From cc858ef3db390b57dd291f6d966b21b107a516a1 Mon Sep 17 00:00:00 2001
From: highlander <highlander@keepkey.com>
Date: Fri, 31 Jul 2026 14:41:53 -0300
Subject: [PATCH] feat(solana): add verified token recipient owner hints

---
 messages-solana.options | 2 ++
 messages-solana.proto   | 9 +++++++++
 2 files changed, 11 insertions(+)

diff --git a/messages-solana.options b/messages-solana.options
index 510df1cf..fd945238 100644
--- a/messages-solana.options
+++ b/messages-solana.options
@@ -6,6 +6,8 @@ SolanaSignTx.raw_tx max_size:1232
 SolanaSignTx.token_info max_count:4
 SolanaSignTx.schema_payload max_size:256
 SolanaSignTx.schema_signature max_size:64
+SolanaSignTx.token_recipient_owner max_count:4
+SolanaSignTx.token_recipient_owner max_size:32
 SolanaTokenInfo.mint max_size:32
 SolanaTokenInfo.symbol max_size:13
 SolanaAddress.address max_size:45
diff --git a/messages-solana.proto b/messages-solana.proto
index 865b5cfb..d377a6aa 100644
--- a/messages-solana.proto
+++ b/messages-solana.proto
@@ -78,6 +78,15 @@ message SolanaSignTx {
     optional bytes schema_payload = 9;
     optional bytes schema_signature = 10;       // 64-byte compact secp256k1 over SHA256(payload)
     optional uint32 schema_signer_key_id = 11;  // trusted clearsign signer slot (0-3)
+    /*
+     * Candidate owners for SPL associated-token-account destinations. For a
+     * TransferChecked instruction, firmware may display an owner only after
+     * independently deriving ATA(owner, token_program, mint) and matching it
+     * to the signed destination account. An unmatched candidate is never
+     * treated as a recipient. This lets payment protocols such as x402 show
+     * their payTo address without trusting host-side decoding or chain RPC.
+     */
+    repeated bytes token_recipient_owner = 12;  // 32-byte Solana public keys (max 4)
 }
 
 /**