Transfer hooks: the extra programme inside a transfer

Solana's transfer-hook extension allows custom programme logic to execute during token transfers. This creates another dependency to examine alongside the mint and token account. A transfer can involve more than subtracting one balance and adding another.

Map the dependency Identify the hook programme, its configuration and any additional accounts it requires. Determine whether that programme can be upgraded and who holds the authority. Review the actual conditions under which transfers succeed, rather than assuming the behaviour from a token description.

Test the relevant direction A successful incoming transfer does not establish that every outgoing transfer will work under the same conditions. Where testing is authorised, compare the intended user operation with a small, controlled example and record the accounts, slot and response. Do not expose someone else's funds to prove a point.

Explain the practical consequence Report the conditions and the authority that can change them. Do not call every hook a honeypot. A restriction might implement a disclosed product rule, while an undisclosed restriction might contradict the market-facing promise. The difference is established through configuration, execution and communication, not through a label pasted onto a scanner result.