Why Does Solana Token-2022 Need Separate Checks From SPL?
SPL and Token-2022 carry different categories of risk — a check built only for one can miss what matters on the other. Here's why the distinction matters.
Treating every Solana token the same way during a safety check misses an entire category of risk specific to Token-2022 — because the original SPL standard simply doesn't have the mechanisms that make those checks necessary in the first place.
Why SPL Tokens Have a Simpler, More Predictable Risk Profile
The original SPL token standard supports a limited, well-understood set of authorities — primarily mint authority and freeze authority. A safety check for an SPL token can focus on a relatively small, consistent set of questions, because the standard itself doesn't offer many more capabilities to check for.
Why Token-2022 Expands What Needs Checking Considerably
Token-2022 adds an entire system of optional extensions — Transfer Fee, Permanent Delegate, Default Account State, Mint Close Authority, and others — each representing a distinct capability that may or may not be enabled on any given token. A check that only looks at mint and freeze authority, the way it would for SPL, misses all of this entirely.
Why You Can't Assume Which Extensions Are Enabled
Unlike a fixed feature set, Token-2022 extensions are configured individually per token — one token might use only the Transfer Fee extension, another might combine several, and a third might use the standard with no extensions enabled at all beyond what SPL already offered. There's no way to know which apply without checking that specific token's configuration directly.
Why This Matters More as Token-2022 Adoption Grows
As more new tokens launch using Token-2022 rather than the older standard, the proportion of tokens where these additional checks are actually relevant increases — a habit built around SPL-only checks becomes progressively less complete as the ecosystem shifts.
Why a Tool Needs to Explicitly Check for the Standard Itself First
Before even checking specific extensions, confirming whether a token uses SPL or Token-2022 in the first place is a necessary first step — a check built only for one standard can return an incomplete or misleading picture if it doesn't first identify which standard actually applies.
What This Means for Manually Reviewing a New Solana Token
Checking a token's underlying program (whether it's the original Token Program or Token-2022) before assuming which categories of risk are even possible for that specific token, and if it is Token-2022, checking each configured extension individually rather than assuming standard mint/freeze checks cover everything relevant.
Check whether a Solana token uses the original SPL standard or Token-2022, and its full extension configuration if applicable — the two standards carry meaningfully different categories of risk to check for.