Token-2022 transfer hooks declare their account requirements through an ExtraAccountMetaList PDA, written once during initialize_extra_account_meta_list. The list encodes every account the hook needs at execute time: the binding PDA, the coefficient state account, the Whirlpool, and the active tickArray accounts.
The Token-2022 program validates this list before invoking the hook. A malformed or incomplete list causes the entire transfer to fail at the program boundary, before any tame logic runs. The binding between the token, its hook program, and the bound pool is enforced by the runtime, not by trust.