x402agent/pump-solana-wallet

Solana Wallet — Key Generation & Security

Secure Solana wallet generation using official Solana Labs libraries with Ed25519 keys, memory zeroization, and offline-only operation. Three implementations: Rust (production), TypeScript (educational), and Bash (wrappers).

Approved Crypto Libraries

| Context | Library | Role | |---------|---------|------| | Rust | solana-sdk | Keypair::new(), Signer trait, Base58 encoding | | TypeScript | @solana/web3.js | Keypair.generate(), Keypair.fromSecretKey() | | Shell | solana-keygen | grind (vanity), new (random), verify | | MCP Server | @solana/web3.js | Session keypair management in SolanaWalletMCPServer |

Address Format

• 32-byte Ed25519 public key encoded as Base58
• Length: 32–44 characters (typically 43–44)
• Case-sensitive alphabet: 123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz

Vanity Address Difficulty

| Prefix Length | Expected Attempts | Time (100K/sec) | |---------------|-------------------|-----------------| | 1 char | ~58 | < 1 sec | | 2 chars | ~3,364 | < 1 sec | | 3 chars | ~195,112 | ~2 sec | | 4 chars | ~11.3M | ~2 min | | 5 chars | ~656M | ~2 hours |

Security Model (6 Defense Layers)

1. CSPRNG only — OsRng (Rust), crypto.getRandomValues (Node.js)
2. Official libraries — No third-party crypto
3. Memory zeroization — Zeroize trait (Rust), buffer.fill(0) (TypeScript)
4. File permissions — 0o600 owner-only
5. Offline operation — No network calls during key generation
6. Post-generation verification — Re-derive public key from secret and compare

Memory Zeroization by Language

| Language | Mechanism | |----------|-----------| | Rust | Zeroize trait + Drop impl, zeroize_on_drop | | TypeScript | secretKey.fill(0) + Buffer.alloc(0) (best-effort, GC may relocate) | | Shell | shred -u or rm -P for file cleanup |

Patterns to Follow

• ONLY use solana-sdk, @solana/web3.js, or solana-keygen for crypto operations
• Zero all key material as soon as it is no longer needed
• Set file permissions to 0o600 immediately after writing keypair files
• Never make network calls during key generation
• Verify every generated keypair: re-derive public key from secret and compare

Common Pitfalls

• JavaScript GC may copy/relocate buffers — fill(0) is best-effort, not guaranteed
• solana-keygen output is [u8; 64] JSON array (32-byte secret + 32-byte public)
• Base58 is NOT the same as Base64 — Solana uses a specific alphabet without 0OIl
• Vanity matching must use raw Base58 — case-sensitive, no regex anchoring errors