Security
Security & how Solstack works
Your keys stay in your wallet. This page lists what each Solstack transaction should contain, so you can check it before you sign.
Your keys stay in your wallet
Solstack never holds your wallet's private keys; they stay in your wallet, whether that is Phantom, Solflare, Backpack or another wallet. Each transaction is built in your browser from the form you filled in and handed to your wallet for you to review and approve, and Solstack cannot move anything without that approval. How signing works covers this step by step. The exceptions are Multisender and Airdrop, where your single approval funds a key created for that send and held by Solstack's server until the send finishes, and the market-making bots, which trade from their own wallet whose key the server holds. Both are described below.
What runs on Solstack's servers
Most of Solstack runs in your browser. The server handles a small set of jobs: an RPC relay that keeps the provider's API key private, price and token metadata lookups, the devnet faucet, sign-in and saved snapshots, and the Token Locker's delivery crank. Two server components hold funds: the sender behind Multisender and Airdrop, and the market-making bots. When you send with Multisender or Airdrop, your one transaction approves a key created for that send to spend exactly the total (tokens stay in your wallet until each batch moves them) and funds it with SOL for rent and fees, plus the amount itself for a SOL send. The server keeps that key encrypted, sends every batch with it and returns any SOL it does not use. It keeps the key after the send ends, so anything sent to it later can also be returned. A Grid Trading Bot or DLMM Liquidity Bot gets its own key in the same way: your one transaction moves the bot's SOL and tokens to it, the server keeps the key encrypted and signs the bot's trades with it, and stopping the bot returns everything it holds to you. The privacy policy lists what is stored.
What each approval should show
Wallet drainers typically hide a harmful instruction inside a routine-looking transaction, or request a broad, standing approval instead of a one-time transfer. The table below lists what a legitimate Solstack transaction contains for each tool. If a wallet prompt shows anything different, do not approve it.
| Multisender | One transaction, to a key made for that send, which Solstack's server holds and sends every batch with. For a token: one ApproveChecked for exactly the total you entered (never unlimited) and a SOL transfer for rent and network fees. For SOL: one transfer of the total plus those fees. Plus the fee transfer to Solstack's fee wallet and a memo naming the send. That key, not your wallet, signs the batches that follow. |
|---|---|
| Airdrop | The same as Multisender: one transaction to a key made for that airdrop, with an ApproveChecked for exactly the preview's total (never unlimited), a SOL transfer for rent and network fees, the fee transfer to Solstack's fee wallet and a memo naming the send. Solstack's server then signs the batches with that key: per recipient, an idempotent create for their token account (it does nothing if the account exists) and one TransferChecked for the exact amount shown in the preview. |
| Wallet Aggregator | From your connected wallet, at most one transaction: a single SOL transfer to a fee key made in your browser for the run. The pasted keys sign their own transfers and account closes; your wallet signs nothing that moves tokens. Untick paying fees from your wallet and it signs nothing at all. |
| SPL / Token-2022 Creator | CreateAccount, InitializeMint and metadata instructions, plus a fee transfer to Solstack's fee wallet. If you chose to revoke authorities, one SetAuthority instruction for each, setting it to None. None of them assigns an authority to another address. |
| Token Manager (revoke / burn / update metadata) | Only the action you chose: one SetAuthority instruction setting the authority to None, one Burn, or one metadata-update instruction. Nothing unrelated is bundled in. |
| Rent Reclaim | Batches of CloseAccount instructions that send each account's rent to your wallet, with a Burn before the close of each token you ticked to burn. A token you ticked to sell gets its own transaction: Jupiter's swap of its whole balance for SOL, then its close (a token still on a launchpad curve sells through Jupiter Ultra, and its account closes in a batch after). No Solstack fee transfer, and no approval or delegate is ever set. A wallet holding under 0.001 SOL gets Solstack's sponsor key as fee payer: it signs after the wallet, and the batch ends with a 0.00001 SOL transfer paying it back from the rent. |
| Wallet Cleaner | From your connected wallet, at most one transaction: a SOL transfer to a fee key made in your browser to pay the run's network fees, and what it doesn't spend comes back. The pasted keys sign their own closes, burns, sales and sweeps, and each of their close transactions ends with a transfer to Solstack's fee wallet of 2% of the rent it returns and of what a sale brought in. |
| Token Locker / LP Locker | A transfer of the exact amount you specified into a program-owned lock account, with the unlock terms you set. No blanket transfer authority is requested. |
| Add Liquidity / Remove Liquidity | The DEX's own deposit or withdraw instructions for the pool on the review card, with the most it may take (or the least it will accept) of each token set by your slippage. A new position adds its NFT mint or position account, signed in your browser. A SOL side adds a wrap and an unwrap of your own wrapped-SOL account, and a deposit adds the fee transfer. No approval or delegate is ever set. |
| Grid Trading Bot / DLMM Liquidity Bot | One transaction to the bot's own wallet, a key made for that bot which Solstack's server holds: a SOL transfer of the bot's starting SOL plus its reserve and, if it starts with tokens, an idempotent create for its token account and one TransferChecked for the exact amount on the review card. Plus the fee transfer to Solstack's fee wallet and a memo naming the bot. Pausing, resuming and stopping are a signed message, not a transaction. The bot's key, not your wallet, signs every trade after that. |
| Launch tools (pump.fun, letsbonk.fun, Meteora DBC, StonkFun) | Mint creation and the launchpad program's own pool-creation instructions, plus, only if you set a dev buy, one swap instruction for the exact SOL amount you entered. |
| Holder Snapshot | Taking a snapshot needs no wallet and no transaction. Exporting its full CSV is one transaction with two instructions: the fee transfer to Solstack's fee wallet and a memo naming the snapshot. |
| Read-only tools (Inspectors, Status) | No transaction and no wallet prompt. These tools only read public on-chain data. |
SetAuthority that gives control to a Solstack-owned address, or a blanket or unlimited token approval. If a wallet prompt shows either, or contains more instructions than the action requires, reject it and contact support@solstack.xyz.Verify it yourself
- Run the flow on devnet first by switching networks in the top bar. Devnet SOL is free from the faucet, so you can see what a tool does before using it on mainnet.
- When your wallet shows the approval, expand the instruction list (Phantom and Solflare both support this) rather than relying on the summary line, and check that it matches the table above for that tool.
- After signing, open the transaction on Solana Explorer or Solscan using the signature your wallet or Solstack shows, and confirm the instructions and balances match what you approved.