Solana
Token delegates
A delegate lets another address move tokens from your Solana token account without your signature, until you revoke it.
How it works
SPL token accounts can name a delegate with an allowance. Programs use this for things like trading bots and marketplaces.
Drainers set themselves as delegate on your token accounts during a fake claim, then pull the tokens later.
Delegates are easy to miss because most wallets don't list them on the main screen.
Red flags
- An 'approve' or delegate instruction on a site that shouldn't need one
- Tokens leaving your wallet days after you used a new site
Protect yourself
- Check your token accounts for delegates now and then
- Revoke delegates you don't recognise
- Use a burner wallet for new sites and claims
If you already signed
- Revoke the delegate (many wallets and explorers can do it) or move the tokens to a fresh wallet
- Check every token account, not just the one that was drained
Incidents using it 0
None tracked yet.