Sigvex
SolanaRemediation1 min read

Token Extension Security Remediation

How to fix Token-2022 extension security misconfigurations.

svmaccess-control

Token Extension Security Remediation

Overview

Related Detector: Token Extension Security

Misconfigured Token-2022 extensions create bypass opportunities. The fix is to validate amounts, recipients, and authorities in all extension hooks and operations.

Impact. An empty or misconfigured extension hook (a transfer hook, transfer-fee, or similar) removes the very control the extension was added to enforce, so transfers that should be blocked, capped, or fee-charged go through unchecked. Because integrators presume the extension is enforcing policy, they trust a guarantee that isn’t there — the failure is silent until it’s abused.

// Transfer hook with full validation
pub fn execute_hook(ctx: Context<Hook>, amount: u64) -> Result<()> {
    require!(amount <= MAX_TRANSFER, ExceedsLimit);
    require!(!is_blacklisted(&ctx.accounts.destination), Blacklisted);
    require!(ctx.accounts.source.owner == expected_program, InvalidSource);
    Ok(())
}

Common Mistakes

Mistake: Empty Transfer Hook

// WRONG: hook does nothing -- defeats purpose of the extension
pub fn execute_hook(_ctx: Context<Hook>) -> Result<()> {
    Ok(())  // No validation at all
}

If a transfer hook is configured, it should perform meaningful validation.

References