If you have run an EVM treasury, you know the pattern: a Safe owned by hardware wallets, with a Zodiac Roles Modifier that lets a bot or agent call specific functions with specific parameters within limits. It is the gold standard for on-chain agent permissions, and it does not exist on Solana. Coldstar is the nearest thing that does.
Safe plus Roles for the EVM side of a multichain treasury; Coldstar (with Squads for on-chain quorum) for the Solana side.
| Coldstar | Safe + Zodiac Roles | |
|---|---|---|
| Who holds the root key | You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | The Safe's owners, typically hardware wallets. No provider can sign. Role members hold whatever key they use, usually hot. |
| Where the key lives | On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | On-chain smart account (EVM). The Roles Modifier is a module attached to the Safe. |
| Policy engine | Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold. Evaluated locally, first match wins, before any signature exists. | Scoped target addresses, functions, and allowed parameter values, plus rate and threshold limits. Fully on-chain. |
| Out-of-policy transactions | ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. | Reverted; out-of-role actions need the Safe's normal owner multisig. |
| Cold / offline root | Yes — the root key never touches a networked machine. | Yes, structurally. Owners can be hardware wallets. Not a feature, an architecture. |
| Agent integration | Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. CLI signer today; MCP server in progress. | Not documented on the first-party pages we fetched; widely used for bots in practice. |
| Solana support | Solana mainnet. Core is chain-agnostic; EVM signing exists. | No. Safe's supported networks are EVM chain IDs; the Roles Modifier is deployed on 19 EVM networks. |
| Source & self-hosting | Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | safe-smart-account LGPL-3.0; zodiac-modifier-roles LGPL-3.0+. Contracts free to use. |
| Pricing | Free software plus a ~$10 drive. | Gas only for the contracts; Safe's commercial offerings not confirmed. |
| Maturity | Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; among the most battle-tested contracts on EVM. |
This is the design Coldstar admires most and cannot use: the chain enforces the rule, and the owners are cold. On Solana, Squads provides the quorum and spending limits, and Coldstar provides the cold, policy-gated keys.
Safe plus Roles puts everything on-chain: the owner set, the role scopes, the limits. A role member's key can be hot because the contract will refuse anything outside scope. Owners approve the exceptional cases with their hardware wallets. It is a complete answer for EVM.
Coldstar is an off-chain answer to the same shape of problem: a cold root that authorises a bounded session key, with the bounds enforced locally before a signature exists. Pair it with Squads for on-chain quorum and spending limits and you get most of the Safe plus Roles pattern on Solana.
Safe and Zodiac are production. Coldstar is beta, pre-audit.
No. Safe's supported networks are EVM chains. Squads is the Solana multisig standard, and Coldstar is a cold, policy-gated signer you can put in its seats.
No. Coldstar's policy works at the program, recipient, and amount level. Parameter-level scoping is a strength of on-chain modules that Solana tooling has not matched.
Because Solana teams coming from EVM search for it. The honest answer is that the pattern does not port directly, and this page says what does.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.