@solentic/verify

Deterministic, zero-trust client-side verifier for Solentic (Blueprint) Solana stake transactions.

Solentic returns unsigned transactions that your agent signs locally. This package lets the agent prove, before signing, that a returned transaction does exactly one thing: create a native stake account funded by your wallet, set your wallet as both the stake and withdraw authority, delegate to Blueprint's vote account, and attach the Solentic memo — with no other instructions (no authority hijack, no hidden transfer, no look-alike validator).

Blueprint's vote account is compiled into this package. You trust these ~120 lines, not the server that built the transaction.

Install

npm install @solentic/verify @solana/web3.js

Usage

import { verifyStakeTransaction } from '@solentic/verify';

// `transaction` is the base64 returned by POST /api/v1/stake/transaction
const result = verifyStakeTransaction(transaction, myWalletPublicKey);

if (!result.ok) {
  throw new Error(`Refusing to sign: ${result.reason}`);
}
// safe — sign and submit

result.checks lists each assertion (fee_payer_is_wallet, wallet_is_stake_and_withdraw_authority, delegates_to_blueprint, solentic_memo_present, ...) with a pass/fail flag, so you can log exactly what was verified.

What it guarantees

| Check | Meaning | |-------|---------| | instruction_count | Exactly 4 instructions — nothing extra slipped in | | fee_payer_is_wallet | You pay the fee; no third-party payer | | creates_stake_account_from_wallet | The new stake account is funded by you and owned by the Stake program | | wallet_is_stake_and_withdraw_authority | You keep full control — both authorities are your wallet | | delegates_to_blueprint | Delegation target is Blueprint's vote account (compiled in), not a look-alike | | solentic_memo_present | The on-chain attribution memo is present and unmodified |

MIT licensed.