x402agent Solana Wallet — Key Generation & Security
Secure Solana wallet generation using official Solana Labs libraries with Ed25519 keys, memory zeroization, and offline-only operation. Three implementations: Rust (production), TypeScript (educational), and Bash (wrappers).
Approved Crypto Libraries
| Context | Library | Role |
|---|---|---|
| Rust | solana-sdk |
Keypair::new(), Signer trait, Base58 encoding |
| TypeScript | @solana/web3.js |
Keypair.generate(), Keypair.fromSecretKey() |
| Shell | solana-keygen |
grind (vanity), new (random), verify |
| MCP Server | @solana/web3.js |
Session keypair management in SolanaWalletMCPServer |
Address Format
- 32-byte Ed25519 public key encoded as Base58
- Length: 32–44 characters (typically 43–44)
- Case-sensitive alphabet:
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz
Vanity Address Difficulty
| Prefix Length | Expected Attempts | Time (100K/sec) |
|---|---|---|
| 1 char | ~58 | < 1 sec |
| 2 chars | ~3,364 | < 1 sec |
| 3 chars | ~195,112 | ~2 sec |
| 4 chars | ~11.3M | ~2 min |
| 5 chars | ~656M | ~2 hours |
Security Model (6 Defense Layers)
- CSPRNG only —
OsRng(Rust),crypto.getRandomValues(Node.js) - Official libraries — No third-party crypto
- Memory zeroization —
Zeroizetrait (Rust),buffer.fill(0)(TypeScript) - File permissions —
0o600owner-only - Offline operation — No network calls during key generation
- Post-generation verification — Re-derive public key from secret and compare
Memory Zeroization by Language
| Language | Mechanism |
|---|---|
| Rust | Zeroize trait + Drop impl, zeroize_on_drop |
| TypeScript | secretKey.fill(0) + Buffer.alloc(0) (best-effort, GC may relocate) |
| Shell | shred -u or rm -P for file cleanup |
Patterns to Follow
- ONLY use
solana-sdk,@solana/web3.js, orsolana-keygenfor crypto operations - Zero all key material as soon as it is no longer needed
- Set file permissions to
0o600immediately after writing keypair files - Never make network calls during key generation
- Verify every generated keypair: re-derive public key from secret and compare
Common Pitfalls
- JavaScript GC may copy/relocate buffers —
fill(0)is best-effort, not guaranteed solana-keygenoutput is [u8; 64] JSON array (32-byte secret + 32-byte public)- Base58 is NOT the same as Base64 — Solana uses a specific alphabet without
0OIl - Vanity matching must use raw Base58 — case-sensitive, no regex anchoring errors