pump-solana-wallet

---
name: pump-solana-wallet
description: "Secure Solana wallet generation using official Solana Labs libraries — Ed25519 keypairs, memory zeroization, vanity address generation, offline-only operation, and multi-language implementations (Rust, TypeScript, Bash)."
metadata:
  solanaos:
    homepage: https://github.com/nirholas/pump-fun-sdk
    requires:
      bins:
        - solana-keygen
---

# Solana Wallet — Key Generation & Security

Secure Solana wallet generation using official Solana Labs libraries with Ed25519 keys, memory zeroization, and offline-only operation. Three implementations: Rust (production), TypeScript (educational), and Bash (wrappers).

## Approved Crypto Libraries

| Context | Library | Role |
|---------|---------|------|
| Rust | `solana-sdk` | `Keypair::new()`, `Signer` trait, Base58 encoding |
| TypeScript | `@solana/web3.js` | `Keypair.generate()`, `Keypair.fromSecretKey()` |
| Shell | `solana-keygen` | `grind` (vanity), `new` (random), `verify` |
| MCP Server | `@solana/web3.js` | Session keypair management in `SolanaWalletMCPServer` |

## Address Format

- 32-byte Ed25519 public key encoded as Base58
- Length: 32–44 characters (typically 43–44)
- Case-sensitive alphabet: `123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz`

## Vanity Address Difficulty

| Prefix Length | Expected Attempts | Time (100K/sec) |
|---------------|-------------------|-----------------|
| 1 char | ~58 | < 1 sec |
| 2 chars | ~3,364 | < 1 sec |
| 3 chars | ~195,112 | ~2 sec |
| 4 chars | ~11.3M | ~2 min |
| 5 chars | ~656M | ~2 hours |

## Security Model (6 Defense Layers)

1. **CSPRNG only** — `OsRng` (Rust), `crypto.getRandomValues` (Node.js)
2. **Official libraries** — No third-party crypto
3. **Memory zeroization** — `Zeroize` trait (Rust), `buffer.fill(0)` (TypeScript)
4. **File permissions** — `0o600` owner-only
5. **Offline operation** — No network calls during key generation
6. **Post-generation verification** — Re-derive public key from secret and compare

## Memory Zeroization by Language

| Language | Mechanism |
|----------|-----------|
| Rust | `Zeroize` trait + `Drop` impl, `zeroize_on_drop` |
| TypeScript | `secretKey.fill(0)` + `Buffer.alloc(0)` (best-effort, GC may relocate) |
| Shell | `shred -u` or `rm -P` for file cleanup |

## Patterns to Follow

- ONLY use `solana-sdk`, `@solana/web3.js`, or `solana-keygen` for crypto operations
- Zero all key material as soon as it is no longer needed
- Set file permissions to `0o600` immediately after writing keypair files
- Never make network calls during key generation
- Verify every generated keypair: re-derive public key from secret and compare

## Common Pitfalls

- JavaScript GC may copy/relocate buffers — `fill(0)` is best-effort, not guaranteed
- `solana-keygen` output is [u8; 64] JSON array (32-byte secret + 32-byte public)
- Base58 is NOT the same as Base64 — Solana uses a specific alphabet without `0OIl`
- Vanity matching must use raw Base58 — case-sensitive, no regex anchoring errors