Advanced· Lesson 8 of 8· 5 min

Token locks, vesting and escrow

A lock is a promise enforced by a program instead of a person. Here is how one is built, how vesting schedules are expressed on-chain, and how to tell a real lock from a wallet with a label on it.

“Team tokens locked for a year” means nothing unless the tokens sit somewhere the team cannot reach. On Solana that place is a token account whose authority is a program derived address, moved only when the program signs for it, and the program signs only when its own rules say so. Everything else — the schedule, the recipient, whether it can be cancelled — is data in an account next to the vault, readable by anyone.

How a lock is built

1. The creator calls create_lock with the amount, the recipient and the schedule. The program derives a lock account and a vault from a seed and stores the parameters.
2. In the same transaction the tokens move from the creator into the vault. The vault's authority is the lock PDA, so no wallet can sign for it.
3. Time passes. The clock the program reads is the on-chain one, not the sender's.
4. Anyone calls release. The program computes what has unlocked so far, subtracts what was already released, and transfers the difference to the recipient with invoke_signed.
5. When everything is out, the lock closes and its rent goes back to the creator.

That release can be sent by anyone is the point: the recipient does not depend on the creator, and the creator cannot withhold. Solstack's Token Locker runs a crank that sends it every few minutes, so unlocks arrive without anyone clicking.

Schedules

// what has unlocked at time t, for cliff + linear
if t < cliff_ts:            unlocked = 0
elif t >= end_ts:           unlocked = total
else:                       unlocked = cliff_amount
                                     + (total − cliff_amount) × (t − cliff_ts) / (end_ts − cliff_ts)
claimable = unlocked − released_amount

The options that change what a lock means

• Cancelable: the creator can end the lock early. Unlocked tokens still go to the recipient, the rest come back. Off by default in Solstack's locker; on by default in some others. A cancelable team lock is a promise, not a lock.
• Transferable: the recipient can hand the schedule to another address. Useful for a hire who leaves; irrelevant to trust.
• Extendable: a lock's date can be pushed later, never earlier. Extending is a stronger commitment; shortening should not exist.
• Token-2022 traps: a permanent delegate on the mint can empty any vault, lock or not. The locker refuses transfer hooks and flags permanent delegates for this reason.

LP locks

The liquidity in a DEX pool belongs to whoever holds the pool's LP tokens. Burning them makes the liquidity permanent; locking them makes it permanent until a date. Both are verifiable: find the LP mint, then check where its supply is — burned, in a lock program's vault, or in the deployer's wallet. Some DEXes offer a native lock that keeps trading fees claimable while the principal stays put. LP Lock Verifier does the lookup for Raydium and Meteora pools; LP Locker creates the lock.

Verifying any lock claim

1. Find the vault. A lock page or a verifier gives the address; otherwise look at the largest holders of the mint.
2. Read its owner and authority in Account Inspector. The authority must be a PDA — off-curve, no private key — of the lock program, and the program must be the one it claims.
3. Read the lock account next to it: amount, recipient, cliff, end date, cancelable flag. Compare the amount against the supply the team says is locked.
4. Check the program itself: is it upgradeable, and by whom? A lock in an upgradeable program with a single-wallet authority is only as strong as that wallet.
5. Sum every lock for the mint. Five small locks that add up to less than the claim are the usual sleight of hand.

Token Lock Verifier runs these checks for Solstack locks and lists every active lock for a mint. For other programs the same five steps apply, and the second is the one that catches nearly every fake: a “vault” whose authority is a plain wallet is a wallet.

Escrow beyond locks

The same pattern — a PDA-controlled account released by rules — is every trustless escrow on the chain: a launchpad's sale vault that refunds if the soft cap is missed, an OTC swap that completes only when both sides deposit, a marketplace holding an NFT until payment lands. A multisig is the other tool, and it is not the same thing: a multisig releases when people agree; a lock releases when the rule is met. Use a multisig for treasuries and decisions, a lock for promises.