Security model
Do not trust SolKnife blindly. The toolkit is designed so the important parts can be checked before your wallet signs: what program is called, what account is touched, where funds move, and what fee is included.
Non-custodial transaction flow
State-changing tools use the same shape wherever possible:
- The server reads live Solana state and builds an unsigned transaction.
- The browser verifies the transaction against that tool's rules.
- Your wallet shows the transaction and signs only if you approve.
- The server re-verifies the signed bytes before submitting them.
Your private key never touches SolKnife's backend. The server cannot change a transaction after your wallet signs it because changing even one byte invalidates the signature.
What the verifier checks
Each signing tool has a purpose-built verifier. The exact checks vary by tool, but the common rule is simple: if the transaction does not match the operation you reviewed, it is rejected.
- ▸Program allowlists block unexpected program calls before signing.
- ▸Fee transfers are pinned to the configured fee account and amount.
- ▸Authority tools re-read the mint and confirm your wallet actually controls the authority being changed.
- ▸Change-authority refuses PDA/off-curve new authorities, so a token authority cannot be moved to an address that normal wallets cannot sign for.
- ▸If a signal, account layout, or transaction shape cannot be verified, SolKnife fails closed instead of guessing.
What the backend can and cannot do
- ▸It can read public chain state, request quotes from upstreams, build unsigned transactions, and submit signed transactions.
- ▸It cannot spend your funds without your wallet signature.
- ▸It cannot alter a transaction after signing without invalidating the signature.
- ▸It cannot recover, revoke, or change an authority after you transfer it away. Solana authority changes are on-chain actions.
Fees and fund movement
Privacy
SolKnife has no accounts and no sign-up. Wallet addresses, token mints, quotes, and signed transactions are used to answer the request you made.
Short-lived caches may hold public token or pool data briefly so repeated reads are fast. Page visits are measured in aggregate with Google Analytics when enabled. See the disclaimer and privacy notes for the full privacy stance and limits.
Limits
- ▸SolKnife is not a smart contract audit and does not guarantee a token is safe.
- ▸Wallet simulation, wallet warnings, and your own review still matter. If your wallet shows something unexpected, do not sign.
- ▸Upstream data can be unavailable, stale, or incomplete. SolKnife labels unverifiable results rather than clearing them.