Solana Permanent Delegate Risk: Who Can Move Token-2022 Assets Without the Owner?
A Solana permanent delegate is a Token-2022 mint-level authority that can authorize transfers and burns from token accounts for that mint without requiring the token account owner's signature. Unlike an ordinary token-account delegate, which is approved by one account owner for a limited allowance and can be revoked by that owner, the permanent delegate is defined at the mint level and applies across the mint's token accounts. This capability can support regulated assets, recovery procedures, sanctions enforcement and issuer-controlled financial products, but it also changes the meaning of self-custody for that particular asset. Holding the private key to a wallet does not, by itself, prevent an authorized permanent delegate from moving or burning the affected Token-2022 tokens. Investors therefore need to inspect the mint extension, current authority, governance structure and historical use before deciding what that control means for a specific asset.
TL;DR
- A Token-2022 permanent delegate is a mint-level authority that can transfer or burn tokens from accounts for that mint without the holder signing the action.
- The holder cannot revoke this authority from an individual token account the way they can revoke a normal account delegate.
- Permanent delegates can have legitimate uses, including regulated assets, recovery and legally required asset controls.
- The extension is not the same as mint authority, freeze authority or a normal token-account delegate.
- Risk depends heavily on disclosure, governance, authority security, actual transaction history and whether the power matches the asset's stated purpose.
- Before holding a Token-2022 asset, inspect the exact mint and its active extensions rather than assuming wallet ownership gives exclusive control.
If a Token-2022 mint has an active Permanent Delegate extension, control of the wallet's private key does not give the holder exclusive authorization over that mint's tokens. The holder still controls the wallet, SOL, unrelated tokens and normal wallet actions, but the permanent delegate has an additional authorization path for transferring or burning the affected token.
What is a Solana permanent delegate?
The Permanent Delegate extension belongs to Solana's Token-2022, or Token Extensions, program. Token-2022 preserves the familiar concept of mints and token accounts while allowing projects to initialize additional behavior at the mint or account level.
A permanent delegate is one of those extensions. Instead of assigning authority to one holder's token account, it stores a delegate authority in the mint's extension data. The result is a global authorization relationship for that mint.
Official Solana documentation describes the authority as able to authorize transfers and burns from token accounts belonging to the mint. Token account owners cannot remove that mint-level authority from their individual accounts.
This makes the word "permanent" important, but it should be interpreted correctly. It means the delegation is not a temporary per-holder approval that disappears because one holder revokes it. The current authority configuration of the mint itself should still be inspected rather than assuming the address originally assigned at mint creation can never change.
The authority belongs to the mint's security model
Consider an ordinary token-account delegate. Alice owns one token account containing 1,000 tokens. Alice can approve Bob to spend up to 200 from that account. Bob's rights exist because Alice granted them, are limited by the delegated amount, and can be revoked by Alice.
A permanent delegate works at a different level. If a mint designates Authority P as its permanent delegate, Authority P does not need a separate approval from Alice for Alice's token account, another approval from Bob for Bob's account and another approval from Carol for Carol's account. The authority comes from the mint extension.
That architectural difference is what creates both the feature's usefulness and its risk.
It is specific to the token, not the entire wallet
A permanent delegate for Mint X does not become a universal delegate over the wallet. It cannot, merely because of that Token-2022 role, move SOL, Mint Y, NFTs from unrelated programs or other assets the wallet owns.
The authority applies to the token accounts for the configured mint. This scope is essential when evaluating risk because the phrase "can move tokens without the owner" can otherwise sound broader than the protocol actually permits.
Where is the permanent delegate stored?
The Permanent Delegate extension is stored on the Token-2022 mint account. It is not hidden inside each holder's associated token account, and it is not created when an individual holder approves a transaction.
This is why mint inspection is the correct starting point for due diligence. A user's token account can look completely ordinary at first glance while the mint itself contains a permanent delegate that affects every balance issued under that mint.
The extension is initialized as part of the mint design
Token-2022 extensions generally require additional account space, so extension choices are typically planned when the mint is created. Solana's Permanent Delegate initialization flow places the extension on the new mint before the mint is fully initialized.
This differs from the user casually approving a delegate months later. The capability exists because the token issuer designed the mint with that extension.
For investors, this creates a useful due-diligence property: the existence of the extension can be detected directly from the mint's on-chain state. A project should not be able to rely on marketing language alone to define whether the capability exists.
The current authority matters more than the token symbol
Symbols, logos and token names do not describe authority structure. Two assets with identical-looking symbols can have completely different control models.
One can be a legacy SPL token with no permanent delegate. Another can be Token-2022 with permanent delegate, transfer fee and additional extensions. The mint address and decoded mint state are therefore the authoritative starting points.
The TokenToolHub Solana Token Scanner can help begin that mint-level review by separating the exact token being investigated from copied names or superficial metadata.
What can a permanent delegate actually do?
The two powers that matter most are transfer authorization and burn authorization.
Both are significant because they operate without requiring the affected token account owner to sign the instruction.
Transfer tokens from a holder's account
A permanent delegate can sign the applicable Token-2022 transfer instruction as the authority for a source token account belonging to the mint.
Suppose a wallet holds 10,000 units of a regulated Token-2022 asset. If the mint has a valid permanent delegate and the required token-program conditions are satisfied, that delegate can authorize moving some or all of those units to another token account for the same mint without obtaining a fresh signature from the wallet owner.
This is the mechanism that enables forced transfers or seizure-style workflows.
The word "forced" describes the relationship to the token holder's authorization. It does not mean the delegate bypasses Solana's entire token program. The transaction still has to be valid, use appropriate token accounts, satisfy balance requirements and comply with other applicable Token-2022 state.
Burn tokens from a holder's account
The permanent delegate can also authorize a burn from token accounts of the mint.
Burning is different from transferring. A transfer changes which token account holds the units. A burn reduces the source balance and reduces the mint's outstanding supply by the corresponding amount.
This capability can be appropriate for redemption systems. For example, a regulated issuer may redeem a tokenized asset off-chain and then burn the corresponding on-chain units to maintain supply integrity.
The same authority can become dangerous when undisclosed or poorly governed because a holder can lose token units without authorizing the burn themselves.
The permanent delegate does not gain mint authority automatically
Transfer and burn authority should not be confused with the ability to create new supply.
The mint authority controls minting. A wallet being the permanent delegate does not, by that role alone, give it permission to mint arbitrary new units.
One address can hold multiple roles if the issuer configured it that way, but the roles remain conceptually separate. A risk review must therefore identify every authority independently instead of seeing one familiar address and assuming it has only one power.
Who can do what? The authority model visually
Token account owner
Normally authorizes transfers and burns from their token account and can approve or revoke an ordinary delegate.
Account delegate
Receives authority over one token account up to an approved amount. The account owner can revoke it.
Permanent delegate
Mint-level authority capable of authorizing transfers and burns across token accounts for that mint.
Freeze authority
Can freeze or thaw eligible token accounts. Freezing blocks normal token operations but does not itself transfer balances.
Mint authority
Can create additional units of the token while that authority remains active. It does not automatically seize existing balances.
Permanent delegate vs owner, account delegate, freeze authority and mint authority
Authority labels are easy to blur together because several of them can influence a token holder's practical risk. They should be evaluated separately.
| Authority | Where scope comes from | Can transfer existing tokens? | Can burn existing tokens? | Can holder revoke it? | Main risk question |
|---|---|---|---|---|---|
| Token account owner | Ownership field of the individual token account. | Yes, from the account they own when account state permits. | Yes, from the account they own when account state permits. | Owner controls their own key or ownership configuration. | Is the owner's wallet or signer secure? |
| Ordinary token-account delegate | Approval stored on one token account. | Yes, up to delegated allowance. | Can use delegated authority within applicable allowance rules. | Yes, the token account owner can revoke the delegate. | What amount was approved and to whom? |
| Permanent delegate | Permanent Delegate extension on the mint. | Yes, across token accounts for the configured mint. | Yes, across token accounts for the configured mint. | No, individual token account owners cannot revoke the mint-level delegate. | Who controls the authority, why does it exist, and how has it been used? |
| Freeze authority | Freeze authority configured on the mint. | No, not merely by being freeze authority. | No, not merely by being freeze authority. | No individual holder can revoke the mint's freeze authority. | Can accounts be frozen selectively, and who controls that power? |
| Mint authority | Mint authority configured on the mint. | No, not merely because it can mint. | No, not merely by being mint authority. | No individual holder controls the mint's authority. | Can supply be expanded, and under what governance? |
Why an ordinary account delegate is fundamentally different
The ordinary SPL token delegate model is familiar to many Solana users because it behaves like a scoped permission. The token account owner explicitly approves another address and defines how many tokens that delegate is permitted to transfer or burn from that account.
If Alice approves Bob for 100 units, Bob does not become a global authority over the mint. He cannot use that approval against another holder. He cannot automatically spend 101 units. Alice can later send a Revoke instruction to clear the delegation.
The permission originates with the holder
This is the most important distinction. An account delegate receives power from the account owner. A permanent delegate receives power from the mint's configuration.
Consequently, a holder can review and revoke an ordinary delegate from their account, but the same holder cannot remove the mint's permanent delegate merely because they dislike it.
Ordinary delegated allowance is local
Delegated amount is tracked for the token account. Spending through that ordinary delegation reduces the available delegated amount as applicable.
The permanent delegate is not a collection of millions of independent allowances. Its authorization exists across the mint's token accounts without each holder assigning an amount.
This is why calling a permanent delegate "just another approval" understates its significance.
Permanent delegate vs mint authority
Mint authority concerns supply creation. Permanent delegate concerns control over existing balances.
If a mint authority remains active, its holder can issue additional token units according to the token program. That can create dilution or supply-integrity risk, but it does not by itself authorize the mint authority to remove tokens already sitting in another user's token account.
A permanent delegate works in the opposite direction. It does not need to create new supply to affect a holder. It can authorize moving or burning tokens that already exist.
Both roles together create a broader control surface
If the same organization controls mint authority and permanent delegate, it can potentially influence both sides of the supply equation: issuing new units and moving or destroying existing units.
This may be intentional for a regulated issuer managing tokenized claims. It can be far more concerning for a speculative token marketed as permissionless or trust-minimized.
The correct analysis therefore asks whether mint authority is active, whether permanent delegate is active, whether the same governance controls both, and whether the project's disclosures accurately explain those powers.
Permanent delegate vs freeze authority
Freeze authority is another important but distinct control.
A valid freeze authority can freeze eligible token accounts. A frozen account cannot perform normal transfers, burns or delegate changes until it is thawed according to the token program's rules.
Freezing therefore controls mobility, while permanent delegation provides an authorization path for movement or burning.
Freeze does not equal seizure
A freeze authority cannot automatically send tokens from a holder to a treasury simply because it can freeze the account.
It can make the account unable to transact. If the mint also has a permanent delegate, the issuer has a broader toolset, but the authority roles should not be described as interchangeable.
A frozen account remains subject to token-program state checks
The existence of a permanent delegate does not imply that every other Token-2022 restriction disappears. Source account state and other applicable checks still matter to valid execution.
This is another reason transaction-level analysis is important. Knowing that an authority exists does not tell you whether every attempted action by that authority will succeed under every account state.
For a broader explanation of mint and freeze controls when evaluating Solana assets, TokenToolHub's Solana token checker guide covers the practical implications of these authority states alongside other token-level risk signals.
What a forced transfer looks like on-chain
A forced transfer does not mean Solana silently edits a balance without a transaction.
The permanent delegate must authorize a valid Token-2022 instruction. That instruction is processed on-chain and leaves transaction evidence that researchers can inspect.
Source token account
The instruction identifies the token account from which units will move. The source account belongs to the relevant Token-2022 mint.
Destination token account
A transfer needs a destination capable of receiving the same mint. In a recovery or seizure workflow, this could be an issuer-controlled recovery token account.
Authority signer
The crucial difference is the transfer authority. Instead of the source token account owner signing, the permanent delegate signs under its mint-level authorization.
Balance changes remain auditable
The transaction changes the source and destination token balances according to the executed instruction. Researchers can inspect those pre-transaction and post-transaction balances and identify the authority that authorized the movement.
The TokenToolHub Solana Transaction Decoder is useful when the important question is not merely whether a transaction succeeded, but which authority signed, which token accounts changed and whether the action was a normal owner transfer or an authority-driven operation.
What a permanent-delegate burn means
Burning is economically different from seizure.
If 1,000 tokens are transferred from a holder to an issuer recovery account, the 1,000 units still exist. Ownership changed.
If the same 1,000 units are burned, the holder balance decreases and the mint's outstanding supply decreases.
Burn authority can support redemption
Consider a token representing a redeemable real-world claim. A user completes redemption through the issuer. The issuer must ensure the on-chain token cannot continue circulating after the corresponding off-chain obligation has been settled.
A permanent delegate can support a controlled burn process without relying on the user to send a second transaction at the correct time.
Burn authority can also be coercive
If the same power is held by an undisclosed administrator for a token marketed as censorship-resistant, the interpretation changes substantially.
The protocol capability is identical. What differs is governance, disclosure, intended asset model and how authority has been used.
This is why permanent delegate should be treated as a material control signal rather than automatically classified as either legitimate or malicious.
Legitimate reasons a token may use a permanent delegate
The capability makes most sense where the asset intentionally includes issuer or administrator control.
Regulated securities and tokenized funds
Tokenized shares, fund interests and other regulated instruments may need mechanisms for enforcing court orders, correcting ownership records or handling transfers that violate applicable rules.
Traditional financial assets already operate inside systems where legal ownership can be corrected or restricted through regulated intermediaries. A permanent delegate can provide an on-chain mechanism for similar administrative control.
The important requirement is disclosure. An investor buying a regulated security should know the issuer retains these powers and understand the governance process around their use.
Sanctions and compliance enforcement
An issuer may need to remove assets from an address associated with sanctions, stolen funds, fraud or another legally restricted condition.
A permanent delegate can support a recovery or seizure process after the issuer's compliance procedure reaches the relevant decision.
Whether that architecture is desirable depends on the product. For a regulated payment token, administrative control can be a deliberate design requirement. For an asset presented as sovereign bearer property, the same control may contradict user expectations.
Lost-key recovery
A tokenized financial product can provide a formal recovery process for a customer who loses access to a wallet.
After identity verification and the required waiting or legal process, the issuer could transfer the affected asset from the inaccessible token account to a newly verified wallet.
This capability changes the finality of key loss. It can protect users in one threat model while creating issuer trust in another.
Court-ordered asset recovery
Real-world asset issuers can be subject to court orders, insolvency procedures or ownership disputes that require changes to tokenized records.
A permanent delegate provides technical capability for enforcing the final authorized action on-chain.
Operational error correction
Enterprise token systems may need a documented mechanism for correcting exceptional issuance or custody errors. A carefully governed delegate can serve that purpose.
This use case should still avoid becoming a vague administrator backdoor. Strong systems define what qualifies for intervention, who approves it, which keys execute it and how the action is disclosed.
Why permanent delegate should not automatically be labeled malicious
Security analysis becomes less useful when every powerful feature is automatically called a scam feature.
A feature can introduce trust without being malicious. A regulated asset is allowed to have an issuer. A recovery product is allowed to have recovery authority. A compliance token is allowed to enforce legal restrictions.
The analytical task is to identify the trust boundary and determine whether it matches the product users were told they were buying.
Control can be appropriate when expectations match
If a prospectus, token documentation and user interface clearly state that the issuer can seize or burn assets under specified circumstances, then the permanent delegate is implementing a disclosed product property.
An investor can evaluate that tradeoff knowingly.
Undisclosed control is a different risk
If the token is marketed as "fully decentralized," "nobody can touch your balance" or "only you control your tokens" while an active permanent delegate can move those balances, the mismatch becomes a major red flag.
On-chain capability and marketing representation should agree.
How permanent delegate authority can be abused
The feature's legitimate uses do not reduce the severity of a compromised or malicious delegate.
Because the scope spans the mint's token accounts, authority security becomes an ecosystem-level issue for that asset.
Selective seizure
A malicious administrator could target specific holders and transfer their assets to another address.
The affected wallet's private key could remain completely secure. From the wallet owner's perspective, the loss would come from the token's mint-level authority model rather than key compromise.
Mass seizure
A compromised delegate key could potentially be used repeatedly against many token accounts for the mint.
This creates a different blast radius from compromising an ordinary token-account delegate. A local delegate approval affects one account and its allowance. A mint-level permanent delegate can represent systemic authority over the asset.
Forced burns
An abusive authority can reduce holder balances through burns rather than transferring the assets to another account.
This may make recovery more difficult because the affected token units no longer exist after a valid burn.
Discriminatory enforcement
Even where the authority was created for compliance, governance can apply it inconsistently. Similar holders may receive different treatment, or policy can change without adequate disclosure.
The risk is therefore not only key compromise. It includes governance quality and operational process.
Coercion of the authority operator
A well-intentioned issuer can be legally or physically compelled to use its authority. Whether this is viewed as a feature or a risk depends on the asset's purpose and the holder's expectations.
For regulated instruments, legal enforceability can be essential. For censorship-resistant assets, susceptibility to external coercion can undermine the investment thesis.
The delegate key becomes a high-value security target
An authority capable of affecting balances across an entire mint should not be secured like an ordinary operational wallet.
The security architecture around the delegate often matters more than the mere fact that the extension exists.
Single-key control deserves elevated scrutiny
If one ordinary externally owned wallet controls a high-value permanent delegate, compromise of that one signer can become an asset-wide incident.
The token itself does not need a smart contract exploit. The attacker needs the authority required by the existing design.
Multisig improves key distribution, not policy by itself
A multisig can prevent one stolen key from being sufficient, but several signers can still approve abusive actions. Governance review should therefore ask both who can sign and under what policy they are expected to sign.
Programmatic control shifts risk into code
A PDA or governance program can control actions under deterministic rules, reducing reliance on a human hot key. That moves some risk into program correctness, upgradeability and governance execution.
There is no universally perfect authority model. The objective is to understand the chosen trust structure accurately.
Can the permanent delegate change?
Investors should not assume that identifying one delegate address today permanently resolves the authority question.
Token-2022 exposes authority-management functionality for PermanentDelegate state. The live mint should therefore be inspected whenever current authority matters, particularly after governance migrations, issuer upgrades or security incidents.
Current state matters more than launch documentation
A token launch announcement may identify one custody address as the delegate. Months later, governance may rotate authority to another control structure.
That can be positive. A project might move from a launch-time key into a multisig or institutional custody arrangement.
It can also increase risk. A previously distributed governance design can be replaced with a more concentrated control path if the token's authority model permits the change.
Historical authority changes are useful evidence
Researchers should inspect whether authority rotations coincide with upgrades, security incidents, regulatory changes or unexplained token movements.
A transparent migration accompanied by documentation is different from an unexplained authority change followed by holder seizures.
What permanent delegate means for self-custody
Self-custody is often summarized as "not your keys, not your coins." That principle is useful, but programmable tokens make the control model more nuanced.
If you control the wallet's private key, you control the wallet. You can authorize wallet-level actions and protect the account against unauthorized signatures.
However, the token program may recognize additional authorities over a specific asset.
Your private key can remain uncompromised
A permanent-delegate transfer does not require the holder's private key. Therefore, a holder cannot conclude that any unexpected outgoing token movement proves their seed phrase was stolen.
This distinction matters during incident response. If SOL and unrelated tokens remain untouched while one PermanentDelegate-enabled mint is transferred by its authorized delegate, wallet compromise may not be the cause.
A hardware wallet cannot override token-program authority
A hardware wallet protects the user's private key. It cannot rewrite Token-2022 rules.
Moving the asset to a Ledger, Keystone, OneKey or another signing device does not remove a permanent delegate that exists at the mint level. The hardware wallet can protect against phishing and unauthorized owner signatures while the mint-level authority remains valid.
This is a crucial distinction between signer security and asset-design risk.
Recovery scenarios: feature or custody tradeoff?
Permanent delegation can make some assets more recoverable than pure bearer tokens.
Suppose an investor loses the seed phrase to a wallet containing a tokenized bond. Under a strict bearer-asset model, the asset is effectively lost. Under a regulated recovery model, the investor can complete identity verification and the issuer can move the tokenized claim to a replacement wallet.
That outcome can be highly desirable for financial products intended for mainstream ownership.
Recovery requires trust in adjudication
The same mechanism must determine who is entitled to request recovery.
An attacker could impersonate the holder. An insider could abuse the process. Documents can be forged. Governance can make an incorrect determination.
Technical recovery power therefore requires procedural security outside the token program.
Good recovery systems leave evidence
Serious issuers should maintain an auditable process linking administrative actions to documented cases, approvals and policy.
The on-chain transaction can prove that the permanent delegate moved the token. The issuer's governance records should explain why.
Sanctions and compliance scenarios
Sanctions controls are another reason regulated issuers may require a permanent delegate.
Imagine a tokenized treasury product whose legal issuer must prevent a sanctioned entity from controlling the underlying claim. Merely freezing the token account can stop further movement, but the issuer may eventually need to move or burn the affected on-chain representation pursuant to its legal process.
The permanent delegate provides a technical path for executing that decision.
Compliance functionality changes censorship assumptions
An investor should decide whether issuer intervention is compatible with the reason they hold the asset.
For a regulated security, the answer may be yes. For an asset bought specifically for censorship resistance, a permanent delegate can materially alter the thesis.
Jurisdiction matters operationally
The blockchain capability is global, but the entity controlling it operates under some legal and organizational framework.
Researchers evaluating institutional tokens should therefore combine on-chain authority analysis with issuer identity, legal documentation and governance process.
Wallet limitations: why the risk can be easy to miss
A wallet can accurately show that you own 50,000 tokens while failing to explain that another authority can move those same tokens.
This is not necessarily a balance-display bug. Balance and authority are different pieces of state.
Token balances are visually simple
Most portfolio interfaces prioritize token name, amount and value. A mint can contain several security-relevant extensions that do not fit naturally into a compact asset row.
As Token-2022 adoption grows, wallets and research tools need to expose authority information more clearly.
A send preview does not reveal inbound authority
Users often inspect only transactions they are about to sign. A permanent delegate can act without asking the holder to sign, so there may be no wallet approval screen for the holder to reject.
Risk review therefore has to occur at asset evaluation time, not only at transaction-signing time.
Revoking normal delegates does not solve permanent delegate risk
A security-conscious user might revoke every ordinary token-account approval and assume their token account now has no external spending authority.
That conclusion is incorrect for a mint with a Permanent Delegate extension. The mint-level authority remains independent of the account's ordinary delegate field.
Exchange and custodian implications
Exchanges and custodians need to understand PermanentDelegate assets before listing them because issuer-level control affects custody assumptions.
Customer balances can be moved externally
An exchange can hold a Token-2022 asset in an omnibus token account and still be subject to the mint's permanent delegate.
The fact that the exchange controls the custody private key does not remove the issuer's mint-level authority over that token.
Asset recovery can benefit custodians
A regulated issuer may be able to help recover assets sent to a known but inaccessible custody address where its policies allow intervention.
This can reduce some operational risks relative to a strictly immutable bearer asset.
Seizure can create balance-sheet risk
If a permanent delegate removes tokens from an exchange-controlled account, the exchange may still owe customers corresponding balances in its internal ledger.
Listing teams therefore need to understand legal and operational conditions under which authority can be exercised.
Deposit screening should include mint extensions
Custodians should not evaluate a token solely from metadata and liquidity. Token-2022 extension detection belongs in asset onboarding because extension state can materially change custody behavior.
dApp and protocol implications
DeFi protocols can also hold assets subject to a permanent delegate.
Imagine a lending protocol accepting a Token-2022 asset as collateral. The protocol's vault owns the collateral token account, but the mint's permanent delegate can still be a material authority over that asset.
Collateral assumptions can change
If a permanent delegate can move units from the protocol's vault under valid Token-2022 rules, the protocol must account for that control in its risk model.
Collateral is not equivalent to an ordinary asset whose only spend authority is the vault program.
AMM liquidity can also be exposed
Tokens held in pool-controlled token accounts remain tokens of the same mint. A protocol evaluating whether to permissionlessly support a Token-2022 asset should understand all extensions capable of affecting those balances.
Protocol integration should be extension-aware
Token-2022 compatibility should not mean merely accepting the Token-2022 program ID. Applications should inspect extensions and decide which authority models they are prepared to support.
How to inspect a Solana mint for permanent-delegate risk
A reliable review starts with the mint, then expands outward into authority identity, wallet history and transaction evidence.
Verify the mint
Confirm the exact Solana mint rather than relying on symbol, logo or token name.
Identify token program
Determine whether the mint belongs to Token-2022 and decode its extensions.
Read delegate state
Identify the current permanent delegate and distinguish it from other authorities.
Investigate governance
Determine whether the authority is a single signer, multisig, program or institutional control system.
Review history
Search for delegate-authorized transfers, burns and other relevant authority events.
Compare disclosure
Decide whether observed capability and usage match the asset's published purpose and holder expectations.
Step 1: verify the exact mint
Never begin a permanent-delegate investigation from a token symbol alone.
Solana token names are not unique identifiers. Attackers can copy names, tickers and logos. Even legitimate issuers can have multiple versions of an asset with different mint configurations.
Copy the exact mint from a trusted source and compare it with the mint attached to the wallet balance or transaction being investigated.
Confirm Token-2022 ownership
The Permanent Delegate extension belongs to the Token-2022 model. Establish which token program owns the mint before interpreting extension data.
A research tool should distinguish legacy SPL Token state from Token-2022 rather than applying extension assumptions generically.
Enumerate the complete extension set
Permanent delegate is only one possible control. The same token can have other extensions affecting transfer behavior, account state or economics.
The security question should therefore be "what controls exist on this mint?" rather than "does it have permanent delegate?"
The Solana Token Scanner provides a useful first layer for mint-level investigation before researchers move into transaction history and authority-wallet analysis.
Step 2: identify the current permanent delegate
If the extension is present and contains an active delegate, record the exact authority address.
Do not stop at a yes-or-no flag.
Is the authority recognizable?
The address may correspond to a published multisig, treasury, issuer administration wallet, governance program or another documented component.
An unexplained address does not automatically prove malicious intent, but it increases uncertainty.
Does project documentation name the authority?
A mature regulated issuer should be able to explain what the authority is for, how it is secured and when it may be used.
If the on-chain mint exposes permanent delegate while official materials say holders have exclusive control, the inconsistency itself is a material finding.
Does the same address hold other authorities?
Compare permanent delegate with mint authority, freeze authority and other relevant control addresses.
Consolidating several powers into one signer increases the consequences of that signer's compromise.
Step 3: investigate the authority wallet or control system
An authority address is useful only when interpreted in context.
Researchers should ask who appears to operate it, how active it is, what kinds of transactions it signs and whether its behavior matches the asset's published governance.
Look at transaction history
Has the authority ever exercised forced-transfer or burn powers? If so, were those events isolated, routine or unexpectedly frequent?
Historical use is often more informative than theoretical capability alone.
Look for operational patterns
An institutional control wallet may show structured interaction patterns. A governance-controlled authority may interact through a known multisig or program.
A newly funded personal-looking wallet that suddenly becomes a high-impact authority deserves additional investigation.
Use wallet-level analysis
The TokenToolHub Solana Wallet Risk Scanner can help extend the investigation beyond the mint by reviewing activity and counterparty context for relevant authority wallets.
Where supported, Nansen can add address labels and entity-level context when investigating known institutions, treasuries or large holders. Labels are useful research signals, but on-chain authority state remains the stronger evidence for what an address is technically allowed to do.
Step 4: inspect actual permanent-delegate transactions
If the authority has been exercised, decode the transaction instead of relying on explorer labels alone.
Identify the source token account
Determine whose token account lost units and what its previous balance was.
Identify whether the action was transfer or burn
A transfer moves supply to another account. A burn removes supply. These actions have different economic and governance meanings.
Identify the authority that signed
Determine whether the token account owner signed, an ordinary account delegate signed, or the mint's permanent delegate authorized the action.
Compare the event with public disclosure
A regulated issuer may publish a notice for a court-ordered seizure or redemption burn. An unexplained forced movement against a speculative holder can carry a different risk interpretation.
TokenToolHub's Solana Transaction Decoder guide explains how to move beyond a transaction signature and inspect account roles, instructions and balance changes in more detail.
Transaction forensics: owner transfer or permanent-delegate transfer?
Unexpected token movement should be investigated before concluding that a wallet was hacked.
Start with the transaction signature and answer three questions: what instruction moved the tokens, which authority satisfied the token program, and what other assets moved from the wallet?
Normal owner-authorized transfer
If the holder's expected signer authorized the token transfer, wallet compromise or intentional owner action remains a possible explanation.
Ordinary delegated transfer
If a previously approved token-account delegate signed, review the delegated allowance and approval history. The holder may have granted permission earlier through an application.
Permanent-delegate transfer
If the mint's permanent delegate authorized the movement, the holder's wallet signature is not required for that token movement. This changes incident-response priorities.
The user should still secure their wallet if compromise is uncertain, but analysis should not assume seed phrase theft merely because a token left the account.
Compare unaffected assets
If SOL, USDC and unrelated assets remain untouched while one PermanentDelegate-enabled token moves under its mint authority, the evidence can point toward issuer-level action rather than wallet-wide compromise.
If many unrelated assets disappear through holder-authorized transactions, wallet compromise becomes more plausible.
Holder decision matrix: how much should the extension concern you?
A permanent delegate should change the due-diligence score, but context determines how much.
| Signal | Lower concern | Moderate concern | Higher concern |
|---|---|---|---|
| Disclosure | Authority is prominently documented before purchase, with clear reasons and examples. | Authority is mentioned but governance details are limited. | Project claims exclusive holder control or never discloses the mint-level authority. |
| Asset purpose | Regulated security, tokenized fund, recovery product or asset where issuer control is expected. | Utility asset with a plausible but non-essential administrative reason. | Token marketed as censorship-resistant or fully permissionless despite administrative seizure power. |
| Governance | Well-defined institutional, multisig or programmatic control with documented process. | Known team wallet with internal controls that are difficult for outsiders to verify. | Single unexplained hot wallet or opaque authority ownership. |
| Scope of retained controls | Permanent delegate exists but other powerful authorities are minimized and purpose is narrow. | Several authorities remain active under the same organization. | Permanent delegate, minting, freezing and other controls are concentrated in one opaque signer. |
| Historical use | Rare actions match clearly documented redemption, recovery or legal processes. | Authority has been used multiple times with incomplete explanations. | Unexpected holder seizures, unexplained burns or patterns inconsistent with published policy. |
| Authority changes | Rotations are transparent and move toward stronger governance. | Authority changes occur with limited operational detail. | Sudden unexplained control changes precede unusual token movements. |
| Holder expectation | Investor knowingly accepts issuer-controlled asset terms. | Control model is understood only after deeper technical review. | Authority contradicts the primary reason the user believed the asset was trust-minimized. |
Permanent-delegate red flags investors should investigate
The extension alone is not the red flag. The combination of authority, governance and behavior determines the risk.
Signals that deserve deeper investigation
- The project does not disclose the Permanent Delegate extension anywhere in user-facing documentation.
- Marketing states that nobody can move holder balances while an active permanent delegate exists.
- The authority address cannot be linked to any documented governance or operational system.
- A single ordinary hot wallet controls permanent delegate, mint authority and freeze authority.
- The authority has executed unexplained forced transfers from unrelated holders.
- Tokens have been burned from user accounts without a clear redemption, compliance or recovery rationale.
- The authority changes shortly before unusual balance movements.
- Project representatives refuse to explain who controls the delegate.
- Documentation describes the token as permissionless while administrative seizure remains technically possible.
- The token has other high-impact controls that substantially compound the permanent-delegate risk.
- Issuer policy provides no process for disputing mistaken recovery or compliance actions.
- Historical authority activity conflicts with the stated reasons the capability supposedly exists.
Signals of stronger governance
There are also indicators that an issuer has treated permanent-delegate authority as a serious security responsibility.
Clear documentation
The issuer explicitly states that the token can be transferred or burned by an administrative authority under defined circumstances.
Purpose-specific policy
The authority's intended use is limited to scenarios such as recovery, legal orders or redemption rather than vague discretionary control.
Distributed authorization
A multisig, institutional custody process or governed program reduces dependence on one online key.
Auditable history
Past interventions can be connected to published actions and do not show unexplained extraction from holders.
Separation of powers
Different critical authorities can be separated rather than concentrating every mint-level privilege in one signer.
Change transparency
Authority rotations and policy changes are communicated before they materially affect holders.
Practical permanent-delegate scenarios
Scenario 1: legitimate lost-wallet recovery
A user owns 25,000 units of a tokenized money-market product. The wallet's seed phrase is destroyed, but the investor can prove ownership through the issuer's regulated onboarding process.
After identity verification, a waiting period and internal approval, the issuer uses the permanent delegate to transfer the tokenized position from the inaccessible token account to a newly verified wallet.
The user did not sign from the lost wallet because doing so was impossible. The permanent delegate is what made recovery possible.
This is a strong example of the feature serving its intended administrative purpose.
Scenario 2: sanctions enforcement
A regulated issuer determines that an address falls under a legally binding sanctions process. Its policy requires the asset to be removed from circulation under specified conditions.
The issuer's governed authority signs a permanent-delegate action according to its documented compliance process.
From a protocol perspective, this is a non-owner-authorized movement or burn. From the issuer's product perspective, it is enforcement of the terms under which the regulated asset was issued.
Investors should know this capability exists before acquiring the asset.
Scenario 3: speculative token with hidden seizure power
A project launches a token and repeatedly claims that the developer cannot touch user balances. The Token-2022 mint actually contains a permanent delegate controlled by a team wallet.
Large holders begin selling. The team uses the delegate to move tokens from several of those accounts into another address.
Here the same technical extension becomes a serious trust and disclosure problem because observed control contradicts the asset's public positioning.
Scenario 4: compromised administrator key
A legitimate issuer uses permanent delegate for customer recovery but stores the authority in an inadequately secured operational key.
An attacker compromises the signer and begins transferring tokens from high-value holder accounts to attacker-controlled destinations.
The Token-2022 Program is operating correctly. The failure is authority-key security.
This scenario demonstrates why an extension can be correctly implemented yet still create systemic risk.
Scenario 5: forced redemption burn
A holder redeems an off-chain asset represented by 10,000 tokens. The issuer completes payment outside the chain and burns the corresponding token balance using the permanent delegate.
The total token supply falls by 10,000, preserving the relationship between circulating tokens and the underlying asset.
For a redemption product, the burn may be expected and economically necessary.
Scenario 6: account delegate confused with permanent delegate
A user inspects their token account and sees no ordinary delegate. They assume nobody else can authorize movement.
The mint, however, contains an active permanent delegate.
The user has correctly revoked all account-level approvals but has not changed the mint-level trust model because that authority is outside the token account owner's revocation control.
Scenario 7: freeze authority exists but permanent delegate does not
A different token has an active freeze authority but no permanent delegate.
The issuer can freeze the holder's token account, preventing transfers, but cannot claim permanent-delegate transfer power that the mint does not have.
This is why TokenToolHub-style authority analysis should report distinct controls rather than combining them under a generic "centralized" label.
Scenario 8: permanent delegate exists but mint authority is revoked
A project permanently removes its ability to mint additional supply but retains the permanent delegate.
Supply can no longer be expanded through the removed mint authority, yet issuer-level control over existing balances remains.
Calling the token "fixed supply" can therefore be accurate while saying "issuer has no control over holder balances" can still be false.
Scenario 9: same signer holds every authority
A mint uses one wallet for mint authority, freeze authority and permanent delegate.
If that wallet is compromised, the attacker may gain several independent capabilities at once. The resulting incident can include supply expansion, account freezing and movement or burning of existing token balances, depending on the full mint configuration.
Concentrated authority dramatically increases key compromise impact.
Scenario 10: authority is rotated into stronger governance
A project launches using a temporary administrative key, then later moves permanent-delegate control into a properly configured multisig with public signers and documented intervention policy.
The existence of the permanent delegate has not changed, but governance quality has improved.
This illustrates why static risk labels can miss meaningful authority evolution.
Scenario 11: unexpected transaction appears in a holder's history
A user discovers that 5,000 units of one token left their wallet overnight. SOL remains present, unrelated tokens remain present and there is no suspicious wallet signature involving those assets.
Transaction decoding shows that the affected mint's permanent delegate authorized the Token-2022 movement.
The immediate investigation should therefore include issuer policy and authority activity, not only seed-phrase compromise.
Scenario 12: DeFi vault accepts a controlled asset
A lending protocol accepts a Token-2022 asset as collateral but fails to model its permanent delegate.
The issuer later executes a legitimate compliance seizure against the vault account because of a legal condition affecting the depositor or asset.
The protocol's recorded collateral position and actual token balance can diverge from assumptions made when the asset was listed.
Protocol risk teams should therefore evaluate token authority before treating all fungible assets as equivalent collateral.
Why authority history matters as much as authority existence
A static snapshot answers what the token can do now. History helps answer how that power is actually used.
Never-used authority
An authority may exist as an emergency mechanism and never have been exercised. That still creates trust, but the absence of arbitrary past intervention can be useful context.
Rare documented use
An issuer may have a handful of transfers corresponding to public recovery or redemption cases. That pattern can support the stated governance model.
Frequent administrative movement
If permanent-delegate activity is common, users should understand why. The asset may function more like a managed ledger than an ordinary bearer token.
Unexplained or selective movement
Transfers concentrated around market events, holder sales or team disputes deserve investigation, particularly when the project did not disclose discretionary control.
How to think about risk without oversimplifying
A useful risk assessment separates capability, probability and impact.
Capability
The extension establishes that an active authority can authorize transfer or burn actions across the mint's token accounts.
Probability
How likely is that authority to be used against an ordinary holder? This depends on issuer purpose, policy, key security, legal environment and historical behavior.
Impact
If the authority is compromised or abused, how much of the holder's balance or the total mint can be affected?
A global authority can have high impact even when expected day-to-day use is low.
A practical investor workflow before holding the token
Permanent delegate due-diligence checklist
- Confirm the exact mint address from a trusted source.
- Verify whether the mint uses the Token-2022 Program.
- Enumerate all mint extensions, not only PermanentDelegate.
- Determine whether a permanent delegate is currently active.
- Record the exact delegate address.
- Compare that address with the project's published governance information.
- Check whether the same signer also holds mint or freeze authority.
- Investigate whether the authority appears to be a single key, multisig, program or institutional custody system.
- Review historical transactions involving the authority.
- Look specifically for transfers from token accounts whose owners did not sign.
- Look for burns authorized through the permanent delegate.
- Compare historical actions with redemption, recovery or compliance disclosures.
- Determine whether the asset's stated purpose reasonably requires administrative transfer power.
- Check whether marketing accurately discloses that power.
- Review other token controls that may compound the authority risk.
- Evaluate how much of your investment thesis depends on exclusive bearer-style ownership.
- For regulated assets, read the issuer's intervention and recovery policy.
- For speculative assets, apply greater scrutiny when broad administrative power has no clear product need.
- Re-check mint authority state after major governance or issuer changes.
- Decode suspicious transactions instead of assuming every unexpected transfer means wallet compromise.
What to do if tokens move without your signature
Unexpected movement is stressful, but the investigation should be evidence-driven.
Preserve the transaction signature
Start with the exact signature associated with the outgoing movement. Do not rely solely on a wallet notification or portfolio balance change.
Check whether unrelated assets moved
If multiple unrelated assets were drained, wallet compromise may be the dominant hypothesis.
If one Token-2022 mint moved while everything else remains intact, inspect that mint's authority structure.
Decode the authorization path
Determine who signed the transfer or burn. A token-account owner, ordinary account delegate and permanent delegate imply very different incident scenarios.
Review mint state immediately
Confirm the current Permanent Delegate extension and compare the signer from the transaction with the mint's authority structure.
Contact the issuer when appropriate
For a regulated or recovery-enabled product, the event may be related to an administrative process. Obtain the issuer's explanation and compare it with published terms.
Still secure the wallet if compromise cannot be excluded
Authority-level token movement does not prove the wallet is safe. If other indicators suggest key compromise, move unaffected assets using an appropriate security response.
Common misconceptions about Solana permanent delegates
A permanent delegate controls the entire wallet
No. The authority applies to the configured Token-2022 mint. It does not automatically gain control over unrelated assets or the wallet's SOL.
The holder can revoke it like a normal delegate
No. An ordinary account delegate is approved and revoked by the individual token account owner. The permanent delegate is a mint-level authority and cannot be revoked by individual holders from their own token accounts.
Permanent delegate and mint authority are the same thing
No. Mint authority issues additional supply. Permanent delegate authorizes transfers and burns of existing balances for the mint.
Permanent delegate and freeze authority are the same thing
No. Freeze authority freezes or thaws token accounts. Permanent delegate provides transfer and burn authorization. They are separate roles.
A token with permanent delegate must be a scam
No. Regulated securities, recovery products and other managed assets can have legitimate reasons for administrative control.
A regulated use means the feature is risk-free
No. The delegate key can be compromised, governance can fail and administrative decisions can be incorrect. Legitimate purpose and secure implementation are separate questions.
A hardware wallet protects the token from the permanent delegate
No. A hardware wallet protects the holder's private key. It cannot remove mint-level authority defined by Token-2022.
Revoking all token approvals removes every third-party authority
No. Revoking ordinary account delegates clears those local approvals. It does not erase an active Permanent Delegate extension on the mint.
If mint authority is revoked, nobody can touch existing balances
Not necessarily. Revoking mint authority can prevent future minting while a separate permanent delegate remains capable of authorizing transfers or burns of existing tokens.
Any unexpected transfer proves the seed phrase leaked
No. Transaction authorization needs to be inspected. A valid permanent-delegate action can move the affected token without the holder signing.
Permanent delegate means the issuer can ignore every token rule
No. The delegate receives a specific authorization role under Token-2022. Transactions still need to satisfy applicable program rules and account state.
What should long-term holders monitor?
If permanent delegate materially affects the value proposition of an asset, checking it only once may be insufficient.
Current delegate identity
Monitor whether authority changes to another signer or governance system.
Related mint authorities
Watch whether mint, freeze or other high-impact controls are modified. Combined authority changes can alter the risk model more than one field in isolation.
Delegate transaction history
New forced transfers or burns can reveal changes in issuer policy or operational behavior.
Issuer governance
Corporate control, multisig membership, legal status and administrative policy can change even while the mint address remains constant.
Product disclosures
Compare technical control with current terms. A change in what the issuer says it may do can be as important as a technical authority rotation.
Permanent delegate as a protocol-design choice
Token-2022 makes Solana fungible tokens more expressive. That expressiveness means two tokens using the same broad standard can expose very different ownership assumptions.
An ordinary bearer-style token emphasizes holder authorization. A regulated Token-2022 product can intentionally embed issuer capabilities. Both can be valid architectures when their behavior matches user expectations.
The standard exposes capability, governance determines trust
Token-2022 defines what the permanent delegate is allowed to authorize. It does not determine whether an issuer should use the capability, when an administrator should exercise it or what legal procedure is appropriate.
Those questions sit above the token program.
Security scanners need semantic authority reporting
A mature token scanner should avoid treating every authority as a binary danger flag.
Users need to know the capability, scope and current state first. Risk interpretation can then consider whether control is expected for the type of asset.
This is particularly important as tokenized securities, funds and other real-world assets adopt programmable standards.
Permanent delegate is only one piece of token risk
A token without permanent delegate can still be risky.
A token with permanent delegate can still be economically legitimate.
Complete due diligence should also examine supply controls, freeze capabilities, liquidity, holder concentration, market depth, metadata integrity, transaction behavior and the broader issuer or protocol.
The absence of one powerful extension is not proof of safety.
Likewise, discovering one extension should not replace analysis of everything else.
TokenToolHub's mint, freeze and liquidity guide provides a broader framework for connecting authority signals with other Solana token evidence.
A complete research framework
The strongest permanent-delegate analysis combines four layers of evidence.
Technical capability
Verify Token-2022 ownership, extension state and all active mint-level authorities.
Authority governance
Identify who controls the delegate and whether security matches the authority's potential blast radius.
Historical behavior
Inspect actual delegate-authorized transfers and burns rather than assessing capability in isolation.
Disclosure alignment
Compare on-chain control with the asset's stated purpose, legal terms and holder expectations.
If all four layers align, the authority can be evaluated as a known product property. If the layers contradict each other, uncertainty rises quickly.
Conclusion: ownership does not always mean exclusive token control
The Solana Permanent Delegate extension is one of the clearest examples of why modern token due diligence needs to go beyond balances, tickers and liquidity charts.
A Token-2022 asset can sit in a wallet whose private key is fully controlled by the holder while another mint-level authority retains the ability to authorize transfers or burns of that specific asset.
That does not mean the wallet itself has been delegated.
It does not mean the permanent delegate can take SOL or unrelated tokens.
It means the mint was designed with an additional authorization path that applies across token accounts for that mint.
The distinction from ordinary delegation is fundamental. A normal token-account delegate is local, allowance-limited and revocable by the holder who created the approval. A permanent delegate is a property of the mint and cannot be removed by one token account owner simply revoking their local approvals.
The distinction from mint authority is equally important. Mint authority controls new supply. Permanent delegate controls authorization over existing token balances through transfers and burns. A token can have fixed supply while still retaining a permanent delegate.
Freeze authority is different again. It controls whether eligible token accounts can transact while frozen. It does not automatically provide the same transfer or burn authorization as permanent delegate.
These authority roles can coexist, and they can be assigned to the same signer or distributed across different governance structures. That is why a serious review has to inspect the complete mint rather than looking for one reassuring flag.
Permanent delegation can be entirely legitimate.
A tokenized security may need court-order enforcement.
A regulated fund may need redemption burns.
A recovery-enabled asset may need a method for restoring ownership after a verified key-loss case.
A compliance product may need legally required seizure capability.
In those systems, the authority is not necessarily a hidden flaw. It may be an essential part of the product.
The risk changes when governance is weak or disclosure is misleading.
A single hot key controlling a mint-wide transfer authority creates a substantial compromise target. An unexplained authority that also controls minting and freezing creates even greater concentration. Forced transfers that contradict published policy deserve investigation. Marketing that promises exclusive holder control while the mint retains administrative seizure capability is particularly problematic.
The appropriate investor question is therefore not simply "does this token have a permanent delegate?"
Ask who controls it.
Ask how that control is secured.
Ask why the asset needs it.
Ask whether holders were told about it.
Ask what other authorities exist.
Ask whether the delegate has been used before.
Ask whether those historical actions match the stated policy.
Then decide whether that trust model matches the reason you want to hold the asset.
Start with the Solana Token Scanner to inspect the mint and token-level signals. If an authority wallet needs deeper review, use the Solana Wallet Risk Scanner. If a balance moved unexpectedly, decode the exact signature with the Solana Transaction Decoder before concluding that the wallet was compromised.
Token-2022 makes Solana assets capable of supporting more sophisticated financial and operational models. That flexibility is useful, but it means the word "ownership" can no longer be interpreted solely from who controls the wallet key.
For a PermanentDelegate-enabled asset, ownership and exclusive control are two different questions.
Check the mint before assuming exclusive control
A wallet balance proves that a token account holds an asset. It does not prove that the account owner is the only authority capable of moving that Token-2022 balance. Inspect the mint extensions first, then verify unusual authority activity at the transaction level.
FAQs
What is a Solana permanent delegate?
A Solana permanent delegate is a Token-2022 mint-level authority that can authorize transfers and burns from token accounts belonging to that mint. The authority exists through the mint's Permanent Delegate extension rather than through a separate approval from each token holder.
Can a permanent delegate move my Token-2022 tokens without my signature?
Yes. If the mint has an active permanent delegate, that authority can authorize eligible transfers from token accounts for the mint without requiring the token account owner's signature.
Can a permanent delegate burn my tokens?
Yes. Token-2022 permits the permanent delegate to authorize burns from token accounts for the mint. A valid burn reduces both the affected token-account balance and the mint's supply.
Can a permanent delegate take SOL from my wallet?
No, not merely because it is a permanent delegate for a Token-2022 mint. The authority applies to the configured token mint and does not automatically control SOL or unrelated assets in the wallet.
Can a permanent delegate move other tokens in my wallet?
Not through its PermanentDelegate role for another mint. Its mint-level authorization applies to token accounts belonging to the mint that contains the extension.
Can I revoke a permanent delegate from my token account?
No. Individual token account owners cannot revoke a mint-level permanent delegate from their own accounts. This differs from a normal token-account delegate, which the account owner can revoke.
What is the difference between a permanent delegate and an ordinary token delegate?
An ordinary delegate is approved by the owner of one token account, is limited by the delegated allowance and can be revoked by that owner. A permanent delegate is configured at the mint level and applies across token accounts for that mint.
Is permanent delegate the same as mint authority?
No. Mint authority can issue additional token supply while active. Permanent delegate can authorize transfers and burns of existing token balances. The roles are separate even when the same address controls both.
Is permanent delegate the same as freeze authority?
No. Freeze authority can freeze or thaw eligible token accounts. Permanent delegate provides mint-level transfer and burn authorization. One mint may have one, both or neither depending on its configuration.
Can a token have fixed supply and still have a permanent delegate?
Yes. Removing mint authority can make future minting unavailable while a separately configured permanent delegate remains relevant to existing balances.
Does a permanent delegate mean a token is a scam?
No. The feature can serve legitimate recovery, compliance, redemption and regulated-asset use cases. Risk depends on disclosure, governance, key security, scope and historical use.
Why would a regulated token need a permanent delegate?
A regulated issuer may need to enforce court orders, handle verified lost-key recovery, process redemptions, correct ownership records or comply with legally required asset restrictions.
Can a permanent delegate be used for asset recovery?
Yes. An issuer can design a recovery process in which a verified holder's tokens are moved from an inaccessible account to a replacement account without requiring the lost wallet to sign.
Can a permanent delegate seize tokens?
The delegate can authorize transfers from token accounts for the mint, which can technically support seizure-style workflows. Whether such use is legitimate depends on the asset's terms, governance and applicable process.
Can a permanent delegate force-burn a holder's tokens?
The permanent delegate can authorize burns under Token-2022. This can support redemptions or compliance actions but creates material holder risk if the authority is compromised or abused.
Where is the permanent delegate stored?
The authority is stored in the Permanent Delegate extension on the Token-2022 mint account. It is a mint-level property rather than a normal delegate approval on each holder's token account.
Can the permanent delegate authority change?
Token-2022 includes authority-management support for PermanentDelegate state. Researchers should inspect the mint's current state rather than assuming the address documented at launch remains the active authority indefinitely.
Does revoking my token approvals remove the permanent delegate?
No. Revoking an ordinary token-account delegate clears that local approval. It does not remove the mint-level Permanent Delegate extension.
Will moving the token to a hardware wallet remove permanent-delegate risk?
No. A hardware wallet protects the holder's private key, but it does not change Token-2022 mint authority. The permanent delegate remains relevant to the affected mint regardless of which wallet device protects the owner's key.
If tokens move without my signature, does that mean my wallet was hacked?
Not necessarily. If the mint has a permanent delegate, that authority can authorize movement of the affected token without the holder signing. Decode the transaction and inspect the mint before deciding whether wallet compromise occurred.
How can I identify a permanent-delegate transfer?
Inspect the Token-2022 instruction, source token account, destination or burn action, transaction signers and mint extension state. Compare the transaction authority with the mint's current permanent delegate.
What happens when a permanent delegate burns tokens?
The affected token account balance decreases and the mint's outstanding supply decreases by the burned amount. The tokens are not transferred to another holder.
Can the freeze authority seize tokens without permanent delegate?
Freeze authority alone is not the same as transfer authority. It can freeze or thaw eligible token accounts, but that role does not itself provide the PermanentDelegate transfer or burn authorization.
Can DeFi protocols be affected by permanent delegate?
Yes. Token-2022 assets held inside protocol-controlled token accounts remain subject to the mint's authority model. Protocol risk teams should evaluate permanent delegate before relying on such assets as collateral or liquidity.
Can an exchange wallet be subject to permanent delegate?
Yes. An exchange controlling the private key to its Token-2022 token account does not remove the mint's permanent delegate. Asset onboarding should account for issuer-level transfer or burn powers.
What should I inspect before buying a token with permanent delegate?
Inspect the exact mint, Token-2022 extensions, current delegate address, mint and freeze authorities, delegate governance, historical authority transactions, project disclosure and whether the control model fits the asset's stated purpose.
Is a multisig permanent delegate safer than a single wallet?
A well-designed multisig can reduce single-key compromise risk, but it does not remove administrative control. Signer independence, threshold design, governance process and operational security still matter.
What if the permanent delegate has never been used?
The capability still exists while the authority remains active. Lack of historical use can provide useful context, but it does not eliminate future compromise, policy change or administrative intervention risk.
What is the biggest investor red flag?
One of the strongest red flags is a mismatch between on-chain capability and disclosure, such as a token marketed as giving holders exclusive, censorship-resistant control while an undisclosed permanent delegate can move or burn holder balances.
What is the safest way to evaluate permanent delegate risk?
Combine mint-level extension inspection, authority-governance analysis, wallet and entity context, historical transaction decoding and comparison with the project's published terms. No single signal provides the complete picture.
Does Token-2022 warn about permanent delegate risk?
The Token-2022 implementation recognizes the significance of the extension, and current program code includes warning language during relevant token-account initialization indicating that tokens associated with a mint carrying a permanent delegate may be subject to seizure.
References and further reading
These primary sources document Token-2022 extensions, permanent-delegate behavior and the related token authority model.
- Solana Documentation: Permanent Delegate
- Solana Documentation: Token Extensions
- Solana Documentation: SPL Token Basics
- Solana Documentation: Burn Tokens
- Token-2022 Program Source
This guide is educational security research. A permanent delegate is a technical capability, not automatic evidence of malicious intent. Regulated and recovery-enabled assets can intentionally retain administrative control. Evaluate the exact live mint, authority structure, disclosure, historical use and asset purpose before deciding whether the control model is appropriate for your risk tolerance.
