Most Solana traders have learned the basic security checklist: before buying a new token, verify that Mint Authority and Freeze Authority are revoked, and confirm that the liquidity pool is burned or locked. However, scammers have evolved by weaponizing advanced extensions inside Solana's Token-2022 (Token Extensions) program. The most dangerous of these is the Permanent Delegate extension.
When a malicious creator initializes a token with an active PermanentDelegate authority, they retain absolute, unrestricted control over every single token in existence forever, even after tokens sit inside your private Phantom wallet or inside a Raydium liquidity pool. In this deep-dive security analysis, we explain how the Permanent Delegate exploit works and how RugPullShield detects hidden Token-2022 backdoors in milliseconds.
What Is the Token-2022 Permanent Delegate Extension?
Solana introduced the Token-2022 program (TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb) to support enterprise and institutional use cases that the original SPL Token program could not handle natively. One of those extensions, PermanentDelegate, was designed for regulated assets (such as compliant stablecoins or soulbound gaming items) where a legal issuer might be required to seize or burn tokens without the account holder's signature.
In the hands of a meme coin scammer, however, PermanentDelegate becomes an invisible god-mode backdoor:
- No Holder Signature Required: The designated delegate wallet can execute a
TransferCheckedorBurninstruction on any Associated Token Account (ATA) holding that mint. - Bypasses Basic Authority Checks: Outdated Telegram bots that only query standard SPL
mintAuthorityandfreezeAuthorityfields often report the token as "Safe / Revoked," completely missing the Token-2022 extension header.
Two Ways Scammers Execute a Permanent Delegate Rug
- The Direct Wallet Clawback: You buy 5 SOL worth of a trending Token-2022 meme coin. Ten minutes later, your position is up 3x. Before you can click sell, the scammer's automated script calls
Burnvia the Permanent Delegate authority on every retail holder wallet that holds more than 0.5% of supply. Your token balance drops to zero without you ever signing a transaction or connecting to a phishing site. - The Liquidity Pool Reserve Drain: As we saw in our Fake Supply Burn Trap breakdown, AMM pricing depends on the ratio of SOL to tokens inside the pool vault. Using Permanent Delegate authority, the attacker transfers 99% of the tokens out of the Raydium pool's token vault into their own wallet and immediately sells them back into the pool, extracting 100% of the SOL liquidity even though LP tokens were burned.
Standard SPL Token vs. Malicious Token-2022 Extensions
| Feature / Risk Vector | Standard SPL Token (Authorities Revoked) | Token-2022 with Active Permanent Delegate |
|---|---|---|
| Program ID | TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA |
TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb |
| Can Creator Move Your Tokens? | Impossible once tokens are in your wallet | Yes, at any time without your approval |
| Is Burned LP Truly Safe? | Yes, pool reserves cannot be seized | No, delegate can empty the pool's token vault |
How to Protect Yourself Before Swapping
Never rely on surface-level "Mint Revoked" badges when trading tokens deployed under the Token-2022 program. Enforce these three security steps on every trade:
- Run a Deep Extension Scan on RugPullShield: Paste the token address into RugPullShield. Our engine inspects the raw mint account buffer, decodes all Token-2022 TLV (Type-Length-Value) extension headers, and immediately flags active
PermanentDelegate, hiddenTransferFeeConfig(100% sell taxes), and Default Account State freeze traps. - Prefer Clean Standard SPL Deployments: Honest creators who launch community tokens via SolanaTokenCreator use the battle-tested, transparent SPL standard with revoked authorities so buyers never face hidden extension hooks.
- Automate Your Pre-Trade Safety Checks: Combine contract scanning with disciplined execution terminals like PumpTraderBot to filter out hazardous contracts before your capital enters the pool.