Safety

Token-2022 explained for traders: extensions that matter

Cover image for Token-2022 explained for traders: extensions that matter

Token-2022 is Solana's second token program. Learn which extensions put holders at risk: transfer fees, permanent delegate, transfer hooks and frozen defaults.

By 8 min read1743 words

Key takeaways

  • Token-2022, also called Token Extensions, is a second Solana token program that keeps the classic SPL Token behaviour and lets each mint opt into extra features called extensions.
  • A Token-2022 permanent delegate can transfer or burn tokens from every holder's account, and a holder cannot revoke it because it is set on the mint rather than on the token account.
  • A Token-2022 transfer fee is withheld from the recipient's amount on every transfer, including sells, and the fee authority can change the rate later.
  • A Token-2022 token account that holds withheld transfer fees cannot be closed until those fees are harvested or withdrawn by the issuer's authority.
  • Most Token-2022 extensions are fixed when the mint is created, so a trader can read the full list on an explorer before buying.

The short answer#

Token-2022, also called Token Extensions, is a second token program on Solana that works like the classic SPL Token program and lets each token switch on optional extensions. Most extensions are harmless. A few, mainly the permanent delegate, transfer hook, transfer fee, non-transferable flag and default frozen state, give the issuer control over a holder's balance or ability to sell.

The extensions are public and mostly fixed at creation, so a trader can read them before buying. The mistake is assuming that "mint and freeze authority revoked" covers a Token-2022 token. It does not.

What is Token-2022, and how does it differ from the classic SPL Token program?#

Token-2022 is a separate on-chain program with its own address, TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb, that lives alongside the original SPL Token program at TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA. Every mint and every token account is owned by exactly one of them, permanently. USDC, SOL's wrapped form and most memecoins are classic SPL tokens. PYUSD is a well-known Token-2022 token.

The core is the same: mints, token accounts, mint authority, freeze authority, delegates, Transfer, Burn, CloseAccount. The difference is that Token-2022 accounts can carry extra data after the standard fields, and that extra data switches on behaviour the classic program has no way to express. A classic token account is always 165 bytes, with a rent deposit of 0.00203928 SOL. A Token-2022 account grows with each extension, so its rent deposit is somewhat higher.

Mint-level extensions generally have to be chosen when the mint is created and cannot be added afterwards. That is good news for traders: what you read today is, for most extensions, what the token will always be. The settings inside an extension, such as the fee rate, can still change if its authority is active.

Which Token-2022 extensions should a trader recognise?#

Eight extensions cover nearly everything a trader will meet. The table rates the risk to a holder of a speculative token; regulated assets use several of these for legitimate reasons.

ExtensionWhat it doesRisk to holder
Transfer feeWithholds a percentage (in basis points, with a maximum cap) from every transfer; fee authority can change itMedium to high: a tax on every sell; rate can be raised later
Permanent delegateOne address can transfer or burn tokens from any holder's accountSevere: balance can be taken or destroyed; holder cannot revoke
Transfer hookRuns a custom program on every transfer, which can reject itHigh: can block sells selectively; breaks many pools and tools
Non-transferableTokens can never leave the account they were minted toSevere for trading: cannot be sold at all; can only be burned
Default account state (frozen)Every new token account starts frozen until the freeze authority thaws itHigh: you may receive tokens you cannot move
Confidential transfersHides transfer amounts and balances using encryptionLow directly; limited tool support, harder to audit supply flows
Metadata / metadata pointerStores name, symbol and URI on the mint itself instead of a Metaplex accountNone by itself; update authority can rename, as with Metaplex
Interest-bearingDisplays a balance that grows at a set rate; no new tokens are mintedLow: cosmetic, but the UI amount differs from the real amount

A few others exist, such as mint close authority, memo-required transfers and CPI guard. They rarely affect a trading decision.

Transfer fee#

The transfer fee extension withholds part of every transfer in the recipient's token account. It is configured as basis points plus a maximum fee per transfer, so 100 basis points is 1%. It applies to every movement, including the transfer into a pool when you sell. The withheld tokens are later collected by the mint's withdraw authority.

Two things to check: the current rate, and whether the transfer fee authority is still active. If it is, the rate can be raised. The program applies a changed fee only after a delay of about two epochs, roughly four days, which gives attentive holders a window but not a guarantee. A small, disclosed fee is a design choice. A large one makes round-trip trading unprofitable by construction.

Permanent delegate#

A permanent delegate is an address, set on the mint, that holds unlimited delegate rights over every token account of that mint. An ordinary delegate is something you grant on your own account with Approve and remove with Revoke. The permanent delegate is not on your account, so Revoke does not touch it. The issuer can move your tokens to themselves or burn them, with no signature from you.

It exists for clawback in regulated assets. On an anonymous token it is the single most dangerous extension. The free Revoke Delegations tool scans your SPL Token and Token-2022 accounts for ordinary delegates you can remove, and also reads the mint of each Token-2022 balance and flags a permanent delegate. It cannot remove one, and nothing can.

Transfer hook#

A transfer hook is a custom program that Token-2022 calls during every transfer, and the transfer fails if the hook returns an error. The hook's author decides the conditions: an allow-list, a trading window, a royalty check, or "only these wallets may sell". The hook cannot move your tokens itself, but it can make them unsellable, which is a honeypot by another route. Hooks also require extra accounts in every transaction that are specific to the hook program, which is why much of the ecosystem refuses them.

Non-transferable, default frozen and the rest#

Non-transferable tokens are "soulbound": they can be burned by the holder but never moved, which suits credentials and is useless for trading. A default frozen state means every new token account is born frozen and only the freeze authority can thaw it; it suits permissioned assets and makes the token's freeze authority a working part of the design. Confidential transfers encrypt amounts; I rarely see them on traded tokens, and tool support is thin. The metadata extension simply relocates the name and URI onto the mint. Interest-bearing tokens change only the displayed amount, so compare raw amounts if the numbers look off.

How do you check a token's extensions before buying?#

Open the mint address on an explorer and read two things: the owner program and the extension list. It takes about a minute.

  1. Copy the token's mint address from the DEX or your wallet.
  2. Open it on Solscan or Solana Explorer. If the owner program is Token-2022, an extensions section appears on the mint's page.
  3. Read every extension and its settings: fee basis points and maximum, permanent delegate address, hook program ID, default state.
  4. Check the authorities inside the extensions, not only the mint and freeze authority. A transfer fee authority set to none means the rate is final.
  5. From a terminal, spl-token display <MINT> prints the same data. The Solana docs describe each extension.

Then run the usual checks on top. Mint and freeze authority work identically on both programs, as covered in mint authority vs freeze authority, and the full pre-buy routine is in how to spot a Solana rug pull.

How do wallets and DEXs handle Token-2022?#

Support is broad for plain Token-2022 mints and uneven for the riskier extensions. Phantom and Solflare display and send Token-2022 tokens. Jupiter routes many of them, and a quote for a transfer-fee token is already net of the fee. Pool programs are selective: DEXs have typically allowed only certain extensions in their pools, and transfer hooks are widely rejected because every swap would need the hook's extra accounts.

The practical upshot for a trader is friction. Expect some bots and aggregators to skip the token, expect the amount received to be lower than the amount sent when a fee applies, and expect occasional tools that simply do not list the balance.

Why can closing a Token-2022 account fail?#

A Token-2022 token account cannot be closed while it holds withheld transfer fees, even when its token balance is zero. On the classic program the only condition for CloseAccount is a zero balance (wrapped SOL excepted), and closing returns the full rent deposit. Token-2022 adds the withheld-fee condition because those fees belong to the issuer, and closing the account would destroy them.

The fix is to move the withheld amount out first. Token-2022 has a permissionless instruction that harvests withheld fees from token accounts to the mint, after which the account closes normally; in practice many holders just wait until the issuer collects. A frozen account is the other common blocker, on either program. General closing safety is covered in is it safe to close Solana token accounts.

How do SOLTidy tools handle both programs?#

Every SOLTidy tool that touches tokens detects which program owns the mint or account and sends its instruction to that program. The specifics:

  • The Token Account Closer scans both SPL Token and Token-2022 accounts and closes empty ones for 5% of the recovered rent.
  • Sell Dust for SOL (1% of SOL received plus 5% of rent) quotes through Jupiter, so a transfer-fee token's quote is already net of the fee. An account with withheld fees will not close until they are harvested, and a frozen account cannot be sold at all.
  • The Multisender (0.0005 SOL per recipient) uses the checked transfer variant for Token-2022, tells you when recipients will receive less because of a transfer fee, and blocks mints with a transfer hook rather than sending transactions that would fail.
  • The free Holder Snapshot drops the fixed 165-byte size filter for Token-2022 mints, since extension accounts vary in size, and matches accounts by mint.
  • The revoke mint and freeze authority tools work on both programs. The Token Creator deliberately creates classic SPL tokens, because they remain the most widely supported choice for a token meant to trade. The metadata editor detects the Token-2022 metadata extension but does not edit it yet.

The reasoning behind those choices, and who builds the tools, is on the about page.

Bottom line#

Token-2022 is not a red flag by itself; it is a container, and the risk is in what the issuer put inside. A permanent delegate, transfer hook, non-transferable flag or default frozen state should stop a speculative buy, and a transfer fee should be priced in along with whether its authority can still raise it. The extension list is public and largely fixed at creation, so reading it costs a minute. Do that before the chart, not after the sell fails.

Questions & answers

What is Token-2022 on Solana?

Token-2022, marketed as Token Extensions, is a token program deployed on Solana alongside the original SPL Token program. It supports the same instructions for minting, transferring and burning, and adds optional extensions that a mint or token account can enable, such as transfer fees, a permanent delegate, transfer hooks and on-mint metadata. Each token belongs to exactly one of the two programs, and that cannot be changed later.

Is a Token-2022 token safe to buy?

It depends entirely on which extensions the mint has. A Token-2022 mint with only the metadata extension behaves like a classic token. One with a permanent delegate, a transfer hook, a high transfer fee, a non-transferable flag or a default frozen state gives the issuer power over your balance or your ability to sell. Read the extension list on an explorer before buying; it is public.

How do I check which Token-2022 extensions a token has?

Open the mint address on Solscan or Solana Explorer. The page shows the owner program, which tells you whether it is Token-2022, and lists the enabled extensions with their settings, such as the transfer fee in basis points or the permanent delegate's address. From a terminal, spl-token display followed by the mint address prints the same information.

Why can't I close my Token-2022 token account?

The usual reason is withheld transfer fees. When a token has the transfer fee extension, fees from incoming transfers accumulate inside the recipient's token account, and the Token-2022 program refuses to close an account while that withheld amount is above zero, even if your balance is zero. Anyone can harvest the withheld fees from the account to the mint, after which it can be closed; a frozen account is the other common cause.

Can a permanent delegate take my tokens?

Yes. The permanent delegate extension gives one address unlimited authority to transfer or burn tokens from any account of that mint, in any wallet, without the holder's signature. It was designed for regulated assets that need clawback. The holder has no instruction that removes it, so the only protection is to check for it before buying and not hold tokens whose issuer you do not trust.

Do Phantom, Solflare and Jupiter support Token-2022?

The major Solana wallets display and transfer Token-2022 tokens, and Jupiter routes swaps for many of them, but support varies by extension. Transfer fees are widely handled, with the fee reflected in the quote. Transfer hooks need extra accounts specific to each hook program, so many pools and tools reject them. Non-transferable and confidential balances have limited support. Expect more friction than with classic SPL tokens.