Most "rug pull" content on Solana is about classic SPL tokens — mint authority, liquidity pulls, whale dumps. But the sharper edge now is Token-2022: a newer token standard whose extensions give a creator powers a normal SPL token never had. For an autonomous trading agent that buys tokens by address, these are landmines.
Here are the extensions that actually drain agents, and how to screen for them before a buy.
The dangerous extensions
permanentDelegate — the single worst one. The creator holds a permanent delegate that can move or burn your tokens out of your wallet, any time, with no further approval. You hold the token; they hold the keys to it.
transferHook — a custom program runs on every transfer and can make selling fail under conditions the creator chooses.
