Fordefi is the institutional wallet for DeFi-heavy funds: two-share MPC where you run one share in a self-hosted API Signer and Fordefi runs the other in Nitro Enclaves, with ordered policies that allow, block, or require approval. It is the closest an institutional product gets to "a share the vendor can't use alone". Coldstar removes the vendor share entirely.
Fordefi for the trading vault under compliance; Coldstar for the cold reserve and for agents that don't justify a subscription.
| Coldstar | Fordefi | |
|---|---|---|
| Who holds the root key | You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Split: the customer's share lives in a mobile hardware enclave or a customer-run API Signer; Fordefi's share lives in AWS Nitro Enclaves. Fordefi cannot sign alone. Self-custody. |
| Where the key lives | On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Customer share on device or in your API Signer container; Fordefi share in Nitro Enclaves. |
| Policy engine | Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Ordered rules on amount, initiator, vault, destination and address book, asset, and dApp; actions Allow, Block, or Require Approval with quorum or approver-group combinations; AML-alert policies. |
| Out-of-policy transactions | ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Held for approval by the configured quorum or approver groups, or blocked. |
| Cold / offline root | Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No air-gapped root. |
| Agent integration | Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | REST API plus self-hosted API Signer for unattended signing; MPC SDK for wallet-as-a-service. No AI-agent product on the docs we fetched. |
| Solana support | Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: Solana mainnet, Eclipse, Fogo; SOL and SPL; Wallet Standard. |
| Source & self-hosting | Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | Closed source. SOC 2 Type II (EY); pentests by NCC Group and Skylight Cyber. Hosted co-signer with a self-hosted signer component. |
| Pricing | Free software plus a ~$10 drive. | Not public; sales contact. |
| Maturity | Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; institutional client base. |
Fordefi's two-share model with a customer-run signer is genuinely better than a fully hosted key, and it is the right shape for a fund. Coldstar's point is that for an agent or a DAO, the second share is still a vendor dependency you may not need.
Fordefi splits the key so that its Nitro co-signer and your API Signer must cooperate. A compromise of Fordefi alone cannot move funds; a compromise of your signer alone cannot either. You still depend on Fordefi's availability and policy layer for every transaction, and the arrangement is a subscription.
Coldstar has no co-signer. The root is one encrypted file on your drive, used offline to sign a policy envelope; the session key that acts inside it is disposable and bounded by a local rule list. Availability depends on nothing but your own machines.
Fordefi is production infrastructure with independent assurance. Coldstar is beta, pre-audit.
You self-host one MPC share in Fordefi's container; the other share and the policy layer run on Fordefi's infrastructure. Coldstar is self-hosted end to end.
Not on the docs we fetched at review time. Its API Signer supports unattended, policy-gated signing, which an agent could use.
No; both shares must be reachable to sign. Coldstar's root signs a policy envelope offline and is not needed for routine transactions.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.