Permanent Delegation on Solana: How to Check a Token
A token can have permissions that you did not create with a wallet approval. Token-2022's permanent delegate is one example: its configuration belongs to the mint, so inspecting only the delegate field on your own token account is not a complete check.
This guide is about identifying that extension and recording what you find. It does not treat its presence as proof that an issuer is malicious, nor does it assume that a token is harmless simply because an explorer omits an extension label.
What does permanent delegation mean on Solana?
A Token-2022 permanent delegate is a mint-level authority that can authorize transfers and burns for that mint, subject to applicable program constraints. A holder cannot remove it through a normal token-account approval revocation. To check it, inspect the exact mint's decoded extensions rather than only your account's delegate field.
Solana's Permanent Delegate documentation describes the mint-wide authority and its distinction from holder-revocable permissions. “Permanent” refers to the holder's inability to revoke it from an individual account; inspect current state rather than assuming a recorded authority address can never change.
Which address do you need to inspect?
You need the token mint. Start with the asset in your wallet, find its mint address, and compare that address with a trusted project reference if one exists. Do not search only by ticker or choose the first matching logo.
A wallet address, token account address, and mint address answer different questions. Looking at your wallet's general permissions page may show connections or account allowances without showing every mint-level extension. Looking at the token account may show its own delegate, which is another permission again.
For a hypothetical pair of tokens with the same symbol, one could be a classic SPL mint and the other a Token-2022 mint with additional permissions. The matching name tells you nothing reliable about which configuration you hold.
How do you check a mint for a permanent delegate?
- Copy the exact mint address from the asset details.
- Open that mint in a Solana explorer or a current Token-2022 account decoder.
- Check the program that owns the mint account.
- If it is Token-2022, inspect the decoded extension list.
- Look for
PermanentDelegateand its configured delegate address. - Record the mint, delegate value, network, and observation time.
- Inspect your token account separately for ordinary delegates and account state.
This check is read-only. You do not need to sign a message or connect your wallet to read a public mint. If a tool asks for a transaction merely to reveal extension information, verify why it is requesting that action before proceeding.
What if the explorer does not show an extension section?
Distinguish “not present in decoded account data” from “not displayed by this interface.” An explorer can be useful without decoding every extension. A blank field or missing panel is therefore not enough to establish absence.
Use a decoder that understands the current Token-2022 format, and confirm it is reading the mint on the intended network. If the result remains unclear, record the check as unresolved. Do not convert an interface limitation into a security claim.
For a developer investigation, keep the raw account response with the decoder version and observation context. For a normal holder, a clear mint link and a current decoded extension view are more useful than a screenshot containing only a token symbol.
How is this different from a normal token approval?
An ordinary token-account delegate is a permission attached to a particular account. A permanent delegate is configured for a mint. A wallet connection is different again: it is a session relationship between a wallet and an application.
| Permission or relationship | Where to inspect it | Does disconnecting the site remove it? |
|---|---|---|
| Wallet connection | Wallet's connected-app interface | It ends that connection |
| Ordinary token-account delegate | The specific token account | No; inspect the applicable revoke operation |
| Permanent delegate | Token-2022 mint extensions | No; a holder cannot revoke it per account |
Read Token Approval vs Mint and Freeze Authority for the broader authority comparison. The practical point here is to inspect each permission at its actual scope before choosing a response.
Can a permanent delegate move every asset in your wallet?
The extension concerns its mint. It does not by itself grant the delegate your wallet key or authority over unrelated mints. Keep that scope clear when evaluating a claim that someone “has access to the wallet.”
That does not settle every possible risk. If you separately signed a suspicious transaction, investigate those instructions and any permissions they created. Receiving a token, holding an extended mint, connecting an app, and approving a transaction are different events.
Use Does Receiving a Scam Token Give It Wallet Access? for the unsolicited-receipt question. If you interacted with a suspicious site, preserve the relevant signatures so you can review what actually changed.
What should you do if a token has this extension?
First decide whether the permission matches the project's stated design and your expectations for holding it. An explanation from an issuer is useful context, but compare it with the mint's actual configuration. Do not infer a promise about future behavior from the extension name alone.
If the authority is unacceptable to you, consider your available actions without assuming they will all succeed. Transfers, sales, and burns remain subject to program constraints and current account state. A display-only hide does not alter the mint or remove the extension.
Sol Incinerator's ordinary approval tools do not turn a holder into the mint's authority. Use supported cleanup only after understanding the asset and intended result. Burning is irreversible, and account closure does not retroactively remove a permission from the mint.
What makes a useful permission-review record?
Keep the exact mint, token program, observed extension values, your token-account state, and any action you took. Include a timestamp because configurations and balances can change. Label unresolved decoder results honestly.
That record answers a more useful question than “was this token safe?” It shows which authority you observed, which assets it applied to, and what you chose to do based on that evidence.
Related Reading
Frequently Asked Questions
What is a permanent delegate on Solana?
A permanent delegate is a Token-2022 mint-level authority that can authorize transfers and burns involving that mint, subject to the program and account constraints. It differs from an allowance on one token account. A holder cannot remove the mint-level permission by using an ordinary token-account revoke action.
How do I check whether a token has a permanent delegate?
Find the exact mint address, confirm that its program is Token-2022, and inspect the decoded mint extensions for PermanentDelegate. Record the configured delegate address and the time of the check. If your explorer does not decode extensions, use another current decoder rather than treating a blank display as proof of absence.
Does a permanent delegate control my entire wallet?
The extension applies to accounts for its specific mint, not every unrelated asset in your wallet. It does not by itself reveal your private key or grant general wallet signing access. Separately inspect any account approvals or transactions you authorized, because those can create permissions beyond the extension you are reviewing.