Sol Safekey Bot

Sol SafeKey Bot

Use sol-safekey whenever a bot needs wallet creation, encrypted keystore storage, unlock, or secure Solana operations.

Core Security Rules

• Do not hard-code base58 private keys.
• Do not store wallet passwords in environment variables.
• Do not commit keystores, decrypted keys, .env, logs with secrets, or startup scripts containing secrets.
• Prefer encrypted keystore files plus stdin or interactive password entry.
• Clear password variables in shell scripts after use.
• Keep real trading disabled until wallet loading and simulation paths are verified.

Dependency

For bot integration:

sol-safekey = { version = "0.1.7", features = ["solana-ops"] }

For local path development:

sol-safekey = { path = "../sol-safekey", features = ["solana-ops"] }

Feature flags include cli, 2fa, solana-ops, sol-trade-sdk, and full.

Three Integration Modes

1. Embedded Interactive Menu

Add a safekey subcommand before bot startup:

if std::env::args().nth(1).as_deref() == Some("safekey") {
    sol_safekey::interactive::show_main_menu()
        .map_err(|e| anyhow::anyhow!(e))?;
    return Ok(());
}

Users run:

./your-bot safekey

2. Bot Helper Unlock

Use the helper when an interactive unlock is acceptable:

let keypair = sol_safekey::bot_helper::ensure_wallet_ready("keystore.json")?;

3. Programmatic Keystore Load

Use this when the bot reads a password from stdin or another secure source:

use sol_safekey::KeyManager;
use std::io::{self, Read};

let json = std::fs::read_to_string("keystore.json")?;
let mut password = String::new();
io::stdin().read_to_string(&mut password)?;
let keypair = KeyManager::keypair_from_encrypted_json(&json, password.trim())?;

For creating a keystore:

let keypair = sol_safekey::KeyManager::generate_keypair();
let json = sol_safekey::KeyManager::keypair_to_encrypted_json(&keypair, password)?;
std::fs::write("keystore.json", json)?;

Startup Script Pattern

Prefer stdin over env vars:

#!/usr/bin/env bash
set -euo pipefail

read -rsp "Wallet password: " WALLET_PASSWORD
echo
printf '%s' "$WALLET_PASSWORD" | ./target/release/your-bot
WALLET_PASSWORD=""
unset WALLET_PASSWORD

Avoid export WALLET_PASSWORD=....

Bot Integration With sol-trade-sdk

After unlocking, pass the keypair as the payer to sol-trade-sdk:

let payer = std::sync::Arc::new(keypair);
let trade_client = sol_trade_sdk::SolanaTrade::new(payer, trade_config).await;

Keep wallet handling separate from trade strategy. The strategy should receive a signer/client, not raw private key text.

CLI Capabilities

The CLI can create encrypted wallets, decrypt, unlock, check balances, transfer SOL/SPL, wrap/unwrap WSOL, close WSOL ATA, create durable nonce accounts, and perform supported PumpFun/PumpSwap sell/cashback operations when features are enabled.

Use CLI or interactive mode for setup; use library APIs for bot runtime.

Review Checklist

• Keystore path is configurable.
• Password is read from stdin, prompt, or a secret manager; not an env var.
• Private key strings do not appear in source, tests, logs, or errors.
• Runtime logs print public key only.
• .gitignore excludes keystores, logs, and local config.
• Bot can start in dry-run/simulate mode after unlocking.

Multi-Language Guidance

If the bot is not Rust, prefer using sol-safekey CLI for wallet lifecycle and a small bridge that returns a signer only inside the local process. If a native binding is unavailable, do not reimplement encryption casually; use the CLI/library as the trust boundary or ask the user how they want secrets managed.