Skip to content

feat(solana): add verified token recipient owner hints #114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BitHighlander merged 1 commit into from
Jul 31, 2026
Merged

feat(solana): add verified token recipient owner hints #114

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions messages-solana.options
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@ SolanaSignTx.raw_tx max_size:1232
SolanaSignTx.token_info max_count:4
SolanaSignTx.schema_payload max_size:256
SolanaSignTx.schema_signature max_size:64
SolanaSignTx.token_recipient_owner max_count:4
SolanaSignTx.token_recipient_owner max_size:32
SolanaTokenInfo.mint max_size:32
SolanaTokenInfo.symbol max_size:13
SolanaAddress.address max_size:45
Expand Down
9 changes: 9 additions & 0 deletions messages-solana.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,15 @@ message SolanaSignTx {
optional bytes schema_payload = 9;
optional bytes schema_signature = 10; // 64-byte compact secp256k1 over SHA256(payload)
optional uint32 schema_signer_key_id = 11; // trusted clearsign signer slot (0-3)
/*
* Candidate owners for SPL associated-token-account destinations. For a
* TransferChecked instruction, firmware may display an owner only after
* independently deriving ATA(owner, token_program, mint) and matching it
* to the signed destination account. An unmatched candidate is never
* treated as a recipient. This lets payment protocols such as x402 show
* their payTo address without trusting host-side decoding or chain RPC.
*/
repeated bytes token_recipient_owner = 12; // 32-byte Solana public keys (max 4)
}

/**
Expand Down
Loading