Free score in seconds. No sign-up, no wallet. Mint addresses and links from DexScreener, Jupiter, pump.fun, Birdeye, Solscan and GMGN all work.

Home › Blog › How to check if a Solana Token-2022 token has a permanent delegate or transfer hook

How to check if a Solana Token-2022 token has a permanent delegate or transfer hook

November 5, 2026 · 4 min read · by the Rugsight team

Classic SPL tokens only give a creator two long-lived controls: mint authority and freeze authority. Token-2022 (Token Extensions) adds more. Some of them are useful for regulated assets. Others let a key holder's address move, tax, block or pause transfers without ever touching the mint authority field. This guide covers the extensions that matter most for rug-risk checks, how to read them yourself, and how they show up in a Rugsight free score.

For the classic authorities, start with how to check mint and freeze authority. For the full checklist, see how to check a Solana token for rug-pull risk.

Classic SPL vs Token-2022

Every Solana token mint is owned by one of two programs:

If the mint is on the classic program, it cannot have Token-2022 extensions. If it is on Token-2022, open the mint on Solscan or Solana Explorer and look for an Extensions section. That list is the source of truth; marketing sites often omit it.

Permanent delegate

A permanent delegate is an address that can transfer or burn tokens from any token account of that mint, without the holder's signature. It is stronger than freeze authority: freeze stops movement; a permanent delegate can move the tokens itself.

How to check:

  1. Open the mint on an explorer.
  2. Confirm the owner program is Token-2022.
  3. Find Permanent Delegate (or the extension named that way). Note the address.
  4. Ask who controls that address. If it is the deployer, a fresh wallet, or an unverified multisig, treat it as full custody risk.

On Rugsight this surfaces as a high-severity PERMANENT_DELEGATE flag when present.

Transfer hook

A transfer hook points at a program that runs on every transfer. The hook can refuse the transfer, rewrite behaviour, or enforce allowlists. A benign hook (for example compliance for a regulated token) and a malicious one look the same in the mint account: you only see that a program is configured.

How to check:

  1. On the mint's Extensions list, find Transfer Hook.
  2. Open the hook program id on the explorer. Prefer audited, well-known programs over anonymous ones deployed the same day as the mint.
  3. If the project cannot name what the hook does in plain English, do not assume it is harmless.

Rugsight flags TRANSFER_HOOK when the extension is present. It does not execute or audit the hook program.

Transfer fee

Token-2022 can take a transfer fee on every move, paid to a withdraw authority. Modest fees exist on some real products. Very high fees can make selling impractical: you send tokens and most of them never arrive at the buyer.

How to check:

  1. Read the transfer-fee extension: basis points (100 bps = 1%) and max fee.
  2. Check who the withdraw authority is.
  3. Compare the fee to what the project claims. A screenshot of "0% tax" means nothing if the on-chain fee is 50%.

Rugsight uses TRANSFER_FEE for a configured fee and HIGH_TRANSFER_FEE when the rate is high enough to be a practical trap.

Default account state (frozen by default)

Default account state can make every newly created token account start frozen. Holders then need someone with freeze authority (or a thaw path) before they can sell. Combined with an active freeze authority, this is a strong control surface.

Rugsight flags DEFAULT_FROZEN when new accounts start frozen.

Pausable

A pausable extension lets a pause authority stop all transfers for the mint. Useful for incident response on an issuer-controlled asset; dangerous on an anonymous meme coin.

Rugsight flags PAUSABLE when the extension is enabled.

Non-transferable (soulbound)

Some Token-2022 mints are non-transferable. That is not a classic rug (you were never meant to sell), but it is a hard stop if you expected a tradable token. Confirm the mint matches the product you think you are buying.

Rugsight flags NON_TRANSFERABLE.

How to read the mint with RPC

If you prefer a raw view, call getAccountInfo on the mint with jsonParsed encoding against any Solana RPC. For Token-2022 mints the parsed info includes an extensions array. Look for types such as permanentDelegate, transferHook, transferFeeConfig, defaultAccountState, pausableConfig, and nonTransferable. The classic program simply has no such array.

You can also run spl-token display <MINT> with a Token-2022-aware Solana CLI; it prints the same extensions in text form.

Red flags

None of these prove intent. They are technical controls you can verify before you buy.

What Rugsight checks

Paste a mint into Rugsight or call GET /api/score/<mint>. The free score includes Token-2022 program detection and the extension flags above (alongside mint/freeze authority, holder concentration, liquidity and main-pool LP burn/lock). Issuer-controlled assets on a short allowlist (for example some stablecoins) may show grade IC instead of a letter when those controls are expected by design.

The free token page also shows a holder-concentration preview; the 1 USDC report adds the top-20 holders, authority addresses and per-flag write-ups.

Rugsight is an automated technical tool. Nothing here is financial advice.

Check a token

Paste a mint on the home page, or start from BONK, WIF, all popular tokens or the new-token feed. See what the paid report contains in the free sample.

More from the blog