[mikemaccana]

Why

The Whitelist transfer hook had four problems:

• Size limit. Every allowed address lived in one account, capped at max_len(11).
• One list for every mint. The list sat at a single global PDA (seeds = [b"white_list"]).
• Anyone could take it over. initialize_extra_account_meta_list opened the list with init_if_needed and set authority = payer on every call, so setting up the hook for any mint of your own made you the authority of everyone's list.
• Wrong check. The hook checked the destination token account's address rather than the wallet that owns it, and rejected transfers with panic!.

Block List was a Pinocchio-only example with no catalogue entry. Its design, one account per blocked wallet, is what Allow/Block List already does in Block mode, in Anchor v1, Anchor v2 and Quasar.

Changes

Whitelist becomes Allow List (tokens/token-extensions/transfer-hook/allow-list/). All three variants (Anchor v1, Anchor v2, Quasar) change together, and the program ID is unchanged.

• Each mint has its own allow list account, at a PDA seeded by "allow_list" and the mint. It holds the list's authority.
• Each allowed wallet has its own allowed wallet account, at a PDA seeded by "allowed_wallet", the mint and the wallet. If the account exists, the wallet is allowed, so the list has no size limit.
• add_to_whitelist is replaced by allow_wallet. The new disallow_wallet closes a wallet's account and returns its rent.
• initialize_extra_account_meta_list requires the mint authority's signature and uses init, so only the issuer can set up a mint's list.
• The hook's one extra account is derived on each transfer from the mint and the destination token account's owner (account 2, bytes 32..64). If that account doesn't exist, the transfer fails with RecipientNotAllowed (in Quasar, custom error 6000).

Block List removed. tokens/token-extensions/transfer-hook/block-list/ is deleted.

Notices. whitelist/README.md and block-list/README.md remain in the old paths, saying where each example went.

Docs. The root README catalogue, the root Cargo.toml workspace member, Cargo.lock, scripts/generate-quasar-readmes.mjs and CHANGELOG.md are updated. The lending and managed-fund docs now say "allow list" instead of "whitelist".

Tests

Variant	Result	How the hook is exercised
Anchor v2	7 passed	Real Token Extensions transfers through the hook
Anchor v1	7 passed	Real Token Extensions transfers through the hook
Quasar	9 passed	Calls the hook directly with the accounts Token Extensions would pass, because the harness can't make a hooked transfer

The tests cover:

• allowing a wallet, and rejecting a wallet that isn't on the list;
• disallowing a wallet;
• a wallet allowed for one mint only;
• fifty allowed wallets;
• a stranger trying to create a mint's allow list;
• a non-authority trying to allow a wallet. Quasar also tests disallowing as a non-authority, and passing another wallet's account.

cargo fmt --check and cargo clippy -p transfer-hook-allow-list -- -D warnings are clean.

The Quasar program was compiled with cargo-build-sbf and tested from that build. quasar build, which also generates the IDL and clients, wasn't run locally, so CI is its first run.

---

Generated by Claude Code