anonymous deployers launching "the next 100x" at 3 AM, and most buyers have no idea it exists.

The other four to check

Extension Risk Why it matters
defaultAccountState: frozen honeypot Every new wallet receives frozen tokens — you can buy but never sell
transferFeeConfig hidden tax On-chain transfer fee baked into the token itself, changeable by authority
transferHook gating A program can intercept or alter every transfer
mintCloseAuthority cleanup risk The mint account itself can be closed

How to check any token in 30 seconds

The extensions are visible in the mint account's parsed JSON via any Solana RPC:

import json, urllib.request

body = {"jsonrpc": "2.0", "id": 1, "method": "getAccountInfo",
        "params": ["<MINT_ADDRESS>", {"encoding": "jsonParsed"}]}
req = urllib.request.Request("https://api.mainnet-beta.solana.com",
    data=json.dumps(body).encode(), headers={"Content-Type": "application/json"})
with urllib.request.urlopen(req, timeout=15) as r:
    v = json.loads(r.read().decode())["result"]["value"]

is_t22 = v["owner"] == "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb"
exts = v["data"]["parsed"]["info"].get("extensions", [])
print("Token-2022:", is_t22)
for e in exts:
    print(" extension:", e["extension"])
Enter fullscreen mode Exit fullscreen mode

Or use SolSniper (my open-source scanner, MIT): v0.3.0 detects Token-2022 mints and scores each dangerous extension — permanentDelegate +0.20, default-frozen +0.25, transfer fees +0.10 — with the usual context damping for established tokens. Full disclosure: I built it, it's free, no telemetry.

pip install git+https://github.com/ezequiellich44-cmd/SolSniper.git
solsniper scan <MINT>
Enter fullscreen mode Exit fullscreen mode

The uncomfortable takeaway

Token-2022 adoption is growing because the extensions are genuinely useful — transfer fees fund treasuries, hooks enable compliance. But every capability is symmetric: the same permanentDelegate that lets a regulated issuer claw back stolen funds lets an anonymous deployer claw back yours.

Check the extensions before you ape. All of them.

Verified against PYUSD's live mint account (2b1kV6Dk…, carrying mintCloseAuthority + permanentDelegate + transferFeeConfig) and classic SPL tokens (BONK) as the negative control. Not financial advice.

Top comments (0)