HostSolana's Token-2022 extension, explained — the features that change risk
Token-2022 adds transfer hooks, transfer fees, and confidential transfers to Solana tokens. Some make tokens safer; some make them harder to sell. Here's how to read which.
Solana's original SPL token program is bare-bones: mint, transfer, approve. Token-2022 is the upgrade — same interface, but with optional extensions that let a token do things the old program never could. Whether that's good or bad for you depends entirely on which extensions the deployer enabled.
Transfer hooks — the token can intercept every trade
A transfer hook is custom code that runs on every transfer. Legitimate uses: block transfers to sanctioned addresses, enforce transfer rules, or add compliance checks. Malicious uses: blacklist sellers or block sells entirely. If a token has a transfer hook, simulate a sell before buying — a hook that only blocks sells is the classic honeypot.
Transfer fees — the built-in tax
Token-2022 can charge a fee on every transfer, withheld automatically. Small fees (0.1%–1%) fund development; large ones (5%+) are how tax tokens extract value. The fee is visible on-chain, so it's not hidden — but it's easy to miss in a swap quote because DEXs don't always surface it clearly.
Confidential transfers — privacy, with a catch
Token-2022 supports confidential transfers using zero-knowledge proofs: balances and amounts hidden on-chain. Legitimate for privacy tokens; a red flag if a "community" token uses it to hide insider holdings. If you can't audit the holder distribution because transfers are confidential, you're trusting the deployer completely.
The one-sentence model: Token-2022 extensions are tools — transfer hooks and fees can protect users or trap them, and confidential transfers can protect privacy or hide whales. The extension list tells you which.
Extensions decide whether you can sell — check before you buy
A transfer hook or fee can turn a "buyable" token into a honeypot. Read the extension list.
How to check a Token-2022 token
Look at the mint account's extension list. No extensions = plain SPL behavior. Transfer hook present = find the hook program and read what it does (or simulate a sell). Transfer fee present = read the fee parameters. Confidential transfer = expect hidden balances. Any of these isn't automatically bad — but each adds a failure mode you should understand before sizing in.
The extensions that should stop you
Not every extension is a trap — transfer fees fund real projects, and confidential transfers have legitimate privacy use cases. These four can separate you from your money:
Permanent delegate. If enabled, the deployer holds a key that can move or burn tokens from any holder's account without approval. There is no defense and no appeal — the extension exists precisely to bypass holder consent. Treat any gated token carrying one as uninvestable.
Default frozen accounts. New accounts start frozen and only the authority can thaw them. A frozen token can't move or sell. Some legitimate airdrops use this for compliance; a traded token with it is a honeypot with extra steps.
Non-transferable. Self-explanatory: you can receive the token and you can never send it. No legitimate traded asset needs this.
Transfer hooks with undisclosed logic. The hook itself isn't visible in the token's metadata — you have to read the program it points to. A hook that only blocks sells is the classic trap; one that blocks buys is the rarer can't-exit variant. Simulating a sell before you buy is the only reliable test.
The pattern to remember: extensions are disclosed on-chain but easy to miss in a swap UI. The scanner reads the token's extension set directly — check it before the first buy, not after.
Frequently asked
Is Token-2022 safer than regular SPL tokens?
Not inherently. The extensions are neutral tools. Transfer hooks can add safety checks or honeypot logic; transfer fees can fund development or extract value. Safety depends on how the deployer configured them.
What is a transfer hook on Solana?
Custom code that runs on every token transfer. It can allow, block, or modify transfers. Legitimate uses include compliance; malicious uses include blocking sells (honeypots) or blacklisting wallets.
How do I know if a token has a transfer fee?
The fee is in the mint's extension data, visible on a block explorer or via a scanner. If your sell simulation returns less than expected, a transfer fee is likely deducting on the way out.
Can Token-2022 tokens be scams?
Yes — the extensions give scammers more tools (hooks that block sells, high transfer fees, hidden balances). The rule is the same as always: simulate the sell, read the extensions, check the holder distribution.
Measured data — what our scanner sees
Token-2022 extensions change what authority checks mean; our grades read the extension-aware state.
From our latest published safety snapshot — 2,001 Solana tokens dated 2026-08-17 to 2026-09-16 — 75.6% had mint authority renounced, 90.0% had freeze authority renounced, and grades split A 1,533 / B 415 / C 53. Every row carries its snapshot date; the full dataset is CC BY 4.0 at nexflowscan.com/data/, and the scoring method is at nexflowscan.com/methodology/.
Sources & further reading
- SPL Token-2022 docs — Extensions, transfer fees, and permanent delegate — primary source.
- Token-2022 program — Program source and interface.
- Solana docs: Transactions — The account model the extensions build on.