Permissioned Tokens on Solana: How Token ACL Works — and How to Tell It From a Honeypot

Originally published on xroot.dev . On-chain, a regulated fund token and a honeypot scam are the same shape. Both are Token-2022 mints. Both keep an active freeze authority. Both set DefaultAccountState to Frozen , so every new holder's account starts locked. One of them is a European money-market fund following its regulator's rules; the other is a trap built to let you buy and never sell. Every token scanner I tested reads them identically: red flags, high risk, score zero. The reason this now matters is sRFC-37, the Token ACL standard — the Solana Foundation's official mechanism for permissioned tokens. It has been live on mainnet since March 2026, real institutional money already uses it, and the entire real-world-asset wave forming on Solana is going to ship in this exact shape. This post covers how it works end to end — and the structural check that separates a compliant token from a trap, verified against the chain rather than anyone's metadata. Why Permissioned Tokens Exist at All A tokenized treasury fund, a regulated stablecoin, a security token — their issuers are not allowed to let anyone hold them. KYC requirements, sanctions screening, court orders, investor-accreditation rules: the issuer must be able to control who holds the asset and stop specific wallets, or the asset cannot legally exist on a public chain. Solana had two ways to build that before, and both hurt: Transfer hooks run issuer code on every transfer — but every DEX, wallet and protocol touching the token must implement the hook interface, so composability dies at exactly the venues that create liquidity. Manual freeze-and-thaw keeps standard transfers — but every new holder starts frozen and waits for the issuer to co-sign a thaw. Onboarding becomes a support ticket, and the issuer signs forever. Token ACL is the third path: keep the freeze mechanism — the one lever the token program already enforces everywhere — but make thawing self-service against a published rulebook. The Mechanics: