What Are the Permissions of a Token-2022 Permanent Delegate?

A Permanent Delegate has unlimited authority over all token accounts under that Mint, can transfer or burn any amount of tokens at any time, and cannot be revoked. Solana's official documentation admits it is a "double-edged sword." It was designed for compliance, recovery of mis-transferred funds, etc., but once abused, the tokens you hold can be emptied within seconds after a trade is confirmed.

1. After acquiring a Token-2022 token, first check if there is a "Permanent Delegate"

Before making any trade, spend 10 seconds doing the following.

Step 1: Check the token's extension information on a block explorer

• What to do: Use Solscan or SolanaFM to view the token's details page and confirm whether the "Permanent Delegate" extension is enabled.

• How to do it:

  • Open Solscan, and enter the token's Mint Address in the search box.

  • Go to the token details page and find the "Extensions" or "Token Extensions" section.

  • Scroll down to see if Permanent Delegate is listed.

• When to consider it done: Confirm that there is no "Permanent Delegate" in the token's extension list. If there is one, proceed to Step 2.

Step 2: If Permanent Delegate is found, identify who the delegate address is

• What to do: Find the specific wallet address bound to the Permanent Delegate field.

• How to do it:

  • In Solscan's token extension area, after Permanent Delegate, there will be a "Delegate" or "Authority" address.

  • Click on this address to view its transaction history and holdings. If it is the project's official multisig wallet or a known compliance team address, it may be normal use. If it is an unlinked new address or has no public identity, stop immediately.

• When to consider it done: You clearly know who this delegate address belongs to, or you have confirmed it does not exist (i.e., the token has not enabled this extension).

Prerequisites: Any Solana wallet (Phantom, Backpack, etc.) supports viewing Token-2022 tokens; you do not need a balance to check token information.

Key reminder: The older SPL Token (Token Program v1) does not have this extension feature. This is a new feature of the Token-2022 standard, only available for new tokens. If you are trading old SPL tokens, you don't need to worry about this issue.

2. What exactly can a Permanent Delegate do?

The official documentation says this feature can be used for compliance sanctions, token recovery (e.g., if you send tokens to the wrong address, someone with authority can retrieve them for you), and other scenarios.

But when it comes to specific permissions, it boils down to one sentence:

It can burn or transfer any amount of tokens from any token account under that Mint, without any limit.

No restrictions. No time limit ("permanent"), no quantity limit ("unlimited"). This address can transfer your tokens whenever it wants and in any amount it wants.

3. A real-world incident

In September 2024, a member of the Jupiter community bought a token called "RED". The wallet displayed a successful transaction, and the tokens appeared to be credited.

Seven seconds later, all the RED tokens in his wallet were destroyed (burned), and the balance went to zero.

The reason was that the token's Mint address had the Permanent Delegate extension enabled. The scammer, while selling tokens, used the delegate authority to directly burn the tokens the buyer had just received.

Risk warning: This is not a traditional Rug Pull where the project team runs away; your held tokens are directly deleted from the chain. No matter how well you protect your wallet's private key, it's useless because the authority is at the token contract level. The risk of fund loss is extremely high.

4. When can a Permanent Delegate be acceptable?

Not all tokens with this extension are scams. There is only one condition under which it may be considered:

The address belongs to a well-known compliant stablecoin issuer or the official security multisig of a major DeFi protocol. For example, a compliant stablecoin may need this permission to freeze addresses involved in hacks or to execute sanctions in compliance with regulatory requirements.

Even then, you still bear the risk that "if this address is compromised or abused internally, your tokens will disappear".

Common failure reason: Some beginners only look at the token name and symbol, think "it looks like a real project", and jump right in. But the Permanent Delegate is written at the token's contract base layer, it is often noted in small print on the trading page, and many people just click "Confirm" without reading.

After completing the above checks, how to confirm safety?

You see that the token's extension list on Solscan does not include "Permanent Delegate", or if it does, you can clearly state which trusted entity that delegate address belongs to — do not buy such a token until both conditions are met. If you already hold it and find a permanent delegate from an unknown address, it is recommended to sell immediately and convert to SOL or USDC.