# Coldstar — comparisons (full text) Source: https://coldstar.dev/compare · Reviewed 2026-09-04 · Coldstar is beta software; an independent audit is planned before the production release. Every third-party fact below is backed by a first-party URL listed under Sources on the page it appears on. ## Ledger alternatives for Solana: eight options, honestly compared URL: https://coldstar.dev/compare/ledger-alternatives-solana Ledger is the default, and it is a fine device. People look for alternatives for three reasons: they want firmware they can read, a real air gap instead of a USB cable, or they do not want to buy a device at all. Here is every serious option for Solana, with the reason you would pick each. ### At a glance - Coldstar: Price: ~$10 drive; software free; Key at rest: AES-256-GCM file; RAM-only while signing; Transaction path: QR; fully air-gapped; Source: MIT - Trezor: Price: $59 (Safe 3), $129 (Safe 5); Key at rest: EAL6+ secure element; Transaction path: USB-C; not air-gapped; Source: Firmware GPL-3.0 - Keystone 3 Pro: Price: $149; Key at rest: Three secure elements; Transaction path: QR + microSD; air-gapped; Source: Published; one pre-compiled MCU library - OneKey: Price: $99 (Classic 1S), $278 (Pro); Key at rest: One to four EAL6+ secure elements; Transaction path: USB/Bluetooth; Pro adds QR air gap; Source: Open, reproducible firmware - SafePal S1: Price: $49.99 (S1), $89.99 (S1 Pro); Key at rest: EAL6+ secure element; Transaction path: QR only; air-gapped; Source: Partially open - Tangem: Price: $59.90 for two cards; Key at rest: EAL6+ card, non-updatable firmware; Transaction path: NFC tap via the online phone; Source: App open; card firmware closed - ELLIPAL Titan 2.0: Price: $149; Key at rest: EAL5+ secure chip; Transaction path: QR only; air-gapped; Source: Closed - Cypherock X1: Price: Not listed on the store page; Key at rest: 5-way Shamir split across EAL6+ cards; Transaction path: USB-C; not air-gapped; Source: MIT + Commons Clause - GridPlus Lattice1: Price: $397; Key at rest: PUF secure enclave; Transaction path: Wi-Fi / Ethernet; always online; Source: SDK open; firmware as signed binaries ### The options - Coldstar: Open-source software that makes any USB drive an air-gapped signer. The cheapest and most scriptable option, and the only one here that is beta and pre-audit. - Trezor: The closest thing to an open-source Ledger: GPL-3.0 firmware plus an EAL6+ chip from $59. Still signs over USB-C. - Keystone 3 Pro: Air-gapped by QR with three secure elements and a Solflare integration. The device to buy if you want the air gap in a box. - OneKey: Open, reproducible firmware with certified chips. The Pro adds a QR camera for air-gapped signing alongside Bluetooth and NFC. - SafePal S1: The lowest-priced air-gapped QR device with a secure element. Firmware only partially open. - Tangem: Seedless NFC cards with an EAL6+ chip, built for phone-first simplicity. No trusted screen; the phone displays the transaction. - ELLIPAL Titan 2.0: Big-screen QR-only device with tamper wipe. Closed firmware. - Cypherock X1: Splits the key across a vault and four cards so there is no seed phrase to protect. Signs over USB-C. - GridPlus Lattice1: Always-online device with a large screen that decodes Solana instructions. The opposite of an air gap, by design. ### How to choose - Want open firmware in a device? Trezor Safe 3 or OneKey. Both publish firmware; OneKey's builds are reproducible. - Want a real air gap in a device? Keystone 3 Pro, SafePal S1, OneKey Pro, or ELLIPAL Titan all sign over QR codes. - Want no device at all? Coldstar. Free, MIT-licensed, air-gapped by QR, and scriptable for treasuries and agents. Beta, so start small. - Want the simplest thing for a non-technical holder? Tangem. - Staying with Ledger? Reasonable. Read where it still wins. ### FAQ Q: Is there an open-source alternative to Ledger for Solana? A: Yes. Trezor publishes its firmware under GPL-3.0, OneKey publishes reproducible firmware, Keystone publishes most of its firmware, and Coldstar is MIT-licensed software. Ledger's device apps are open but its operating system is not. Q: Which Ledger alternatives are air-gapped? A: Keystone 3 Pro, SafePal S1, OneKey Pro, and ELLIPAL Titan sign over QR codes with no data connection. Coldstar does the same in software on an offline computer. Trezor, Cypherock, and Ledger itself sign over USB. Q: What is the cheapest Ledger alternative for Solana? A: Coldstar is free software plus any USB drive. Among devices, SafePal S1 at $49.99 and Trezor Safe 3 at $59 are the lowest-priced options with a secure element. Q: Can any of these sign for a bot or AI agent? A: Only Coldstar is designed for unattended, policy-gated signing. Every hardware wallet here requires a physical confirmation per transaction. ## Every way to keep Solana keys cold, compared URL: https://coldstar.dev/compare/solana-cold-storage-options "Cold storage" covers very different designs: a key sealed in a chip, a key on paper, a key that only exists in RAM for a hundred microseconds. This page lays out every approach people actually use on Solana and what each one asks you to trust. ### At a glance - Coldstar: Price: ~$10 drive; software free; Key at rest: AES-256-GCM file; RAM-only while signing; Transaction path: QR; fully air-gapped; Source: MIT - Ledger: Price: Varies by model; Key at rest: Secure element, EAL5+/EAL6+; Transaction path: USB, Bluetooth, NFC; not air-gapped; Source: Apps open, OS not published - Trezor: Price: $59 (Safe 3), $129 (Safe 5); Key at rest: EAL6+ secure element; Transaction path: USB-C; not air-gapped; Source: Firmware GPL-3.0 - Keystone 3 Pro: Price: $149; Key at rest: Three secure elements; Transaction path: QR + microSD; air-gapped; Source: Published; one pre-compiled MCU library - OneKey: Price: $99 (Classic 1S), $278 (Pro); Key at rest: One to four EAL6+ secure elements; Transaction path: USB/Bluetooth; Pro adds QR air gap; Source: Open, reproducible firmware - SafePal S1: Price: $49.99 (S1), $89.99 (S1 Pro); Key at rest: EAL6+ secure element; Transaction path: QR only; air-gapped; Source: Partially open - Tangem: Price: $59.90 for two cards; Key at rest: EAL6+ card, non-updatable firmware; Transaction path: NFC tap via the online phone; Source: App open; card firmware closed - Squads: Price: Free + 0.1 SOL; Pro $49/mo; Key at rest: On-chain M-of-N; members' own wallets; Transaction path: Members sign from their wallets; Source: Program AGPL-3.0 - a Solana keypair file: Price: Free; Key at rest: Unencrypted JSON on disk; Transaction path: Any process on the host can sign; Source: Apache-2.0 - Phantom: Price: Free; Key at rest: Encrypted in the extension/app, online; Transaction path: On-device; no air gap; Source: App closed; SDKs open ### The options - Coldstar: Encrypted keyfile on any USB drive, decrypted only in RAM on an offline machine, transactions by QR. Free, MIT, scriptable. Beta. - Ledger: Certified secure element with the broadest wallet support. Signs while connected over USB or Bluetooth. - Trezor: Open-firmware device with an EAL6+ chip from $59. USB-C only. - Keystone 3 Pro: QR air-gapped device with three secure elements and Solflare support. - OneKey: Open, reproducible firmware; the Pro model signs over QR as well as Bluetooth and NFC. - SafePal S1: Lowest-priced QR air-gapped device with a secure element. - Tangem: Seedless NFC cards for phone-first users. - Squads: Not storage but the on-chain quorum layer: M-of-N approval, roles, spending limits, time locks. Each member still needs a cold key. - a Solana keypair file: The developer default. Unencrypted, and Solana's own docs call it the least secure option. Fine for devnet only. - Phantom: A hot wallet, included because it is where most Solana sits. Right for spending, wrong for savings. ### How to choose - The key should never touch a network. That rules out hot wallets and keypair files for real funds, and it means USB-connected devices rely on the chip rather than isolation. - Air gap by QR is the strongest common pattern: Keystone, SafePal, OneKey Pro, ELLIPAL, or Coldstar. - Multisig is a layer, not a substitute. Squads decides who must approve; each approver still needs their own cold key. - Automation changes the answer. If a treasury or agent must sign without a human present, only Coldstar's policy-gated model fits; every device requires a press. ### FAQ Q: Is a hardware wallet the same as cold storage? A: Not exactly. A hardware wallet keeps the key in a chip but signs while connected to an online computer. Cold storage in the strict sense means the key never has a network path, which is what air-gapped QR devices and Coldstar's offline signing provide. Q: Is a paper wallet safe for Solana? A: For receiving and holding, yes. To spend, you must import the key into an online wallet, which exposes it completely. Coldstar keeps the key offline through the signing step instead. Q: Do I need multisig? A: For a team or DAO treasury, yes: Squads is the Solana standard. For an individual, a single cold key with a good backup is usually enough. ## Turnkey alternatives for AI-agent signing on Solana URL: https://coldstar.dev/compare/turnkey-alternatives-agent-signing Turnkey has the richest Solana policy language of the hosted signers. People look elsewhere when they want daily spending caps, a human approval step, a cheaper metered price, or a root key that is not in any vendor's enclave. Here is every credible option. ### At a glance - Coldstar: Who holds the root key: You; encrypted on your own drive; Policy: Limits, allowlists, daily cap, escalate to human; Cold root: Yes; Pricing: Free - Privy: Who holds the root key: Privy TEE, Shamir shares; Policy: Solana rules; some enforced at API layer; Cold root: No; Pricing: Free to 50,000 signatures/mo - Crossmint: Who holds the root key: Owner: you. Agent key: Crossmint TEE; Policy: On-chain limits and rolling caps; Cold root: Owner key could be; Pricing: Free to 1,000 active wallets - Coinbase CDP Wallets: Who holds the root key: Coinbase Nitro enclaves; Policy: Per-transaction Solana rules; Cold root: No; Pricing: $0.005 per op; 5,000 free/mo - Openfort: Who holds the root key: Openfort TEE on Google Cloud; Policy: Solana rules incl. Anchor IDL checks; Cold root: No; Pricing: 2,000 ops free, then $0.01 - Para: Who holds the root key: 2-of-2 MPC: device + Para HSM; Policy: Scopes, default deny; API layer; Cold root: No; Pricing: Free to 1,200 MAU - Dfns: Who holds the root key: Dfns MPC nodes; threshold undisclosed; Policy: Velocity limits, quorum approvals, KYT; Cold root: No; Pricing: From $800/year - Cubist CubeSigner: Who holds the root key: Cubist enclave + HSM; Policy: Custom Rust/Wasm policies in TEE; MFA quorum; Cold root: No; Pricing: Sales - Lit Protocol: Who holds the root key: Lit TEE network; authority on Base; Policy: JavaScript Lit Actions; Cold root: No; Pricing: About $0.01 per signature - Fireblocks: Who holds the root key: Fireblocks MPC across SGX enclaves; Policy: Caps, velocity, designated approvers; Cold root: No; Pricing: From $999/month ### The options - Coldstar: Self-hosted, open-source policy signer with an air-gapped root. Daily caps, allowlists, and escalation to a human over QR. Beta. - Privy: Shamir-split TEE wallets with a policy engine and a 50,000-signature free tier. Now part of Stripe. - Crossmint: Two-signer smart wallets: you hold the owner key, Crossmint's TEE holds a scoped agent key, and limits live on-chain. - Coinbase CDP Wallets: Nitro-enclave server wallets with per-transaction Solana rules and the open AgentKit framework. Half a cent per operation. - Openfort: TEE-held backend wallets with Solana rules including Anchor IDL instruction validation. Published pricing and a self-hostable signer component. - Para: 2-of-2 MPC built around a user's device share, with scoped permissions. Better for consumer wallets than headless agents. - Dfns: Institutional: velocity limits, KYT screening, and multi-group quorum approvals. From $800 a year. - Cubist CubeSigner: HSM-sealed keys with custom Rust/Wasm policies executed inside the enclave. Built for validators and bridges. - Lit Protocol: Decentralised TEE network with JavaScript conditions and on-chain authority; Solana via wrapped Ed25519 keys. - Fireblocks: The institutional incumbent, with an agentic payments suite. From $999 a month. ### How to choose - Need daily or rolling caps? Dfns and Fireblocks have velocity limits; Crossmint enforces rolling caps on-chain; Coldstar has a daily cap locally. Turnkey, Privy, and CDP document per-transaction rules only. - Need a human approval step? Dfns has multi-group quorums; Turnkey can require a human co-approver in a consensus rule; Coldstar escalates over air-gapped QR. - Want the root off every vendor's infrastructure? Only Coldstar. Crossmint gets halfway with a customer-held owner key. - Want the cheapest hosted path? Coinbase CDP at $0.005 per operation, or Privy's free tier. ### FAQ Q: Does Turnkey support daily spending limits? A: Not in its policy language at review time. It supports per-transaction conditions and time windows. Dfns, Fireblocks, Crossmint, and Coldstar all express some form of cumulative cap. Q: Which agent signers are open source? A: Coldstar is fully open (MIT). Turnkey publishes its enclave OS, Coinbase publishes AgentKit and its SDK, Openfort publishes its OpenSigner component, and most vendors publish SDKs. The hosted policy engines themselves are closed everywhere except Coldstar. Q: Which of these lets the agent run without any vendor account? A: Coldstar, which is self-hosted software. Every other option is a hosted service you authenticate to. Q: Can I keep Solana Agent Kit and switch signers? A: Yes. Solana Agent Kit's wallet interface is pluggable and ships examples for Turnkey, Privy, Crossmint, and Para. A Coldstar-backed wallet implements the same interface. ## Privy alternatives for agent wallets on Solana URL: https://coldstar.dev/compare/privy-alternatives-agent-wallets Privy is a strong default for consumer embedded wallets and now for agent wallets too. People look for alternatives when they need every policy enforced inside the trusted boundary, a human escalation path, a root they hold themselves, or simply a vendor that is not Stripe. Here are the options. ### At a glance - Coldstar: Who holds the root key: You; encrypted on your own drive; Policy: Limits, allowlists, daily cap, escalate to human; Cold root: Yes; Pricing: Free - Turnkey: Who holds the root key: Turnkey-operated enclaves; Policy: Rich Solana instruction rules; no daily caps; Cold root: No; Pricing: 25 free signatures/mo, then $0.10 - Crossmint: Who holds the root key: Owner: you. Agent key: Crossmint TEE; Policy: On-chain limits and rolling caps; Cold root: Owner key could be; Pricing: Free to 1,000 active wallets - Coinbase CDP Wallets: Who holds the root key: Coinbase Nitro enclaves; Policy: Per-transaction Solana rules; Cold root: No; Pricing: $0.005 per op; 5,000 free/mo - Openfort: Who holds the root key: Openfort TEE on Google Cloud; Policy: Solana rules incl. Anchor IDL checks; Cold root: No; Pricing: 2,000 ops free, then $0.01 - Para: Who holds the root key: 2-of-2 MPC: device + Para HSM; Policy: Scopes, default deny; API layer; Cold root: No; Pricing: Free to 1,200 MAU - Magic: Who holds the root key: Magic Nitro enclaves; Policy: None documented; Cold root: No; Pricing: Free to 1,000 active wallets - Web3Auth: Who holds the root key: Reconstructed on the client at login; Policy: None documented; Cold root: No; Pricing: Free to 1,000 active wallets ### The options - Coldstar: Self-hosted policy signer with an offline root; every rule evaluated on the signing machine. Beta. - Turnkey: Enclave signer with the most expressive Solana policy grammar, evaluated in the enclave. Per-signature pricing. - Crossmint: Smart wallets with a customer-held owner key and on-chain limits; agent key in Crossmint's TEE. - Coinbase CDP Wallets: Nitro-enclave wallets, per-transaction Solana rules, open AgentKit framework, metered pricing. - Openfort: TEE wallets with Solana rules including instruction validation; self-hostable signer component. - Para: 2-of-2 MPC with a user device share and scoped permissions, aimed at consumer apps. - Magic: Mature embedded wallets in Nitro enclaves with JWT-bound signing. No policy engine. - Web3Auth: Social-login MPC wallets that reconstruct the key on the client. No policy engine. ### How to choose - Consumer app, humans holding wallets? Privy, Para, Magic, or Web3Auth are all built for that; Privy and Para have policies, Magic and Web3Auth do not. - Headless agents spending your money? Turnkey, Coinbase CDP, Openfort, or Crossmint if you want a hosted policy; Coldstar if you want the root offline and the policy local. - Policy must be enforced inside the trusted boundary? Turnkey and Cubist claim in-enclave evaluation; Privy says some rules run at its API layer; Coldstar evaluates on the signing machine. ### FAQ Q: Is Privy custodial? A: Privy describes itself as non-custodial: the key is split with Shamir's Secret Sharing and only recombined inside its TEE, and it says it cannot sign alone. The key material lives on Privy-operated infrastructure. Q: Which Privy alternatives have a policy engine for Solana? A: Turnkey, Coinbase CDP, Openfort, Crossmint, Para, and Coldstar. Magic and Web3Auth do not document transaction policies. Q: Which alternative keeps the root key out of the cloud entirely? A: Coldstar. The root is an encrypted file on a drive you hold, used offline. ## Solana agent wallets compared: hosted signers, frameworks, and the raw-key default URL: https://coldstar.dev/compare/solana-agent-wallets-compared Most agents on Solana still run with a base58 secret in an environment variable. The alternatives fall into three shapes: a hosted signer with a policy engine, an on-chain smart wallet with rules in the contract, or a self-hosted signer with an offline root. This is the whole field in one table. ### At a glance - a private key in .env: Who holds the root key: The agent process; Policy: None; Cold root: No; Pricing: Free - Coldstar: Who holds the root key: You; encrypted on your own drive; Policy: Limits, allowlists, daily cap, escalate to human; Cold root: Yes; Pricing: Free - Turnkey: Who holds the root key: Turnkey-operated enclaves; Policy: Rich Solana instruction rules; no daily caps; Cold root: No; Pricing: 25 free signatures/mo, then $0.10 - Privy: Who holds the root key: Privy TEE, Shamir shares; Policy: Solana rules; some enforced at API layer; Cold root: No; Pricing: Free to 50,000 signatures/mo - Crossmint: Who holds the root key: Owner: you. Agent key: Crossmint TEE; Policy: On-chain limits and rolling caps; Cold root: Owner key could be; Pricing: Free to 1,000 active wallets - Coinbase CDP Wallets: Who holds the root key: Coinbase Nitro enclaves; Policy: Per-transaction Solana rules; Cold root: No; Pricing: $0.005 per op; 5,000 free/mo - Openfort: Who holds the root key: Openfort TEE on Google Cloud; Policy: Solana rules incl. Anchor IDL checks; Cold root: No; Pricing: 2,000 ops free, then $0.01 - Para: Who holds the root key: 2-of-2 MPC: device + Para HSM; Policy: Scopes, default deny; API layer; Cold root: No; Pricing: Free to 1,200 MAU - Dfns: Who holds the root key: Dfns MPC nodes; threshold undisclosed; Policy: Velocity limits, quorum approvals, KYT; Cold root: No; Pricing: From $800/year - Cubist CubeSigner: Who holds the root key: Cubist enclave + HSM; Policy: Custom Rust/Wasm policies in TEE; MFA quorum; Cold root: No; Pricing: Sales - Fireblocks: Who holds the root key: Fireblocks MPC across SGX enclaves; Policy: Caps, velocity, designated approvers; Cold root: No; Pricing: From $999/month - Fordefi: Who holds the root key: 2-share MPC; you run one share; Policy: Allow / Block / Require approval; Cold root: No; Pricing: Sales - Lit Protocol: Who holds the root key: Lit TEE network; authority on Base; Policy: JavaScript Lit Actions; Cold root: No; Pricing: About $0.01 per signature - Magic: Who holds the root key: Magic Nitro enclaves; Policy: None documented; Cold root: No; Pricing: Free to 1,000 active wallets - Web3Auth: Who holds the root key: Reconstructed on the client at login; Policy: None documented; Cold root: No; Pricing: Free to 1,000 active wallets - Solana Agent Kit: Who holds the root key: The agent process (KeypairWallet); Policy: None; signer is pluggable; Cold root: No; Pricing: Free - Alchemy Smart Wallets: Who holds the root key: BYO or hosted owner; EVM smart account; Policy: Session keys, EVM only; Cold root: No; Pricing: Compute units - Safe + Zodiac Roles: Who holds the root key: Safe owners, EVM only; Policy: On-chain roles, EVM only; Cold root: Yes, hardware owners; Pricing: Gas only ### The options - a private key in .env: The default in Solana Agent Kit, ElizaOS, and GOAT. Zero setup, zero policy, total loss on one prompt injection. - Coldstar: Self-hosted, open-source policy signer with an air-gapped root and a disposable session key. Beta. - Turnkey: Hosted enclave signer with the richest Solana policy grammar. - Privy: Hosted TEE wallets with policies and a large free tier; a Stripe company. - Crossmint: Smart wallets with on-chain limits; owner key yours, agent key in Crossmint's TEE. - Coinbase CDP Wallets: Nitro-enclave wallets with per-transaction rules and the open AgentKit framework. - Openfort: Hosted TEE wallets with Solana rules including Anchor IDL validation. - Para: 2-of-2 MPC with scoped permissions, built around a user's device. - Dfns: Institutional MPC with velocity limits, KYT, and quorum approvals. - Cubist CubeSigner: HSM-sealed keys with custom policy code in the enclave; infrastructure grade. - Fireblocks: Institutional custody with a policy engine and an agentic payments suite. - Fordefi: Institutional 2-share MPC where you run one share in your own container. - Lit Protocol: Decentralised TEE network with JavaScript conditions; Solana via wrapped keys. - Magic: Hosted enclave wallets, JWT-bound signing, no policy engine. - Web3Auth: Social-login MPC that reconstructs the key on the client; no policy engine. - Solana Agent Kit: Not a signer: the agent toolkit whose pluggable wallet interface most of the above plug into. - Alchemy Smart Wallets: On-chain session keys with limits and expiry. EVM only; Solana gets gas sponsorship. - Safe + Zodiac Roles: The EVM gold standard for on-chain agent permissions. Not deployed on Solana. ### How to choose - Step one is leaving the .env key. Every option here is safer than a raw key in the agent's process, because every one of them puts something between the agent and the signature. - Hosted policy signers (Turnkey, Privy, CDP, Openfort) are fastest to adopt; you trust the vendor's enclave and pay per use. - On-chain rules (Crossmint on Solana; Safe and Alchemy on EVM) are verifiable by anyone and survive off-chain compromise. - Self-hosted with an offline root (Coldstar) removes the vendor entirely at the cost of running it yourself, and it is beta. - Institutions with compliance needs should look at Dfns, Fireblocks, or Fordefi first. ### FAQ Q: What is the safest wallet for an AI agent on Solana? A: The one where the agent cannot sign outside a policy and does not hold the root key. Hosted signers with policy engines, on-chain smart wallets with limits, and Coldstar's self-hosted policy signer all satisfy that; a raw key in .env satisfies neither. Q: Does Solana Agent Kit come with a secure wallet? A: Its default KeypairWallet holds a raw keypair in memory. Its BaseWallet interface is pluggable, with examples for Turnkey, Privy, Crossmint, and Para, and Coldstar implements the same interface. Q: Which agent wallets have daily spending caps? A: Dfns and Fireblocks (velocity limits), Crossmint (rolling caps on-chain), and Coldstar (daily cap). Turnkey, Privy, Coinbase CDP, and Openfort document per-transaction rules only at review time. Q: Can I use Safe or Alchemy session keys on Solana? A: No. Both are EVM-only. On Solana, Squads provides on-chain quorum and spending limits, and Coldstar provides a cold, policy-gated signer. ## Coldstar vs Ledger: Ledger alternative for Solana cold storage URL: https://coldstar.dev/compare/coldstar-vs-ledger Category: Cold storage & custody · Hardware wallet Ledger is the default answer to "how do I keep my Solana safe" and has the widest wallet support of any device. Coldstar replaces the device with open-source software and a USB drive you already own. Here is where each one is actually the better call. ### Pick Ledger if - You want a certified secure element and a vendor to call when something breaks. - You use Phantom or Solflare daily and want on-device confirmation for every click. - You want Bluetooth or NFC signing from a phone, or optional paid seed recovery (Ledger Recover). ### Pick Coldstar if - You want to read every line of code that touches your key. Ledger's apps are open; its OS is not. - You want a true air gap — Ledger signs over USB or Bluetooth, Coldstar signs on a machine with no network path. - You need headless, scriptable, policy-gated signing for bots or AI agents. Ledger requires a button press per transaction. ### Use both when Keep long-term holdings on a Ledger you already trust and use Coldstar as the scriptable cold root for treasuries, agents, and anything that has to sign without a human at the device. ### Side by side (Coldstar | Ledger) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | Four current models from Nano S Plus to Stax; list prices vary by model and region (shop.ledger.com). - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | Inside a certified secure element: CC EAL6+ on Nano S Plus, Flex, Stax; EAL5+ on Nano X. Never leaves the chip. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | USB-C on all models; Bluetooth on Nano X, Flex, Stax; NFC on Flex and Stax. Not air-gapped — the device is connected while signing. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | Device apps are open (e.g. app-solana, Apache-2.0). The operating system is not published. - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | Ledger's silicon, firmware, supply chain, and companion software. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | 24-word BIP39 seed. Optional paid Ledger Recover splits the seed to three custodians and requires government ID. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | None. Every signature needs a physical press; no spending limits or allowlists. - Solana wallets: Coldstar CLI and Seeker app; builds transactions itself, incl. Jupiter swaps and multisig. | Ledger Wallet (staking), Phantom, Solflare, and most Solana dApps — the broadest support of any device. - Maturity: Beta — independent audit planned before the production release. | Longest production track record of any hardware wallet; millions of devices shipped. ### Where Ledger wins - Track record. Years of production use, certified secure elements, a bug bounty, and public incident reports. - Ecosystem. Nearly every Solana wallet and dApp has a Ledger button; Coldstar builds transactions itself. - Convenience. Bluetooth and NFC signing from a phone, plus optional seed recovery for people who fear losing a paper backup. ### Where Coldstar wins - Auditability. Everything that touches the key is MIT-licensed and readable. There is no closed OS to take on faith. - A real air gap. The signing machine has no network path; the transaction crosses by QR. Ledger signs while plugged in. - Automation. CLI-first and headless, so the same cold root can sign for a DAO treasury or an AI agent under policy. ### What you are trusting A Ledger asks you to trust a chip. The secure element is designed so the key cannot be read out even with physical access, and that design has held up well. What you cannot do is read the operating system that drives it, and you are trusting Ledger's release pipeline every time you update. Two documented incidents illustrate the shape of that trust: a 2020 e-commerce database breach exposed customer names and addresses (no keys), and in December 2023 a phished former employee's npm account shipped a malicious Ledger Connect Kit that drained EVM dApp users for a few hours. Coldstar asks you to trust code you can read and a machine you keep offline. The key is stored only as an AES-256-GCM ciphertext; it is decrypted into memory-locked RAM for about a hundred microseconds while signing and then wiped. The attack surface is your offline machine and the passphrase, not a vendor's firmware, servers, or supply chain. The honest trade is maturity. Ledger has shipped for a decade; Coldstar is beta software with an independent audit planned before the production release. Start small, verify addresses on the offline machine, and treat it accordingly. ### Using Ledger and Coldstar together Coldstar does not compete with the Ledger in your drawer. Many teams keep personal holdings on a hardware wallet and use Coldstar where a device can't go: a headless treasury signer, a policy-gated agent, or a $10 cold wallet for each of twenty contributors. ### FAQ Q: Is a USB drive really as safe as a Ledger? A: Different threat model, not the same one. A Ledger protects the key inside a chip while connected to a possibly compromised computer. Coldstar never connects the key to a networked computer at all — the encrypted file only ever opens on an offline machine. The USB drive stores ciphertext; it does not sign anything. Q: Does Coldstar work with Phantom or Solflare like a Ledger does? A: No. Coldstar builds and signs transactions itself through its CLI and Seeker app, including Jupiter swaps and multisig. If your workflow is clicking through dApps in a browser extension, a Ledger fits that better today. Q: Can I use Coldstar with a Ledger? A: They solve different jobs, so most people use both: the Ledger for interactive holdings, Coldstar for scriptable or policy-gated signing. Coldstar does not drive a Ledger device. Q: What about Ledger Recover? A: It is optional and paid, and it requires identity verification with three custodians. Coldstar has no recovery service by design: your passphrase and encrypted keyfile are the whole system, and the drive is disposable. ### Sources - Ledger hardware wallet comparison (secure element ratings, connectivity): https://shop.ledger.com/pages/hardware-wallets-comparison - Ledger app-solana source (Apache-2.0): https://github.com/LedgerHQ/app-solana - Ledger Recover: https://shop.ledger.com/pages/ledger-recover - Ledger: 2020 data leak statement: https://www.ledger.com/message-ledgers-ceo-data-leak - Ledger: Connect Kit security incident report, Dec 2023: https://www.ledger.com/blog/security-incident-report - Ledger support: Solana on Phantom: https://support.ledger.com/article/4408131265169-zd ## Coldstar vs Trezor: Trezor alternative for Solana cold storage URL: https://coldstar.dev/compare/coldstar-vs-trezor Category: Cold storage & custody · Hardware wallet Trezor is the hardware wallet closest to Coldstar in spirit: GPL-licensed firmware you can read, from a vendor that publishes its vulnerability reports. The differences are the air gap, the price of entry, and what happens when nobody is around to press a button. ### Pick Trezor if - You want open firmware and a certified secure element in one consumer device, from $59. - You want Shamir multi-share backups and a polished desktop app (Trezor Suite) that speaks Solana natively. - You want a vendor with a decade of published security disclosures. ### Pick Coldstar if - You want an actual air gap. Every current Trezor signs over USB-C. - You need scriptable, unattended, policy-gated signing. Trezor confirms every transaction on-device. - You already have USB drives and want zero hardware spend per wallet. ### Use both when A Trezor for the seed you never want to touch; Coldstar for the operational keys that have to sign on a schedule or under an agent's policy. ### Side by side (Coldstar | Trezor) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | Safe 3 $59; Safe 5 $129. Model T is discontinued (updates promised through at least 2031). - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | EAL6+ secure element on Safe 3 and Safe 5 (Safe 5 uses an NDA-free chip). Model T had no secure element. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | USB-C only. microSD on Safe 5 is for PIN protection, not transaction transfer. Not air-gapped. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | Firmware open source, GPL-3.0, covering every current model. Trezor Suite is open. The secure element's own firmware is vendor code. - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | Open firmware you (or auditors) can read, plus SatoshiLabs' build pipeline and the SE vendor. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | 12/20/24-word backup, Shamir (SLIP39) multi-share, on-device PIN and passphrase. No cloud recovery. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | None. On-device confirmation for every transaction. - Solana wallets: Coldstar CLI and Seeker app. | Trezor Suite (SOL and SPL, incl. Token-2022). Staking not in Suite yet. Phantom does not support Trezor; Backpack does. - Maturity: Beta — independent audit planned before the production release. | First hardware wallet on the market (2014). Public vulnerability disclosures and third-party evaluations. ### Where Trezor wins - Open firmware in a finished device. GPL-3.0 firmware plus an EAL6+ chip, for $59. - Disclosure culture. Trezor publishes evaluations such as the 2024 Donjon voltage-glitch finding on Safe 3 (no key extraction) and its 2020 response to physical extraction research on Model One/T. - Backups people can survive. Shamir multi-share backup is built into the onboarding. ### Where Coldstar wins - Air gap. Coldstar's signing machine never has a network path. A Trezor is plugged into a live computer while it signs. - Headless and policy-gated. The same cold root can sign for a treasury or an agent under enforced limits. - No per-wallet hardware. Twenty contributors get twenty cold wallets for the price of twenty USB drives. ### What you are trusting Trezor's model is transparency plus a chip. You can compile the firmware yourself and compare the hash; the secure element then protects the seed against physical extraction. The residual trust is in the SE vendor's closed firmware and in SatoshiLabs' signing keys for updates. Coldstar's model is transparency plus isolation. There is no chip to trust because the plaintext key only exists in the RAM of a machine that is not on any network, for the microseconds it takes to sign. Physical extraction of a key that is never at rest in plaintext is a different problem from extracting a seed from a chip. Trezor is production software from a company with a decade of disclosures behind it. Coldstar is beta, pre-audit. If that matters more to you than the air gap, buy the Safe 3. ### FAQ Q: Isn't Trezor already open source? Why would I need Coldstar? A: Trezor's firmware is open, which is exactly why we like it. Coldstar adds two things a Trezor cannot do: sign on a machine with no network connection at all, and sign without a human at the device — under a policy — for treasuries and agents. Q: Does Trezor work with Phantom? A: Not at the time of review; Trezor documents that Phantom does not support its devices, while Backpack and Trezor Suite do. Coldstar does not depend on a browser wallet either way. Q: Which is cheaper? A: A Trezor Safe 3 is $59 once. Coldstar is free software plus any USB drive, roughly $10. Per wallet, Coldstar is cheaper; for a single personal wallet the difference is small. ### Sources - Trezor: Solana on Safe 5, Safe 3, Model T: https://trezor.io/learn/a/solana-sol-on-trezor-safe-5-trezor-safe-3-and-trezor-model-t - Trezor Safe 3 product page ($59): https://trezor.io/trezor-safe-3 - Trezor Safe 5 product page ($129): https://trezor.io/trezor-safe-5 - Trezor firmware source (GPL-3.0): https://github.com/trezor/trezor-firmware - Trezor: Donjon Safe 3 evaluation disclosure: https://trezor.io/vulnerability/donjon-s-trezor-safe-3-evaluation - Trezor: response to read-protection downgrade attack (2020): https://blog.trezor.io/our-response-to-the-read-protection-downgrade-attack-28d23f8949c6 ## Coldstar vs Keystone 3 Pro: Keystone 3 Pro alternative for Solana cold storage URL: https://coldstar.dev/compare/coldstar-vs-keystone Category: Cold storage & custody · Air-gapped hardware wallet Keystone is the closest hardware analogue to Coldstar: transactions cross by QR code, the device never touches USB data or Bluetooth, and the firmware is published. The question is whether you want that model in a $149 appliance or in software you run yourself. ### Pick Keystone 3 Pro if - You want QR air-gap signing in a finished device with a 4-inch screen, fingerprint unlock, and vendor support. - You use Solflare and want a maintained hardware integration. - You value three secure elements protecting the seed at rest. ### Pick Coldstar if - You want the same air-gap flow without buying a device, or need many cold wallets cheaply. - You need the signer to be scriptable and policy-gated, not a screen someone taps. - You want to build and inspect the entire signing stack, not just most of it. ### Use both when Keystone for the human-operated vault; Coldstar for the automated or delegated signing that a device with a fingerprint reader can't do. ### Side by side (Coldstar | Keystone 3 Pro) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | $149 (bundle $254.80). - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | Three secure elements (Microchip ATECC608B, Maxim DS28S60, Maxim MAX32520). Certification level not stated on Keystone's pages. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | QR camera and microSD. No USB data, Bluetooth, Wi-Fi, or NFC. Fully air-gapped. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | Firmware published (Rust/C) and marketed as 100% open. Caveat from the repo: the MH1903 MCU library ships as a pre-compiled binary for IP reasons. - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | Published firmware, the SE vendors, one pre-compiled MCU library, and Keystone's release signing. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | BIP39 12/24 words, Shamir backup, passphrase. No cloud recovery. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | None. Each transaction is a QR round-trip with fingerprint or PIN approval. - Solana wallets: Coldstar CLI and Seeker app. | Solflare extension (firmware ≥1.1.0) and Solflare mobile via QR. - Maturity: Beta — independent audit planned before the production release. | Third-generation device; shipping product with an established user base. ### Where Keystone 3 Pro wins - Appliance simplicity. Camera, screen, fingerprint reader, battery: nothing to set up beyond pairing with Solflare. - Seed at rest in silicon. Three secure elements protect the words against physical extraction. - Maintained Solflare integration with vendor documentation. ### Where Coldstar wins - Price and scale. Free software; a cold wallet per contributor costs a USB drive. - Fully inspectable. No pre-compiled MCU library; the whole signing path is MIT-licensed source. - Programmable. The signer is a CLI, so it can enforce policy for agents and treasuries, not only confirm on a screen. ### What you are trusting Keystone and Coldstar agree on the important thing: the key should never be on a machine with a network path, and transactions should cross the gap as data a human can inspect. Keystone implements that with dedicated hardware and a camera; Coldstar implements it with any offline computer and a USB drive holding an encrypted keyfile. Where they differ is what protects the key at rest. Keystone stores the seed in secure elements, which is strong against physical theft of the device. Coldstar never stores a plaintext key anywhere: the file on the drive is AES-256-GCM ciphertext, and losing the drive costs you nothing without the passphrase. Keystone is a shipping third-generation product. Coldstar is beta ahead of an independent audit. Weigh that honestly. ### FAQ Q: Both are air-gapped by QR. What is actually different? A: Keystone is a purpose-built device; Coldstar is software you run on an offline machine. Keystone protects the seed in secure elements; Coldstar stores only an encrypted file and decrypts into RAM for microseconds. Coldstar is also scriptable and policy-gated, which a device operated by fingerprint is not. Q: Is Keystone fully open source? A: Its firmware is published under an open licence, but the repository notes that one MCU library is included as a pre-compiled binary for IP reasons. Coldstar's signing path is entirely source. Q: Can Coldstar match Keystone's screen for verifying transactions? A: Coldstar shows the decoded transaction on the offline machine's terminal before signing. It is less pretty than a 4-inch touchscreen, and just as inspectable. ### Sources - Keystone 3 Pro product page ($149): https://keyst.one/shop/products/keystone-3-pro - Keystone: triple secure-element design: https://blog.keyst.one/inside-the-vault-how-keystone-3-pro-secures-your-crypto-with-triple-se-chips - Keystone 3 firmware repository (pre-compiled MCU library note): https://github.com/KeystoneHQ/keystone3-firmware - Keystone: Solflare extension guide: https://support.keyst.one/3rd-party-wallets/solana-wallets/solflare-extension ## Coldstar vs Tangem: Tangem alternative for Solana cold storage URL: https://coldstar.dev/compare/coldstar-vs-tangem Category: Cold storage & custody · NFC card wallet Tangem is the simplest hardware wallet you can buy: tap a card to your phone, enter a code, done. Coldstar is the opposite end of the spectrum, built for people who want to see exactly what signs and to script it. Both are cheap. They are for different people. ### Pick Tangem if - You want a wallet a non-technical family member can use from a phone with no seed phrase. - You want Solana staking and Jupiter swaps inside one app with an EAL6+ card as the key. - You value a tiny, waterproof, battery-free form factor. ### Pick Coldstar if - You want to verify the signing code, not trust a non-updatable closed card firmware. - You want the transaction displayed and signed on an offline machine, not on the online phone. - You need scriptable or policy-gated signing. ### Use both when Tangem for a family member's phone wallet; Coldstar for the operator who runs the treasury or the agents. ### Side by side (Coldstar | Tangem) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | 2-card set $59.90; 3-card set $69.90; Ring + 2 cards $160. - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | Samsung S3D350A secure element, CC EAL6+. Firmware is factory-installed and cannot be updated. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | NFC tap from the Tangem phone app. The card is offline, but the transaction is built and displayed on the online phone. No trusted screen on the card. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | Mobile app open source. Card firmware closed; audited by Kudelski (2018, 2023), Riscure (2023), Cure53 (2026). - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | Closed card firmware, third-party audit reports, and the phone the app runs on. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | Seedless by default: each card in the set holds the key, any one card gives full access, protected by an access code. Optional BIP39 import. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | None. Physical tap plus access code per transaction. - Solana wallets: Coldstar CLI and Seeker app. | Tangem app only (SOL, SPL, staking, WalletConnect, Jupiter swaps). Not connectable to Phantom or Solflare. - Maturity: Beta — independent audit planned before the production release. | Shipping since 2018; multiple published audits. ### Where Tangem wins - Zero-friction UX. No seed phrase, no cables, no software beyond the phone app. - Cheapest EAL6+ chip on the market with Solana staking built in. - Physical durability. Cards with no battery, screen, or ports. ### Where Coldstar wins - You can read what signs. Tangem's card firmware is closed and non-updatable; Coldstar's signing code is MIT-licensed. - Trusted display. Coldstar decodes the transaction on the offline machine. Tangem shows it on the phone that built it. - Automation. Headless, scriptable, policy-gated signing for treasuries and agents. ### What you are trusting Tangem's card is a secure element with no screen, so the phone is the display. If the phone is compromised, the card will faithfully sign whatever the phone shows you. Tangem mitigates this with audits and an access code; it cannot mitigate a malicious phone. That is the trade for the tap-to-pay experience. Coldstar separates the online and offline halves. The networked machine builds the transaction; the offline machine decodes it, shows it to you, and signs it. A compromised online machine can propose a bad transaction, but you see it before the key ever opens. Tangem has shipped since 2018 with several published audits. Coldstar is beta, pre-audit. ### FAQ Q: Tangem has no seed phrase. Is that safer? A: It removes the risk of a seed phrase being photographed or lost, which is the most common real-world failure. It also means the key exists only in the cards: lose all cards and it is gone. Coldstar's equivalent is the passphrase plus encrypted file — the drive is disposable, the passphrase is not. Q: Can Tangem be used with Phantom? A: No. The Tangem app is the only companion at the time of review. Coldstar likewise does not drive browser wallets; it builds and signs transactions itself. Q: Which is better for a treasury? A: Coldstar. Tangem is a personal wallet by design; Coldstar supports multisig and policy-gated, unattended signing. ### Sources - Tangem pricing: https://tangem.com/en/pricing/ - Tangem: is Tangem safe (chip, certification, firmware): https://tangem.com/en/learning-hub/post/is-tangem-safe/ - Tangem security page (audits): https://tangem.com/en/security/ - Tangem: stake Solana: https://tangem.com/en/blog/post/stake-solana-sol/ ## Coldstar vs GridPlus Lattice1: GridPlus Lattice1 alternative for Solana cold storage URL: https://coldstar.dev/compare/coldstar-vs-gridplus-lattice1 Category: Cold storage & custody · Always-online hardware wallet The Lattice1 takes the opposite bet from Coldstar: a big touchscreen, Wi-Fi and Ethernet, and remote pairing so your desktop wallet can reach it over the network. It is built for active DeFi users who want to read every instruction. Coldstar is built for keys that should never be reachable at all. ### Pick GridPlus Lattice1 if - You trade actively and want instruction-level decoding on a large screen. - You want to sign from a laptop anywhere on your network without touching the device's port. - You want SafeCards for multiple wallets and PIN-protected backups. ### Pick Coldstar if - You want the key on a machine with no network interface. The Lattice1 is online by design. - You want open, auditable signing code. Lattice1 firmware ships as signed binaries. - You need policy-gated, unattended signing. The Lattice1 requires on-screen approval for every request. ### Use both when Lattice1 for the DeFi desk; Coldstar for the reserve treasury and any agent that must operate under a hard policy. ### Side by side (Coldstar | GridPlus Lattice1) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | $397. - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | "Secure Computing Environment" with a PUF-based secure enclave; SafeCards also PUF-based. No EAL certification stated on GridPlus pages. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | Over the network. Wi-Fi or Ethernet; requests arrive at the device's general computing environment. Cannot operate air-gapped. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | SDK and SafeCard CLI are open. Device firmware is distributed as signed binaries; source not published. - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | GridPlus firmware and enclave design, the anti-tamper mesh, and the network path into the device. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | BIP39 seed viewable on device; backup and restore to PIN-protected SafeCards. No cloud recovery. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | None. Docs state all signing requests must be approved on the device screen; no auto-sign or spending limits. - Solana wallets: Coldstar CLI and Seeker app. | Native Solana signing with three derivation paths; companion wallet NuFi; dApps such as Jupiter, Magic Eden, Tensor. - Maturity: Beta — independent audit planned before the production release. | Shipping product; firmware actively updated (v0.18.x improved Solana decoding). ### Where GridPlus Lattice1 wins - Readable transactions. A 5-inch screen with Solana instruction decoding beats a terminal or a 2-inch OLED. - Remote convenience. Pair once, sign from any machine on your network. - Multi-wallet SafeCards for separating funds without separate devices. ### Where Coldstar wins - No network path. Coldstar's signing machine has no interface an attacker can reach. - Open source. The entire signing path is MIT-licensed, not a signed binary. - Policy and automation. Treasuries and agents can sign within enforced limits without a human tapping a screen. ### What you are trusting The Lattice1 is designed around isolation inside the device: an always-online general computing environment receives requests, and a separate secure environment holds keys and signs only after you approve on screen. You are trusting that internal boundary and GridPlus's unpublished firmware to hold it. Coldstar's isolation is physical. The offline machine has no radio and no cable to the internet; the only way in is a QR code you scan. The plaintext key exists for microseconds in locked RAM. There is no boundary inside a networked device to defend because there is no networked device. GridPlus ships a mature product with a strong anti-tamper design. Coldstar is beta software awaiting an independent audit. ### FAQ Q: The Lattice1 is always online. Is that a problem? A: It is a design choice with a cost. GridPlus isolates keys inside the device, so a network attacker still needs you to approve on screen. Coldstar removes the network path entirely, which removes the class of attack rather than defending against it. Q: Does Coldstar decode transactions like the Lattice1 does? A: Coldstar shows the decoded transaction on the offline machine before you sign, in the terminal. The Lattice1's screen is nicer; the information is the same. Q: Which is better for an AI agent? A: Neither is designed for an agent to drive directly, but Coldstar's policy engine lets an agent transact within limits using a session key while the cold root stays offline. The Lattice1 requires human approval on the device for every request. ### Sources - GridPlus Lattice1 product page ($397): https://gridplus.io/products/grid-lattice1 - GridPlus docs: security features: https://docs.gridplus.io/lattice1/security-features - GridPlus docs: supported digital assets (Solana paths): https://docs.gridplus.io/lattice1/supported-digital-assets - GridPlus docs: firmware reference (approval requirement): https://docs.gridplus.io/lattice1/lattice1-firmware-reference - GridPlus SDK (open source): https://github.com/GridPlus/gridplus-sdk ## Coldstar vs SafePal S1: SafePal S1 alternative for Solana cold storage URL: https://coldstar.dev/compare/coldstar-vs-safepal Category: Cold storage & custody · Air-gapped hardware wallet SafePal S1 is the cheapest way to buy QR air-gap signing in a box, with a secure element and a companion app that also does swaps. Coldstar is the cheapest way to get it at all. The gap between them is open source and automation. ### Pick SafePal S1 if - You want a finished QR air-gapped device for under $50 with a secure element. - You want one companion app for 200+ chains, swaps, and DeFi. - You do not want to set up an offline computer. ### Pick Coldstar if - You want to read the signing code. SafePal's firmware is only partially open. - You need scriptable or policy-gated signing. - You want a cold wallet per team member without buying devices. ### Use both when SafePal for personal mobile holdings; Coldstar for the treasury and agent keys that need policy and scripting. ### Side by side (Coldstar | SafePal S1) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | S1 $49.99; S1 Pro $89.99. - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | CC EAL6+ secure element with anti-tamper self-destruct. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | QR code only. No USB data, Bluetooth, Wi-Fi, or NFC. Fully air-gapped. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | Partial: QR-scanning mechanisms and X1 signing code were opened in 2023; full S1 firmware open-sourcing was announced as a goal, current status not confirmed on SafePal's pages. - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | SafePal's largely closed firmware, the SE, and the SafePal app. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | BIP39 12/24 words generated from a hardware TRNG; PIN and passphrase. No cloud recovery. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | None. On-device confirmation per transaction. - Solana wallets: Coldstar CLI and Seeker app. | SafePal app (iOS/Android) and SafePal browser extension. Not connectable to Phantom or Solflare. - Maturity: Beta — independent audit planned before the production release. | Shipping since 2019; large installed base. ### Where SafePal S1 wins - Price for a finished device. $49.99 with an EAL6+ chip and QR air gap. - Turnkey experience. Box, app, done; 200+ chains in one place. - Physical protections such as self-destruct on tamper. ### Where Coldstar wins - Fully open source. MIT-licensed; nothing partial. - Programmable. A CLI signer can enforce policy for agents and sign for a multisig treasury. - Marginal cost near zero per additional wallet. ### What you are trusting SafePal's S1 keeps the seed in a certified chip and only ever exchanges QR codes with the phone, which is the same air-gap principle Coldstar uses. What you cannot do is read most of the firmware that implements it; SafePal opened parts of its stack in 2023 and stated an intent to open more. Coldstar publishes everything under MIT and stores only an encrypted keyfile on the drive. The plaintext key lives in memory-locked RAM on an offline machine for about a hundred microseconds per signature. SafePal is a mature consumer product. Coldstar is beta and awaiting its independent audit. ### FAQ Q: Both use QR codes across an air gap. What's the practical difference? A: SafePal is a dedicated device with a secure element and a closed-ish firmware. Coldstar is open-source software on any offline computer. SafePal is simpler to start with; Coldstar is inspectable, scriptable, and free. Q: Is SafePal open source? A: Partly. SafePal published its QR-scanning code and X1 signing code in 2023 and said full S1 firmware open-sourcing was a goal. We could not confirm on SafePal's pages that this has happened. Q: Can I use SafePal for a DAO treasury? A: It is a personal wallet; multisig would be handled by an on-chain program such as Squads, with each signer using their own device. Coldstar supports multisig and policy-gated signing natively. ### Sources - SafePal store (S1 $49.99, S1 Pro $89.99, EAL6+): https://www.safepal.com/en/store - SafePal: hardware wallet security chip upgrade: https://www.safepal.com/en/blog/hardware-wallet-upgrade - SafePal: hardware TRNG firmware: https://www.safepal.com/en/blog/hw-firmware-trng - SafePal GitHub (opened components): https://github.com/SafePalWallet - SafePal hardware wallet docs: https://docs.safepal.io/safepal-hardware-wallet ## Coldstar vs OneKey: OneKey alternative for Solana cold storage URL: https://coldstar.dev/compare/coldstar-vs-onekey Category: Cold storage & custody · Open-source hardware wallet OneKey is the hardware wallet that checks the most boxes on paper: open-source, reproducible firmware; EAL6+ secure elements; and on the Pro, QR air-gap signing. If you want a device, it is a strong pick. Coldstar's case against it is price, scripting, and policy. ### Pick OneKey if - You want open, reproducible firmware inside a certified device. - You want the Pro's QR air gap plus Bluetooth and NFC convenience in one unit. - You want a polished multi-chain app and a vendor-audited (SlowMist) stack. ### Pick Coldstar if - You do not want to spend $99–$278 per wallet. - You need headless, policy-gated signing for agents or treasuries. - You want zero firmware and zero vendor in the loop, only code you run. ### Use both when OneKey Pro as the personal vault; Coldstar as the programmable cold root behind automated flows. ### Side by side (Coldstar | OneKey) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | Classic 1S $99 (Pure $79); Pro $278. - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | Classic 1S: one EAL6+ secure element. Pro: four EAL6+ secure elements. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | Classic 1S: USB-C and Bluetooth (not air-gapped). Pro: QR camera for air-gapped signing, plus USB-C, Bluetooth, NFC. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | Firmware and apps fully open source and reproducible; audited by SlowMist. - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | Open firmware you can reproduce, the SE vendors, and OneKey's release signing. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | BIP39; passphrase (Pro: attach-to-PIN hidden wallets); optional OneKey Lite NFC backup card. No cloud recovery. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | None. On-device confirmation (fingerprint on Pro). - Solana wallets: Coldstar CLI and Seeker app. | OneKey app (100+ chains). Direct Phantom or Solflare hardware connection not documented. - Maturity: Beta — independent audit planned before the production release. | Shipping product line with third-party audit. ### Where OneKey wins - Open and reproducible firmware you can build and compare against the shipped binary. - Best-of-both connectivity on the Pro: QR air gap when you want it, Bluetooth when you don't. - Certified silicon protecting the seed at rest. ### Where Coldstar wins - Cost. Free software plus a $10 drive versus $99–$278 per device. - Policy-gated automation for agents and treasuries. - Nothing at rest in plaintext. The drive holds ciphertext only; there is no seed in a chip to extract. ### What you are trusting OneKey and Coldstar both let you read the code. OneKey goes a step further than most vendors with reproducible builds, so you can verify the binary on the device matches the source. The remaining trust is in the secure element vendors and in OneKey's update signing. Coldstar removes the device. The key is an encrypted file; the signer is an offline computer; the code is MIT. What you gain is scriptability and a near-zero marginal cost per wallet. What you give up is a certified chip guarding a seed at rest, which Coldstar replaces by never having a plaintext seed at rest. OneKey is a shipping, audited product. Coldstar is beta, pre-audit. ### FAQ Q: OneKey is open source too. Why pick Coldstar? A: Because you may not want a device at all: for a treasury with many signers, or an agent that must sign under policy without a human present, hardware with a fingerprint reader is the wrong shape. For a single personal wallet, OneKey is a fine choice. Q: Is the OneKey Classic 1S air-gapped? A: No; it connects over USB-C or Bluetooth. Only the Pro has the QR camera for air-gapped signing. Q: Does OneKey work with Phantom? A: OneKey documents its own app for Solana. We did not find a direct Phantom or Solflare hardware connection on OneKey's pages at review time. ### Sources - OneKey products: https://onekey.so/products/ - OneKey Classic 1S ($99): https://onekey.so/products/onekey-classic-1s/ - OneKey Pro ($278, four SEs, QR): https://onekey.so/products/onekey-pro/ - OneKey: connect to app via QR code (air gap): https://help.onekey.so/en/articles/11461088-connect-to-onekey-app-via-qr-code-air-gap - OneKey GitHub (open, reproducible firmware): https://github.com/onekeyhq ## Coldstar vs ELLIPAL Titan 2.0: ELLIPAL Titan 2.0 alternative for Solana cold storage URL: https://coldstar.dev/compare/coldstar-vs-ellipal Category: Cold storage & custody · Air-gapped hardware wallet ELLIPAL's Titan is the big-screen consumer take on air-gapped signing: no ports for data, a camera for QR codes, and a self-destruct on tamper. Coldstar shares the air gap and drops everything else — the device, the price, and the closed firmware. ### Pick ELLIPAL Titan 2.0 if - You want a large touchscreen air-gapped device with a metal body and tamper wipe. - You hold across 45+ chains and want one companion app. - You want a product with a warranty rather than software you operate. ### Pick Coldstar if - You want to read the code that signs. ELLIPAL's firmware is closed. - You need scripting and policy, not a screen a human taps. - You want the marginal cost of another cold wallet to be a USB drive. ### Use both when Titan for personal holdings you sign by hand; Coldstar for the treasury and agent keys that need policy. ### Side by side (Coldstar | ELLIPAL Titan 2.0) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | $149 (sale price from $169 at review). - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | On-device, CC EAL5+ secure chip. Auto-wipe on physical tampering. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | QR only. No Wi-Fi, Bluetooth, or USB data. Fully air-gapped. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | No open-source claims on the product page; firmware closed. - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | ELLIPAL's closed firmware and the secure chip. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | Seed phrase; up to five wallets plus a hidden secondary wallet. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | None. Human QR scan and confirmation per transaction. - Solana wallets: Coldstar CLI and Seeker app. | ELLIPAL app; dApps via WalletConnect and MetaMask bridging. - Maturity: Beta — independent audit planned before the production release. | Shipping consumer product, second-generation Titan. ### Where ELLIPAL Titan 2.0 wins - Self-contained. Battery, camera, big screen, metal body; nothing to assemble. - Tamper response. Wipes on physical intrusion. - Chain breadth with one app. ### Where Coldstar wins - Open source. MIT-licensed signing path versus a closed firmware you cannot audit. - Scriptable and policy-gated for treasuries and agents. - Disposable medium. The drive holds ciphertext; there is nothing to extract. ### What you are trusting The Titan puts the key in a secure chip inside a sealed device and moves transactions by QR. That removes the network path, which is the main thing. What remains is trust in firmware you cannot read and a chip that must resist physical attack if the device is stolen. Coldstar removes the device. The offline computer decrypts an AES-256-GCM keyfile into memory-locked RAM for microseconds, signs, and wipes. The drive is storage, not a signer; stealing it yields ciphertext. ELLIPAL is a shipping product; Coldstar is beta, pre-audit. ### FAQ Q: Is ELLIPAL open source? A: Not that ELLIPAL claims on its product pages at review time. Coldstar's code is MIT-licensed. Q: Both are QR air-gapped. Which is more secure? A: Against remote attackers, both remove the network path. Against a thief with the device, ELLIPAL relies on its chip and tamper wipe; Coldstar relies on the passphrase protecting an encrypted file. Against a bug in the signer itself, only Coldstar lets you look. Q: Can ELLIPAL sign for a bot or agent? A: No. Every transaction needs a human to scan and confirm. Coldstar's policy engine lets an agent transact inside limits while the root stays cold. ### Sources - ELLIPAL Titan product page ($149, EAL5+, QR-only, self-destruct): https://www.ellipal.com/products/ellipal-titan - ELLIPAL homepage (supported chains incl. SOL): https://www.ellipal.com/ ## Coldstar vs Cypherock X1: Cypherock X1 alternative for Solana cold storage URL: https://coldstar.dev/compare/coldstar-vs-cypherock Category: Cold storage & custody · Shamir-split hardware wallet Cypherock attacks a different problem than most wallets: the seed phrase itself. The X1 splits your key into five Shamir shares across a vault and four cards, so no single object holds it. Coldstar's answer to the same problem is that the key is never at rest in plaintext at all. ### Pick Cypherock X1 if - Your biggest fear is a seed phrase being found, photographed, or lost. - You want inheritance and physical 2-of-5 redundancy built into the product. - You want an EAL6+ card-based design with published firmware. ### Pick Coldstar if - You want a true air gap. The X1 signs over USB-C to a desktop app. - You need scripting and policy-gated signing. - You want a fully MIT-licensed stack you can reuse commercially. ### Use both when X1 for the generational cold vault; Coldstar for the operational cold root that signs on a schedule or under an agent policy. ### Side by side (Coldstar | Cypherock X1) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | X1 Standard and X1 Pro; prices render client-side on Cypherock's store and are not quoted here. - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | Split into five Shamir shares: the X1 Vault plus four NFC cards (EAL6+ secure elements). Signing needs the vault plus any one card. The vault never stores the complete key. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | USB-C to the cySync desktop app; cards via NFC. Not air-gapped. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | Firmware public under MIT plus Commons Clause (no commercial resale). - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | Published firmware, the card secure elements, and the connected desktop. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | Any vault plus one of four cards. No seed phrase to write down by default; inheritance feature. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | None. - Solana wallets: Coldstar CLI and Seeker app. | cySync app; dApps via WalletConnect. - Maturity: Beta — independent audit planned before the production release. | Shipping product; audited by Keylabs per Cypherock. ### Where Cypherock X1 wins - No seed phrase to protect. The 2-of-5 physical split is easy to reason about for a long-term holder. - Inheritance and redundancy designed in. - Certified card silicon guarding each share. ### Where Coldstar wins - Air gap. Coldstar never connects the signing machine to a network; the X1 signs over USB to an online desktop. - Policy-gated automation for treasuries and agents. - Plain MIT licence with no commercial restriction. ### What you are trusting Cypherock's model is that the key exists only when reassembled inside the vault from shares that are otherwise kept apart. That is a strong defence against a single backup being compromised. The signing itself happens on a device connected over USB to a desktop app, so the transaction path is not air-gapped. Coldstar's model is that the plaintext key exists only in RAM, on a machine with no network, for the microseconds it takes to sign. The single backup is an encrypted file plus a passphrase you keep in your head or a safe. Cypherock is a shipping, audited product. Coldstar is beta and pre-audit. ### FAQ Q: Doesn't splitting the key across cards beat a passphrase-protected file? A: It beats a single paper backup. Against theft of the encrypted file, AES-256-GCM with a strong passphrase (and Argon2 key stretching) is not the weak link. Against loss, the X1's redundancy is genuinely convenient; Coldstar's answer is to keep more than one encrypted copy, which costs nothing. Q: Is the X1 air-gapped? A: No. It connects over USB-C to the cySync desktop app for signing. Q: Which fits a treasury? A: Coldstar, which supports multisig and unattended, policy-gated signing. The X1 is a personal vault. ### Sources - Cypherock homepage (Shamir 5-way split, EAL6+ cards, Keylabs audit): https://www.cypherock.com/ - Cypherock: Solana wallet page: https://www.cypherock.com/coin/wallet/solana - Cypherock X1 firmware licence (MIT + Commons Clause): https://github.com/Cypherock/x1_wallet_firmware/blob/main/LICENSE.md ## Coldstar vs Phantom: cold storage alongside your Phantom hot wallet URL: https://coldstar.dev/compare/coldstar-vs-phantom Category: Cold storage & custody · Hot wallet Phantom is where most Solana users keep the money they use every day, and it is very good at that. Coldstar is where you keep the money you don't want a browser to be able to reach. They are not competitors so much as two ends of the same wallet stack — until Phantom's agent wallet enters the picture. ### Pick Phantom if - You are using dApps, NFTs, and swaps daily and want the best consumer UX on Solana. - You want Ledger support for the balance you keep in the extension. - You want an AI assistant to get a wallet in minutes via Phantom's MCP server and accept that it holds a hot key. ### Pick Coldstar if - You are storing funds you do not touch daily and want the key off every networked machine. - You are a team or DAO that needs a scriptable cold root. - You want an agent to transact under enforced limits rather than with a hot wallet of its own. ### Use both when This is the normal setup: Phantom for spending, Coldstar for savings and for anything automated. ### Side by side (Coldstar | Phantom) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | Free. - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | Encrypted in the browser extension or mobile app on an online device. Optional Ledger for hardware-held keys. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | Directly; the wallet is on the same device as the browser. No air gap. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | Wallet app is not open source. Public repos: connect SDK (MIT), blocklist, sign-in-with-solana, audit reports. - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | Phantom's closed app, its release pipeline, and the security of the device it runs on. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | Seed phrase. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | No spending limits or allowlists. Phantom MCP server gives an AI assistant a dedicated embedded wallet (13 tools); no policy controls documented for it. - Solana wallets: Coldstar CLI and Seeker app. | Is the wallet. Solana, Ethereum, Bitcoin, Base, Polygon, HyperEVM. - Maturity: Beta — independent audit planned before the production release. | Millions of users; bug bounty up to $50k; published audit reports. ### Where Phantom wins - Daily UX. The best-supported Solana wallet for dApps, NFTs, and swaps. - Ecosystem gravity. Every Solana dApp integrates it; Ledger works with it. - Fastest agent onboarding. The MCP server gets an assistant transacting in minutes. ### Where Coldstar wins - Air gap. The key never sits on a device that runs a browser. - Open source. Phantom's app is closed; Coldstar's signing path is MIT. - Policy for agents. Coldstar bounds what an agent can do; Phantom's agent wallet is a hot key with no documented limits. ### What you are trusting A hot wallet's threat model is the device it runs on. Phantom mitigates with a phishing blocklist, transaction warnings, audits, and a bounty, and it is one of the safer hot wallets. But a malicious extension, a clipboard hijacker, or a compromised OS is inside the trust boundary by construction. That is fine for spending money. It is not fine for a treasury. Coldstar's boundary is an offline machine. The transaction is built online and crosses by QR; the key opens for microseconds in memory-locked RAM on a machine nothing can reach. A compromised online machine can propose a bad transaction; you see it before it is signed. For agents the gap widens. Phantom's MCP server provisions the assistant a dedicated embedded wallet, which is a hot key the model can spend from, with no spending limits documented. Coldstar's agent model is the reverse: the agent proposes, a policy decides, the root stays cold. ### Using Phantom and Coldstar together Use Phantom for the balance you spend from. Sweep the rest to a Coldstar wallet on a USB drive, and when an agent needs to transact, give it a Coldstar policy envelope instead of a Phantom wallet. ### FAQ Q: Is Phantom safe? A: As hot wallets go, yes: audited, bounty-backed, with phishing protection. The limitation is structural, not a flaw in Phantom: the key lives on an internet-connected device. Keep spending money there and savings somewhere cold. Q: Can Phantom give my AI agent a wallet? A: Yes, via the Phantom MCP server, which creates a dedicated embedded wallet the assistant can sign from. Phantom's setup docs do not describe spending limits for it, so the agent effectively holds a hot key. Coldstar's approach is policy-gated: the agent never holds the key and can only act within limits. Q: Does Coldstar replace Phantom? A: No. Coldstar does not aim to be a browser wallet for dApps. It is the cold layer under it. ### Sources - Phantom docs (supported chains): https://docs.phantom.com/ - Phantom security page: https://phantom.com/security - Phantom MCP server setup: https://docs.phantom.com/phantom-mcp-server/setup - Phantom GitHub (public repos, audit reports): https://github.com/phantom - Phantom help: Ledger on the extension: https://help.phantom.com/hc/en-us/articles/4406388670483 ## Coldstar vs Solflare: cold storage alongside your Solflare hot wallet URL: https://coldstar.dev/compare/coldstar-vs-solflare Category: Cold storage & custody · Hot wallet Solflare is the Solana-native power-user wallet: staking, Ledger and Keystone support, and its own $49 tap-to-sign Shield card. Coldstar is the cold, scriptable layer underneath. The comparison is mostly about where the key sits and who is allowed to press the button. ### Pick Solflare if - You want a Solana-only wallet with first-class staking and hardware integrations. - You already own a Ledger or Keystone and want to keep using it through a browser. - You want a cheap tap-to-sign card (Shield) for a personal balance. ### Pick Coldstar if - You want the key off every networked device, with no extension in the loop. - You need scriptable or policy-gated signing for a team or an agent. - You want to audit the signing code. Solflare's app is not open source. ### Use both when Solflare for interactive use, Coldstar for the reserve and the automation. ### Side by side (Coldstar | Solflare) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | Free app; Shield hardware from $49. - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | In the extension, web, or mobile app on an online device, or on a connected Ledger, Keystone, or Shield. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | Directly in the app. With Keystone attached, QR air-gapped signing is possible through Solflare. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | Wallet app not published. Public: SDK, MetaMask Snap, token lists, blocklist. - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | Solflare's closed app and the device it runs on, plus any attached hardware. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | Seed phrase. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | None. dApps connect via Wallet Adapter; the user approves each transaction. No AI-agent product. - Solana wallets: Coldstar CLI and Seeker app. | Is the wallet. Solana only. - Maturity: Beta — independent audit planned before the production release. | Long-running Solana wallet with a large user base. ### Where Solflare wins - Solana-native depth. Staking, hardware integrations, and notifications in one app. - Hardware flexibility. Ledger, Keystone, and Shield all work. - Interactive dApp use through Wallet Adapter. ### Where Coldstar wins - Air gap without a device. Any offline computer plus a USB drive. - Open source signing path. - Automation and policy for treasuries and agents. ### What you are trusting Solflare on its own is a hot wallet: the key is on the device running the browser. Attach a Ledger or Keystone and the key moves into hardware, with Solflare acting as the online half. That is a sound setup for interactive use, and it is closer to Coldstar's design than most hot wallets get. Coldstar is the same online/offline split without vendor hardware. The online machine builds the transaction; the offline machine decodes, signs, and wipes. Because the signer is a CLI, the split also works when no human is present, under a policy. Solflare is production software; Coldstar is beta ahead of an independent audit. ### FAQ Q: Solflare plus Keystone is already air-gapped. Why Coldstar? A: That combination is a good one for a person. Coldstar is for the cases a person-operated device doesn't cover: many wallets for a team at USB-drive prices, unattended signing for a treasury, and policy-gated signing for agents. Q: Is Solflare open source? A: The wallet app is not published at review time; the SDK, Snap, and token lists are. Coldstar's signing code is MIT-licensed. Q: Does Coldstar do staking? A: Coldstar signs any Solana transaction you build, including stake instructions, but it does not have Solflare's guided staking UI. ### Sources - Solflare homepage: https://solflare.com/ - Solflare docs: import a Keystone device: https://docs.solflare.com/solflare/onboarding/web-app-and-extension/import-your-keystone-device.md - Solflare docs: import a Ledger device: https://docs.solflare.com/solflare/onboarding/web-app-and-extension/import-your-ledger-device.md - Solflare GitHub (public repos): https://github.com/solflare-wallet ## Coldstar vs a Solana keypair file: an encrypted, air-gapped alternative to id.json URL: https://coldstar.dev/compare/coldstar-vs-solana-keypair-file Category: Cold storage & custody · Developer default Every Solana developer has one: an id.json written by solana-keygen, sitting in ~/.config, holding an unencrypted 64-byte secret. Solana's own docs call it the least secure wallet option. Coldstar is what that file should have been: encrypted, offline, and still scriptable. ### Pick a Solana keypair file if - It is a devnet or test key and the balance is worthless. - It is a validator identity or CI key where the process must hold a key and you have hardened the host. - You need zero dependencies beyond the Solana tool suite. ### Pick Coldstar if - The key controls real funds. Solana's docs say to use hardware for that; Coldstar is the software route. - You want to keep a CLI, scriptable workflow but stop storing plaintext secrets on disk. - The key will be used by a bot or agent and needs limits. ### Use both when Keep the keypair file for devnet. Move mainnet keys to Coldstar. ### Side by side (Coldstar | a Solana keypair file) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | Free. - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | Unencrypted JSON on disk. Anza docs: the password applies to the seed phrase, not the file; anyone with the file has all the tokens. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | Any process on the machine can read the file and sign. The paper-wallet docs suggest deriving on an air-gapped computer, but there is no built-in offline transaction transport. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | Apache-2.0, part of the Agave client. - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | Every process, user, backup, and sync tool that can read the file. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | BIP39 seed phrase. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | Fully scriptable with no policy layer: whatever can read the file can sign anything. - Solana wallets: Coldstar CLI and Seeker app. | Solana CLI and every SDK. - Maturity: Beta — independent audit planned before the production release. | Reference implementation. ### Where a Solana keypair file wins - Zero friction. Works with every tool in the ecosystem immediately. - No dependencies beyond the CLI you already installed. - Right for throwaway keys on devnet and in CI. ### Where Coldstar wins - Encrypted at rest. AES-256-GCM with Argon2 key stretching instead of plaintext JSON. - Air-gapped signing with a QR transport built in, so the key never has to be on an online host. - Policy. Bots and agents get limits, allowlists, and rate caps instead of the whole key. ### What you are trusting A keypair file has no trust model; it has an access-control list, and it is the one your operating system gives to every process running as you. Backups copy it. Sync clients upload it. A malicious npm postinstall reads it. Solana's docs are explicit that this is the least secure option and steer real funds to hardware. Coldstar keeps the same CLI ergonomics and removes the plaintext. The file on the drive is ciphertext; the passphrase never touches disk; decryption happens in memory-locked RAM on an offline machine for about a hundred microseconds. For scripts and agents, a policy decides what may be signed, so a compromised host proposing transactions can only do what the policy allows. Coldstar is beta and pre-audit. It is still a large step up from an unencrypted secret on a laptop. ### Using a Solana keypair file and Coldstar together Coldstar was built for people who already live in the terminal. Keep solana-keygen for devnet and use Coldstar for any key that would hurt to lose. ### FAQ Q: Isn't my id.json protected by my disk encryption? A: Only while the machine is off. When you are logged in, every process you run can read it, and so can anything that backs up or syncs your home directory. Q: Can I keep using the Solana CLI with Coldstar? A: Coldstar is a CLI signer: build the transaction online with your usual tools, sign it offline with Coldstar, broadcast. It also builds common transactions itself, including Jupiter swaps. Q: What about the CLI's hardware wallet support? A: The Solana CLI supports Ledger over usb://ledger, which is a good option if you own one. Coldstar gives you an offline signer without buying hardware and adds a policy layer for automation. ### Sources - Anza docs: file-system wallet (unencrypted, least secure): https://docs.anza.xyz/cli/wallets/file-system - Anza docs: paper wallet (air-gapped derivation, swap warning): https://docs.anza.xyz/cli/wallets/paper - Anza docs: Ledger hardware wallet with the CLI: https://docs.anza.xyz/cli/wallets/hardware/ledger - Agave source (Apache-2.0): https://github.com/anza-xyz/agave ## Coldstar vs Squads: cold, scriptable keys for a Squads multisig URL: https://coldstar.dev/compare/coldstar-vs-squads Category: Cold storage & custody · On-chain multisig Squads is the standard Solana multisig: audited, formally verified, with roles, time locks, and spending limits enforced on-chain. It answers who must approve. Coldstar answers where each approver's key lives. Most serious treasuries want both; this page is about where each one carries the weight. ### Pick Squads if - You need N-of-M approval enforced by the chain, not by any one machine. - You want roles (proposer, voter, executor), time locks, and per-member spending limits. - You want a polished team app with audits from OtterSec, Neodyme, and Trail of Bits. ### Pick Coldstar if - You want each signer's key off any networked device. Squads members typically sign from Phantom or Solflare. - You want a scriptable cold root that can sign proposals or run a spending-limit bot under policy. - You are a single operator who wants cold storage today and may add multisig later. ### Use both when Squads decides who and how much; Coldstar decides where the keys live and stops the agent before it asks. Each covers the other's gap, which is why we built the integration rather than just recommending it. ### Side by side (Coldstar | Squads) - Upfront cost: ~$10 — any USB drive. The software is free and MIT-licensed. | Basic: free plus a one-time 0.1 SOL deployment fee. Pro $49/month; roles and permissions need Business or Enterprise. 0.25% on limit orders. - Where the key lives: AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | Funds sit in an on-chain smart account. Each member's key lives in that member's own wallet, usually a hot wallet or a Ledger via Phantom/Solflare. - How a transaction reaches the key: Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | Members approve in the Squads app from their connected wallets. No air gap unless a member brings hardware; Ledger requires blind signing through Phantom or Solflare. - Source code: Open source (MIT) — every line that touches the key is readable on GitHub. | Program AGPL-3.0, Rust crate and TypeScript SDK public. Audits plus Certora formal verification. App frontend source status not confirmed. - What you trust: Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | The audited program, the threshold of member keys, and each member's own wallet security. - Recovery: Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | Threshold of members can rotate a lost member key on-chain. - Automation & policy: CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | Threshold, roles, spending limits per member and token with reset periods and destination allowlists, global time locks (1h to custom). SDK for programmatic proposals; no AI-agent product. - Solana wallets: Coldstar CLI and Seeker app. | Members connect any Solana wallet; Ledger only via Phantom or Solflare. - Maturity: Beta — independent audit planned before the production release. | Production; secures large treasuries on Solana mainnet. ### Where Squads wins - On-chain enforcement. Thresholds, time locks, and spending limits are checked by the program, not by a client. - Team workflow. Proposals, roles, and approvals in a shared app. - Assurance. Multiple audits and formal verification. ### Where Coldstar wins - Cold member keys. Coldstar keeps each approver's key off networked machines; Squads leaves that to each member. - Scriptable signer. A Coldstar-held member can approve or execute programmatically under policy. - Solo operators. Cold storage from day one without needing a team or a monthly plan. - It reads Squads rather than trusting it. spending_limit_use is decoded so local limits still apply, and the instructions that would raise the agent's own ceiling are refused. ### What you are trusting Squads moves the authorization question on-chain: funds move only when enough members approve, within whatever limits and locks the Squad set. That is the right place for quorum rules. What Squads cannot control is the security of each member's signing key, which is usually a browser wallet on a laptop. Coldstar is a signer, not a multisig program. It controls where a key lives and under what local policy it will sign. Put a Coldstar-held key in each Squad seat and the multisig's threshold sits on top of keys that never touch a network. Squads is production infrastructure; Coldstar is beta, pre-audit. For a treasury, use Squads for the quorum and be deliberate about how cold each seat's key really is. ### Using Squads and Coldstar together This is the pairing we built for, not a theoretical one. Put the funds in a Squads vault and make the agent's session key a member with a spending limit: Coldstar decodes spending_limit_use, so its per-transaction, daily and per-mint limits apply on top of the ones the program enforces. Coldstar's honest weakness is that a stolen session key defeats it, and that is exactly what the on-chain limit bounds; Squads' is that members usually sign from a hot browser wallet, and that is exactly what a cold root fixes. Coldstar also refuses the Squads instructions that would let an agent raise its own ceiling — adding or removing a spending limit, changing the config, executing an arbitrary vault transaction — so the agent can spend inside its limit and cannot change it. ### FAQ Q: Is Coldstar a multisig? A: Coldstar supports multisig flows, but Squads is the on-chain quorum standard on Solana. Coldstar's contribution is making each signer cold and scriptable. Q: Can Squads members sign from Coldstar? A: Squads members sign with any Solana wallet. A Coldstar-held key can approve as a member; the approval transaction crosses the air gap by QR like any other. Q: How do Squads spending limits compare to Coldstar's agent policy? A: Squads enforces a per-member budget on-chain; Coldstar enforces limits, allowlists, and rate caps locally before any signature exists and can escalate to a human. Used together, an agent gets both an on-chain ceiling and a local gate. ### Sources - Squads docs (pricing, Ledger via Phantom/Solflare, spending limits, time locks): https://docs.squads.so/main/llms-full.txt - Squads Protocol v4 source (AGPL-3.0, audits): https://github.com/Squads-Protocol/v4 - Squads docs: member permissions: https://docs.squads.so/main/navigating-your-squad/members/permissions.md - Squads docs: spending limits: https://docs.squads.so/main/navigating-your-squad/settings/spending-limits.md ## Coldstar vs Turnkey: Turnkey alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-turnkey Category: Agent-safe signing · Hosted enclave signer Turnkey has the most expressive Solana-aware policy language of any hosted signer: instruction-level conditions, SPL transfer checks, consensus rules, all evaluated inside an attested enclave. Coldstar evaluates a smaller rule set on your own machine with a root that never goes online. The question is whose infrastructure you want under your agent. ### Pick Turnkey if - You want a managed, SOC 2 Type II signer with attestation and no infrastructure to run. - You need instruction-level Solana conditions (program keys, SPL transfer fields, instruction data). - You are fine with per-signature pricing and an always-online root. ### Pick Coldstar if - You want the root key on hardware you own, offline, with no vendor account between your agent and the chain. - You need cumulative daily caps and a human escalation path over QR. Turnkey's language has no velocity limits. - You want to read and self-host the entire signer, not only the SDK. ### Use both when Turnkey for a fleet of consumer sub-org wallets; Coldstar as the cold treasury root that funds and bounds them. ### Side by side (Coldstar | Turnkey) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Turnkey's enclaves. Keys are generated and used only inside Turnkey-operated QuorumOS enclaves; customers hold API keys and passkeys, not key material. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Turnkey's enclave stack with remote attestation. Underlying cloud hardware not named on the fetched pages. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Boolean policy language: consensus (who) and condition (when). Solana fields for account keys, program keys, instructions, SOL and SPL transfers, address-table lookups; time windows via cron spans. No cumulative or daily caps. DENY beats ALLOW; evaluated inside the enclave. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Rejected, or held for a consensus rule that requires a human approver alongside the agent key. Root users can revoke by adding DENY policies. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No. Always-online service; the customer's passkeys are the only customer-held material. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Documented "End-User Delegated Agent Signing" (sub-org + zero-permission API user + policies); solutions for LangChain, CrewAI, Vercel AI SDK, x402; agent skills repo. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes, deeply: Solana transaction fields are first-class in the policy language. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | QuorumOS enclave OS published on GitHub; SDKs open. The service is hosted; no self-hosted option. - Pricing: Free software plus a ~$10 drive. | Free: 25 signatures/month, up to 1,000 wallets, then $0.10 per signature. Pro: $99/month minimum, $0.05 per signature. Enterprise: custom, down to $0.0015 per signature. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; SOC 2 Type II; whitepaper published. ### Where Turnkey wins - Policy expressiveness. Instruction- and SPL-level conditions that Coldstar's first-match rule list does not express today. - Operational maturity. Attestation, SOC 2, multi-tenant sub-organisations, published whitepaper. - Nothing to run. No offline machine, no drive, no ops. ### Where Coldstar wins - Cold root you own. Compromise of a vendor, an account, or an API key cannot reach the root; it is encrypted on a drive in your possession. - Velocity limits and escalation. Daily caps and an air-gapped human approval step for anything over the threshold. - No metered dependency. Free, MIT-licensed, self-hosted; no per-signature bill and no vendor outage on the critical path. - Revocation anyone can verify. Turnkey revokes by adding a DENY policy inside its own control plane; Coldstar publishes the revocation on Solana, where the agent's counterparties can check it too. ### What you are trusting Turnkey's claim is that no single engineer can access an enclave or reconstruct a secret, and that every change to your organisation's data is stamped inside an enclave. It backs that with remote attestation and a published enclave OS. You are trusting that design, Turnkey's operations, and the cloud beneath it, and paying per signature for the privilege of not running it. Coldstar's claim is smaller and checkable at home: the root key is an AES-256-GCM ciphertext on a drive you hold; it decrypts only into memory-locked RAM on an offline machine, to sign a bounded policy envelope. The agent works from a disposable session key inside that envelope. Nothing online, and no vendor, can produce a root signature. Turnkey is production infrastructure. Coldstar is beta; its policy engine and signing core are in scope for the planned independent audit, and its rule set is deliberately simple: blocklist, program allowlist, escalate threshold, per-transaction limit, recipient allowlist, daily cap. ### FAQ Q: Is Turnkey non-custodial? A: Turnkey describes a model where keys exist only inside its enclaves and it cannot unilaterally sign. In practice the key material lives on Turnkey-operated infrastructure and you authenticate to it. Coldstar's root never leaves a drive you physically hold. Q: Does Turnkey support daily spending caps? A: Not in its policy language at review time. It supports per-transaction conditions and time windows. Coldstar's policy includes a daily cap. Q: Can I use Solana Agent Kit with either? A: Yes. Solana Agent Kit ships a Turnkey example, and Coldstar's ColdstarWallet implements the same BaseWallet interface, so either plugs in. Q: Which is cheaper? A: Coldstar is free software. Turnkey's free tier covers 25 signatures a month, then $0.10 each on pay-as-you-go. ### Sources - Turnkey policy language (Solana fields, time, consensus): https://docs.turnkey.com/features/policies/language - Turnkey: delegated agent signing: https://docs.turnkey.com/features/policies/delegated-access/agentic-wallets - Turnkey security approach (enclaves, no single engineer access): https://docs.turnkey.com/security/our-approach - Turnkey pricing: https://www.turnkey.com/pricing - QuorumOS source: https://github.com/tkhq/qos ## Coldstar vs Privy: Privy alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-privy Category: Agent-safe signing · Embedded & server wallets Privy powers embedded wallets for consumer apps and, since its acquisition by Stripe, is the obvious pick if you already run on Stripe rails. Its server wallets and policy engine cover agents too. Coldstar is the option when you don't want an agent's authority to originate in anyone's cloud. ### Pick Privy if - You are building a consumer app and want user wallets and agent wallets from one vendor. - You want the deepest published audit trail of the hosted signers and a generous free tier. - You are already on Stripe. ### Pick Coldstar if - You want the root offline and in your possession, with no account to phish. - You want every policy enforced in one place, locally. Privy enforces some rules at its API layer rather than in the enclave. - You need daily caps and human escalation. Privy documents neither. ### Use both when Privy for end-user wallets in your product; Coldstar for the operator treasury and any agent that spends your money rather than a user's. ### Side by side (Coldstar | Privy) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Privy's infrastructure. Keys are split with Shamir's Secret Sharing and reassembled only inside a TEE; Privy states it cannot sign alone. Developers control server wallets with authorization keys; export and policy changes can be gated by a key quorum. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Hardware-backed TEEs operated by Privy; vendor not named on the security page. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Rules over 24+ methods and 15 field sources including Solana program, system, and token instructions; operators such as eq, lt, in, contains; transfer-size limits, time-bound signers, recipient and program allow and deny lists. Default deny. Some policies are enforced at the API layer, not in the enclave. No daily caps documented. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Denied. Key quorum protects critical actions such as export and policy updates; no per-transaction human approval workflow documented. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No. Online TEE service. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Agentic-wallet recipes (developer-owned vs user-owned agents, x402, Hyperliquid); AgentKit has a Privy wallet provider. Dedicated MCP server not confirmed. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: Solana instruction fields in policies and a send-Solana-transaction recipe. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | SDKs open; enclave and sharding code closed. Hosted only. - Pricing: Free software plus a ~$10 drive. | Free: 50,000 signatures and $1M transaction volume per month. Scale from $299/month. Enterprise down to $0.001 per signature. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; SOC 2 Type II; audits by Cure53, Zellic, SwordBytes, Doyensec; HackerOne bounty. ### Where Privy wins - One vendor for users and agents. Embedded wallets, server wallets, and policies share a console. - Audit depth. Four named audit firms and a public bounty programme. - Free tier. 50,000 signatures a month covers most early agent workloads. ### Where Coldstar wins - Offline, owner-held root. No API key or console login can reach it. - Single enforcement point. Every rule is evaluated locally before a signature exists; there is no API-layer versus enclave split. - Escalation. Over-threshold transactions go to a human over QR instead of being silently denied or, worse, silently allowed. ### What you are trusting Privy's design splits the key so that neither its servers nor your app hold the whole thing, and recombines it inside a TEE. That is a sound consumer-wallet architecture. Its policy documentation is candid that some checks, such as transfer-size limits that require simulation, run at the API level. Those rules are only as strong as the API boundary. Coldstar has one boundary: the offline machine that holds the encrypted root and evaluates the policy. Amount limits, allowlists, and the daily cap are checked there, first match wins, and only then does a signature exist. An agent never has anything to exfiltrate but a bounded session key. Privy is production, audited, and now part of Stripe. Coldstar is beta and pre-audit. Weigh maturity against where you want the root. ### FAQ Q: Is Privy custodial? A: Privy describes itself as non-custodial: key shares are split and only recombined inside its TEE, and it says it cannot sign alone. The key material still lives on Privy-run infrastructure. Coldstar's root lives on your drive. Q: Where does Privy enforce policies? A: Its docs say the TEE enforces policies but that some, such as transfer-size limits, are enforced at the API level. Coldstar enforces everything locally on the signing machine. Q: Does Privy have a daily spending cap? A: Not documented at review time. Coldstar's policy includes one. ### Sources - Privy policies overview (fields, operators, enforcement notes): https://docs.privy.io/controls/policies/overview - Privy agentic wallets recipe: https://docs.privy.io/recipes/agent-integrations/agentic-wallets - Privy security (Shamir, TEE, audits, SOC 2): https://www.privy.io/security - Privy pricing: https://www.privy.io/pricing - Privy: acquisition by Stripe: https://privy.io/blog/announcing-our-acquisition-by-stripe ## Coldstar vs Crossmint: Crossmint alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-crossmint Category: Agent-safe signing · Smart-contract agent wallets Crossmint's agent wallets put the rules on-chain: a smart wallet with two signers, where the owner has full control and the agent's TEE-held key can only act within limits the contract enforces. It is the hosted design closest to Coldstar's, and the differences are exactly where the two keys live. ### Pick Crossmint if - You want limits enforced by a smart-wallet program that anyone can verify on-chain. - You need cards, fiat rails, and stablecoin payments in the same integration. - You want an EU MiCA-authorised, SOC 2 vendor. ### Pick Coldstar if - You want the agent's signer under your control too, not in a vendor TEE. - You want a plain Solana keypair with no smart-wallet program dependency. - You want human escalation over QR for out-of-policy transactions rather than a hard on-chain wall. ### Use both when Coldstar as the cold owner signer for a Crossmint smart wallet is a natural fit if Crossmint exposes owner signing that way; check their docs for your chain. ### Side by side (Coldstar | Crossmint) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Split: the owner signer is held by you (a person or company) with full control; the agent signer is held in Crossmint's TEE with scoped control. Owner can revoke. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Owner key: wherever you keep it. Agent key: Crossmint's TEE (vendor not named). Rules: on-chain in the wallet contract. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Per-transaction limits, rolling caps, allowlisted recipients, time windows, "or any other policy the owner configures", enforced by the smart contract at the wallet level. Exact Solana rule set not detailed on the docs overview. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Reverted by the contract. Owner retains full control and can revoke the agent. Cards offer spend limits and human approval; a wallet-level approval queue is not documented. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | Possible in principle: the owner signer is customer-held, so it could be a cold key. Not documented as a product feature. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Agent Wallets plus Agentic Cards and x402; white-label SDK that plugs into agent frameworks as a tool. Solana Agent Kit ships a Crossmint example. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: agent wallets on EVM, Solana, and Stellar. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | SDKs public; wallet contract and audit status not confirmed on the fetched pages. Hosted. - Pricing: Free software plus a ~$10 drive. | Free for 1,000 monthly active wallets; then from $0.05 per active wallet with volume discounts; enterprise custom. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; SOC 2 Type II; MiCA CASP authorisation. ### Where Crossmint wins - On-chain enforcement. The limit is in the contract, so it holds even if every off-chain component is compromised. - Payments stack. Cards, fiat, and stablecoin rails alongside the wallet. - Compliance posture. SOC 2 and MiCA authorisation for teams that need them. ### Where Coldstar wins - Both keys yours. Root cold on your drive, session key disposable on your host; no vendor TEE in the path. - No smart-wallet dependency. Plain Solana keypairs; nothing to upgrade or trust in a wallet program. - Escalation instead of a wall. Over-threshold transactions can be approved by a human over QR. ### What you are trusting Crossmint's two-signer model is a good one. The owner holds full control; the agent's key is scoped by the wallet contract and lives in Crossmint's TEE. You are trusting the wallet program, Crossmint's enclave operation for the agent key, and your own custody of the owner key. Limits that live on-chain are verifiable by anyone, which is a genuine advantage. Coldstar keeps both halves on your side. The air-gapped root signs a policy envelope; the agent's session key is disposable and lives on a host you run; the policy is evaluated locally before any signature exists. There is no program to audit and no vendor on the signing path, at the cost of on-chain verifiability of the limits. Crossmint is production and certified. Coldstar is beta, pre-audit. ### FAQ Q: Who holds the agent key with Crossmint? A: Crossmint, inside a TEE, scoped by the on-chain wallet rules. The owner key is yours. With Coldstar, the root is yours and offline, and the agent's session key runs on your own host. Q: Are on-chain limits better than local policy? A: They are verifiable by third parties and survive compromise of off-chain components. Local policy is faster to change, can include escalation to a human, and does not depend on a smart-wallet program. Many teams will want both, using Squads spending limits for the on-chain ceiling. Q: Does Coldstar work with Crossmint? A: Not as an integration today. If Crossmint's owner signer can be an external Solana keypair, a Coldstar-held key could serve as the cold owner. ### Sources - Crossmint docs: agent wallets overview: https://docs.crossmint.com/solutions/ai-agents/agent-wallets/overview - Crossmint: agentic payments: https://www.crossmint.com/solutions/agentic-payments - Crossmint: agent wallets compared (two-signer model): https://www.crossmint.com/learn/agent-wallets-compared - Crossmint pricing: https://www.crossmint.com/pricing - Crossmint wallet infrastructure (SOC 2, MiCA): https://www.crossmint.com/products/wallet-infrastructure ## Coldstar vs Coinbase CDP Wallets: Coinbase CDP Wallets alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-coinbase-cdp Category: Agent-safe signing · Hosted enclave signer + AgentKit Coinbase's developer platform pairs Server Wallets in AWS Nitro Enclaves with AgentKit, the most widely integrated open agent framework, and prices it per operation. Coldstar is what you use when the agent's authority should not originate in Coinbase's cloud, even a very well-run one. ### Pick Coinbase CDP Wallets if - You want the cheapest metered path with a real Solana rule set and an Apache-2.0 agent framework. - You want x402, onramp, and Coinbase adjacency. - You are comfortable with Coinbase as the always-online root. ### Pick Coldstar if - You want the root on your own hardware, offline. - You need cumulative caps, time windows, or human escalation. CDP's Solana policies are per-transaction only. - You do not want a rotatable cloud secret to be the thing standing between an attacker and your agent's funds. ### Use both when AgentKit as the agent framework with Coldstar as the wallet provider is a clean split: Coinbase's tooling, your root. ### Side by side (Coldstar | Coinbase CDP Wallets) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Coinbase's enclaves. Private-key operations happen inside the enclave boundary, not accessible to CDP, AWS, or other components per Coinbase. The developer holds a rotatable P-256 Wallet Secret that authorises writes. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | AWS Nitro Enclaves: no persistent storage, no interactive access, no external networking. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Solana criteria: recipient address in/not-in, SOL value ≤, mint address, program ID, SPL address and value range, message regex, network; Anchor IDL policies. Project or account scope. No daily or cumulative limits, no time windows. Where evaluation runs is not stated on the policy pages. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Denied. No per-transaction human approval documented; 2FA protects developer credentials. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No. Online Nitro service. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | AgentKit (Apache-2.0): LangChain, Vercel AI SDK, MCP, OpenAI Agents SDK; wallet providers CDP, Privy, viem; TypeScript and Python; EVM and SVM. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: sign and send Solana transactions, sponsored transactions, Solana policy criteria. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | AgentKit and cdp-sdk open; enclave code closed; customer verification of attestation not documented. Hosted only. - Pricing: Free software plus a ~$10 drive. | $0.005 per wallet write operation (create, sign, broadcast, policy evaluation); 5,000 free operations per month; reads free. Figures from a first-party search snippet; the pricing page returned 403 to our fetch. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; audits or SOC 2 not stated on the security page we fetched. ### Where Coinbase CDP Wallets wins - AgentKit. The widest open framework coverage for agent tooling, with pluggable wallet providers. - Cheap and metered. Half a cent per write operation with a free monthly allowance. - Nitro isolation with a clearly documented enclave boundary. ### Where Coldstar wins - Root you hold. No Wallet Secret, console, or cloud account can produce a root signature. - Richer limits. Daily cap, escalate threshold, and human approval over QR; CDP documents per-transaction rules only. - No provider on the signing path. Free, MIT, self-hosted. ### What you are trusting CDP's design is clean: keys live and sign inside Nitro Enclaves, and your backend authorises operations with a rotatable secret. The enclave protects the key from Coinbase's own staff and from AWS. What it cannot protect is the secret in your backend: whoever holds it can drive the wallet within policy, and policy is per-transaction only. Coldstar assumes the backend will eventually be compromised and bounds the damage. The root is offline on your drive; the agent's session key is disposable; the daily cap and allowlists are enforced before any signature exists; anything over the escalate threshold waits for a human with a phone and a QR code. CDP is production infrastructure from a public company. Coldstar is beta, pre-audit. ### Using Coinbase CDP Wallets and Coldstar together AgentKit supports multiple wallet providers. A Coldstar policy-gated session key can back an AgentKit agent, giving you Coinbase's tooling with an owner-held cold root. ### FAQ Q: Is a CDP Server Wallet self-custodied? A: Coinbase markets it that way: keys exist only in its enclaves and it states they are not accessible to CDP. Operationally, the key is on Coinbase-run infrastructure and your backend holds the secret that authorises use. Coldstar's root is a file on a drive you own. Q: Does CDP have spending caps over time? A: Its documented Solana policy criteria are per-transaction: value thresholds, address and program lists, regex on messages. No daily or rolling caps at review time. Q: Can I keep AgentKit and use Coldstar? A: Yes. AgentKit's wallet-provider abstraction is designed for that, and Coldstar's session key can serve as the provider. ### Sources - CDP Server Wallets v2 security (Nitro Enclaves): https://docs.cdp.coinbase.com/server-wallets/v2/introduction/security - CDP Solana policies: https://docs.cdp.coinbase.com/wallets/security-and-policies/policy-engine/solana-policies - AgentKit source (Apache-2.0): https://github.com/coinbase/agentkit - cdp-sdk source: https://github.com/coinbase/cdp-sdk - CDP pricing: https://www.coinbase.com/developer-platform/pricing ## Coldstar vs Dfns: Dfns alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-dfns Category: Agent-safe signing · Institutional wallet-as-a-service Dfns is built for institutions: MPC signer nodes in enclaves, velocity limits, sanctions screening, travel-rule integration, and approval groups with quorums. It is the most complete escalation model of the hosted signers. It is also priced and shaped for a compliance team, not for an agent developer. ### Pick Dfns if - You are a regulated business that needs KYT screening, travel rule, and M-of-N approval groups. - You want velocity limits (value and count per window) enforced by the platform. - You want SOC 2, ISO 27001, and named audit firms, and can budget from $800 to $35,000 a year. ### Pick Coldstar if - You want an owner-held offline root rather than vendor-run MPC nodes with an undisclosed threshold. - You are one team or one operator running agents, not a compliance department. - You want free, open-source, self-hosted. ### Use both when Dfns for the regulated operating accounts; Coldstar for the cold reserve behind them. ### Side by side (Coldstar | Dfns) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Dfns-operated MPC/TSS nodes. The security page does not disclose the threshold or whether customers hold a share. "Break-the-glass" key export is offered. Delegated (end-user) wallets bypass the policy engine entirely. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | MPC signer nodes inside AWS Nitro Enclaves; Intel SGX, IBM, Thales HSM, and on-prem options on request. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Rules: transaction amount limit (USD and nominal), amount velocity and count velocity per time window, recipient whitelist, Chainalysis and travel-rule screening. Actions: block or request approval. Program- or instruction-level Solana rules not listed. Enforcement at the policy layer; not stated as in-enclave. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Held for approval by one or more approval groups, each with its own quorum; all must pass. The strongest escalation model in this set. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No air-gapped root. On-prem and HSM deployments exist for enterprise. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | No dedicated agent product or docs found. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes, including durable nonces. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | Cryptographic libraries donated to the Linux Foundation; service code closed. Hosted or enterprise on-prem. - Pricing: Free software plus a ~$10 drive. | Starter $800/year (10 wallets, 100 signatures/month); Basic $8,000/year; Pro $35,000/year; Enterprise custom. No AUM or per-transaction fees. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; SOC 2 Type II (KPMG), ISO 27001; audits by Kudelski, Halborn, Redacted. ### Where Dfns wins - Approval quorums. Multi-group M-of-N holds on transactions. - Compliance tooling. KYT, travel rule, ISO 27001. - Velocity limits by value and count per window. ### Where Coldstar wins - Disclosed, simple trust model. One encrypted root on your drive; no undisclosed MPC threshold. - Cold root. Never on a networked machine. - Cost and openness. Free, MIT, self-hosted, versus a four- to five-figure annual subscription. ### What you are trusting Dfns runs the signer nodes. Its security page does not say how many shares exist or whether you hold one, and it notes delegated wallets skip the policy engine. For an institution buying a compliant service with contracts and audits behind it, that is a normal arrangement. For a developer trying to bound an agent, it is a lot of surface you do not control. Coldstar's arrangement is explicit: one ciphertext root on a drive in your possession; local policy with limits, allowlists, and a daily cap; escalation to a human over QR. You can read all of it. Dfns is production, certified, and audited. Coldstar is beta, pre-audit. ### FAQ Q: Does Dfns have an AI-agent product? A: We did not find one on its first-party pages at review time. Its API supports programmatic signing under policy, which an agent could use. Q: Who holds the key with Dfns? A: Dfns-operated MPC nodes in enclaves. The threshold and customer share are not disclosed on the security page. Break-the-glass export is offered. Q: Which has better escalation? A: Dfns, for institutional workflows: multi-group quorums. Coldstar has a single escalate-to-human step over QR, which is what a small team actually operates. ### Sources - Dfns security model (Nitro Enclaves, MPC, certifications): https://docs.dfns.co/core-concepts/dfns-security-model - Dfns policy engine (rules and actions): https://docs.dfns.co/d/api-docs/policy-engine - Dfns: Solana broadcast (durable nonces): https://docs.dfns.co/d/api-docs/wallets/broadcast-transaction/solana - Dfns pricing: https://www.dfns.co/pricing ## Coldstar vs Cubist CubeSigner: Cubist CubeSigner alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-cubist Category: Agent-safe signing · HSM + enclave signer CubeSigner is what staking operators and bridges use when they need arbitrary policy code to run next to the key: HSM-sealed keys, Nitro Enclaves, and a programmable policy engine that executes your Rust or Wasm inside the TEE. Coldstar is a smaller idea, aimed at agents and treasuries rather than validators. ### Pick Cubist CubeSigner if - You need custom policy logic (Rust/Wasm) executed inside a TEE, with complete mediation. - You need MFA quorums (N approvers) and HSM-backed key sealing for high-value infrastructure. - You are running staking, bridges, or exchange hot wallets. ### Pick Coldstar if - You want the root offline and in hand, not sealed in a vendor's HSM. - You want a fixed, readable rule set rather than a policy runtime to maintain. - You want free and self-hosted, with a documented agent story. ### Use both when CubeSigner for validator and protocol infrastructure; Coldstar for the operator treasury and agents that spend from it. ### Side by side (Coldstar | Cubist CubeSigner) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Cubist's enclaves. Only the enclave can access keys in the HSM; Cubist says not even its administrators can see keys. Imported keys encrypt directly to the enclave; cold-storage backup ciphertexts decrypt only for the owner. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | AWS Nitro Enclaves plus KMS and FIPS 140 HSMs, TPM 2.0 attestation; explicitly not Intel SGX. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Built-ins: receiver allowlist, RequireMfa with approver count and MFA types. Programmable Policy Engine runs custom Rust/Wasm in the TEE. Signature issued only if all checks pass. Solana instruction-level built-ins not confirmed. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Denied, or held for MFA by N approvers. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No offline signing root. Owner-decryptable cold backup ciphertexts exist. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | No dedicated AI-agent product or docs found. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: SDK supports Bitcoin and Solana alongside EVM. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | SDKs public; enclave and policy runtime closed. Hosted. - Pricing: Free software plus a ~$10 drive. | Not public; contact sales. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; audited by Veridise (ongoing); SOC 2 referenced. ### Where Cubist CubeSigner wins - Arbitrary policy code in a TEE with complete mediation. - HSM sealing and attestation at infrastructure grade. - MFA quorums for high-value approvals. ### Where Coldstar wins - Cold, owner-held root. Nothing in a vendor HSM. - Simple, auditable rules instead of a policy runtime. - Free and documented for agents; CubeSigner publishes no pricing and no agent story. ### What you are trusting CubeSigner's promise is complete mediation: every signature passes through policy code executing inside an attested enclave, with the key sealed in an HSM. That is a strong model for infrastructure that must sign constantly and cannot have a human in the loop. You trust Cubist's enclave operation and your own policy code. Coldstar's promise is that the root is never reachable: it lives encrypted on a drive, signs a policy envelope offline, and the agent works from a disposable session key under a short, fixed rule list evaluated locally. Less power, less to get wrong, nothing to attest. CubeSigner is production and audited. Coldstar is beta, pre-audit. ### FAQ Q: Is CubeSigner overkill for an agent? A: For most agents, yes; it is built for validators, bridges, and exchanges. Its programmable policies would work for agents, but Cubist publishes no agent documentation or pricing. Q: Can Coldstar run custom policy code? A: No. Coldstar's policy is a fixed, ordered rule list: blocklist, program allowlist, escalate threshold, per-transaction limit, recipient allowlist, daily cap. That is deliberate; a rule list is easier to audit than a runtime. Q: Which is more secure? A: Different jobs. CubeSigner defends an always-online key with hardware and attestation. Coldstar keeps the root offline and limits what the online part can do. ### Sources - Cubist product security (Nitro, KMS, HSM, TPM): https://cubist.dev/product-security - Cubist programmable policy engine: https://cubist.dev/products/programmable-policy-engine - CubeSigner architecture blog: https://cubist.dev/blog/cubesigner-key-management-technical-design-and-architecture - CubeSigner TypeScript SDK (Solana support): https://github.com/cubist-labs/CubeSigner-TypeScript-SDK ## Coldstar vs Para: Para alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-para Category: Agent-safe signing · MPC embedded wallets Para is an embedded-wallet vendor with a real agents page: pregenerated wallets, transfer limits, chain restrictions, and a permissions system with default deny. Its 2-of-2 MPC assumes a human's device holds the second share. Coldstar assumes there is no human device in the loop and puts the root offline instead. ### Pick Para if - You are building a consumer app and want user wallets where the user's device is the second factor. - You want scoped permissions users consent to at grant time. - You want a hosted vendor with SOC 2 and a free tier to 1,200 monthly users. ### Pick Coldstar if - You are running headless agents with no user device to hold a share. - You want policy enforced on the signing machine rather than at a vendor API layer. - You want an owner-held cold root and no per-user pricing. ### Use both when Para for your users' wallets; Coldstar for the agents and treasury on your side of the product. ### Side by side (Coldstar | Para) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | 2-of-2 MPC: one share on the user's device, one in Para's cloud HSMs; both needed, so Para cannot sign alone. For agent and pregenerated wallets, who holds the "user" share is not documented. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Para cloud HSMs (TEE vendor not named) plus user device. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Policies → scopes → permissions, default deny: value caps, recipient allowlists, per-chain scoping, function-level restrictions. Enforced server-side before the MPC ceremony, at the API layer. Daily caps and time windows not confirmed. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Denied. User consent at scope grant; no per-transaction human approval queue documented. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Agents page: REST API, wallet pregeneration, transfer limits, chain restrictions, spending conditions; customers include ElizaOS. Solana Agent Kit ships a Para example. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: EVM, Solana, Cosmos; Swig smart-account integration on Solana. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | SDKs public; MPC code closed. Hosted. - Pricing: Free software plus a ~$10 drive. | Free to 1,200 monthly active users; Starter $200/month (2,500); Growth $500/month (10,000); Scale $1,000/month (25,000); Enterprise custom. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; SOC 2 Type II. ### Where Para wins - User-centric MPC. The user's device is a real second factor for consumer wallets. - Consent UX. Scopes users approve, with default deny. - Free tier that covers early consumer traction. ### Where Coldstar wins - Built for headless. No user share required; the offline root and a disposable session key are the two factors. - Local enforcement. Policy runs on the signing machine, not at a vendor's API boundary. - No MAU pricing. Free software. ### What you are trusting Para splits the key between a user's device and its HSMs and evaluates permissions server-side before the signing ceremony. For a consumer wallet that is sensible: the user's phone is a real second factor. For an agent, the question is who holds the device share, and Para's docs do not say. Coldstar's two factors are the offline root and the disposable session key it authorises. The policy that bounds the session key is evaluated locally, before a signature exists; the root never goes online. Para is production and SOC 2 certified. Coldstar is beta, pre-audit. ### FAQ Q: Who holds the second MPC share for a Para agent wallet? A: Para's docs describe the user-device share for consumer wallets; for pregenerated and agent wallets the holder of that share was not documented at review time. Q: Where does Para enforce policies? A: Server-side, before the MPC signing ceremony, so they cannot be bypassed client-side. That is an API-layer control. Coldstar enforces policy on the signing machine itself. Q: Can I use Para and Coldstar together? A: Yes, in different places: Para for your users' embedded wallets and Coldstar for your own agents and treasury. ### Sources - Para security (2-of-2 MPC, HSMs, SOC 2): https://docs.getpara.com/v2/concepts/security - Para permissions concepts: https://docs.getpara.com/v2/concepts/permissions - Para for agents: https://www.getpara.com/agents - Para pricing: https://www.getpara.com/pricing - Para: Solana smart accounts (Swig): https://blog.getpara.com/solana-smart-accounts/ ## Coldstar vs Fireblocks: Fireblocks alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-fireblocks Category: Agent-safe signing · Institutional custody Fireblocks is the incumbent for institutions: MPC across SGX enclaves, a policy engine that gates every signature, qualified custody, and now an agentic payments suite with an open-source x402 agent. It starts at $999 a month. Coldstar is for everyone below that line, and for anyone who wants the root in their own hands. ### Pick Fireblocks if - You are a regulated institution needing qualified custody, KYT, travel rule, insurance-grade process, and SLAs. - You want designated approvers above an auto-sign threshold, velocity caps, and whitelists managed by a compliance team. - You have a five- or six-figure annual budget for custody infrastructure. ### Pick Coldstar if - You want the root offline on hardware you own, not shares in a vendor's SGX fleet. - You are a team, DAO, or developer running agents, not a bank. - You want free, open-source, self-hosted. ### Use both when Fireblocks for the regulated operating layer; Coldstar for the cold reserve and the experiments that don't need a custodian. ### Side by side (Coldstar | Fireblocks) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Fireblocks holds MPC-CMP key shares alongside shares on customer devices; every signature passes its policy engine. Offers both direct custody and qualified custody. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Shares across multiple Intel SGX trusted execution environments; a cold-wallet add-on exists on the pricing page (mechanism not detailed). - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Transaction Authorization Policy: who can move funds, per-transaction caps, per-period velocity caps, designated approvers above an auto-sign threshold, destination whitelists, ordered rules. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Held for designated approvers, or blocked. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No air-gapped root documented; cold-wallet add-on unspecified. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Agentic Payments Suite: x402 facilitator, agentic wallets with delegated authority, KYT and travel rule. Open-source x402 agent (MCP and CLI) where "the agent never holds keys"; the example is Base USDC, not Solana. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: policies apply across Bitcoin, Ethereum, Solana, and 150+ networks. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | MPC-CMP algorithm and the x402 agent are open source; the platform is closed. Hosted. - Pricing: Free software plus a ~$10 drive. | Essentials $999/month (self-serve, $1M quarterly outbound, 0.20% overage). Pro and Enterprise from $36,000/year. Free developer sandbox. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; the institutional market leader. ### Where Fireblocks wins - Institutional completeness. Qualified custody, compliance, approvals, and insurance-grade operations. - Policy maturity. Velocity caps and approver workflows a compliance team can run. - Agentic suite with delegated authority and an open-source agent reference. ### Where Coldstar wins - Root in your hands. No custodian, no SGX fleet, no account. - Accessible. Free and MIT-licensed versus $999 a month to start. - Air-gapped escalation. The human approval step happens on a device with no network. ### What you are trusting Fireblocks distributes key shares across SGX enclaves and its customers' devices, and enforces a policy on every signature. It carries the compliance, audit, and insurance posture regulated institutions require. You are trusting Fireblocks' enclaves, its operations, and the SGX security model, and you are paying for that trust to be contractual. Coldstar does not ask you to trust an operator. The root is an encrypted file on your drive; it signs a policy envelope offline; the agent works within it under a local rule list with a daily cap and an escalate threshold. It is not qualified custody, and it does not pretend to be. Fireblocks is the market leader in production. Coldstar is beta, pre-audit. ### FAQ Q: Does Fireblocks have an agent product? A: Yes: an Agentic Payments Suite with agentic wallets and an open-source x402 agent whose design keeps keys away from the agent. The published example is Base USDC; Solana is supported by the platform generally. Q: Is Fireblocks self-custody? A: It offers both direct custody (MPC shares partly on your devices, signing gated by its policy engine) and qualified custody. Either way Fireblocks operates the enclaves. Coldstar's root never leaves your possession. Q: Why would a small team pick Coldstar over a Fireblocks sandbox? A: The sandbox is free for development, but production starts at $999 a month. Coldstar is free, and for a team without regulatory obligations the custodian adds cost and a dependency without adding a colder root. ### Sources - Fireblocks: what is MPC (MPC-CMP, SGX, Solana): https://www.fireblocks.com/what-is-mpc/ - Fireblocks: Transaction Authorization Policy: https://developers.fireblocks.com/docs/set-transaction-authorization-policy - Fireblocks: agentic payments: https://www.fireblocks.com/products/agentic-payments - Fireblocks: x402 agent (open source): https://developers.fireblocks.com/docs/x402-agent - Fireblocks pricing: https://www.fireblocks.com/pricing/ ## Coldstar vs Fordefi: Fordefi alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-fordefi Category: Agent-safe signing · Institutional MPC wallet Fordefi is the institutional wallet for DeFi-heavy funds: two-share MPC where you run one share in a self-hosted API Signer and Fordefi runs the other in Nitro Enclaves, with ordered policies that allow, block, or require approval. It is the closest an institutional product gets to "a share the vendor can't use alone". Coldstar removes the vendor share entirely. ### Pick Fordefi if - You are a fund or desk that needs transaction simulation, quorum approvals, and a co-signer the vendor cannot use alone. - You want a self-hosted signer component (Docker or Helm) without building enclave infrastructure. - You have SOC 2 and pentest requirements and a budget for a subscription. ### Pick Coldstar if - You want no vendor share at all: one owner-held offline root. - You need the whole stack open source and free. - You are running agents or a DAO treasury, not a fund's operations desk. ### Use both when Fordefi for the trading vault under compliance; Coldstar for the cold reserve and for agents that don't justify a subscription. ### Side by side (Coldstar | Fordefi) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Split: the customer's share lives in a mobile hardware enclave or a customer-run API Signer; Fordefi's share lives in AWS Nitro Enclaves. Fordefi cannot sign alone. Self-custody. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Customer share on device or in your API Signer container; Fordefi share in Nitro Enclaves. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Ordered rules on amount, initiator, vault, destination and address book, asset, and dApp; actions Allow, Block, or Require Approval with quorum or approver-group combinations; AML-alert policies. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Held for approval by the configured quorum or approver groups, or blocked. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No air-gapped root. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | REST API plus self-hosted API Signer for unattended signing; MPC SDK for wallet-as-a-service. No AI-agent product on the docs we fetched. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: Solana mainnet, Eclipse, Fogo; SOL and SPL; Wallet Standard. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | Closed source. SOC 2 Type II (EY); pentests by NCC Group and Skylight Cyber. Hosted co-signer with a self-hosted signer component. - Pricing: Free software plus a ~$10 drive. | Not public; sales contact. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; institutional client base. ### Where Fordefi wins - Vendor cannot sign alone, and you run a share yourself in your own container. - Institutional workflow. Simulation, address books, quorum approvals, AML alerts. - Assurance. SOC 2 by EY and named pentest firms. ### Where Coldstar wins - No vendor share. One root, offline, yours. - Open and free. MIT-licensed, self-hosted end to end. - Air-gapped escalation for over-threshold transactions. ### What you are trusting Fordefi splits the key so that its Nitro co-signer and your API Signer must cooperate. A compromise of Fordefi alone cannot move funds; a compromise of your signer alone cannot either. You still depend on Fordefi's availability and policy layer for every transaction, and the arrangement is a subscription. Coldstar has no co-signer. The root is one encrypted file on your drive, used offline to sign a policy envelope; the session key that acts inside it is disposable and bounded by a local rule list. Availability depends on nothing but your own machines. Fordefi is production infrastructure with independent assurance. Coldstar is beta, pre-audit. ### FAQ Q: Is Fordefi's API Signer the same as self-hosting? A: You self-host one MPC share in Fordefi's container; the other share and the policy layer run on Fordefi's infrastructure. Coldstar is self-hosted end to end. Q: Does Fordefi have an agent product? A: Not on the docs we fetched at review time. Its API Signer supports unattended, policy-gated signing, which an agent could use. Q: Can Fordefi's root be air-gapped? A: No; both shares must be reachable to sign. Coldstar's root signs a policy envelope offline and is not needed for routine transactions. ### Sources - Fordefi docs: set up an API Signer (customer-held share): https://docs.fordefi.com/developers/getting-started/set-up-an-api-signer - Fordefi docs: product security (Nitro Enclaves): https://docs.fordefi.com/user-guide/welcome/product-security - Fordefi docs: policies: https://docs.fordefi.com/user-guide/policies - Fordefi docs: supported blockchains (Solana): https://docs.fordefi.com/user-guide/manage-chains/supported-blockchains - Fordefi homepage (SOC 2, pentests): https://fordefi.com/ ## Coldstar vs a private key in .env: the safer default for AI-agent wallets on Solana URL: https://coldstar.dev/compare/coldstar-vs-private-key-in-env Category: Agent-safe signing · The default This is the real incumbent. Solana Agent Kit, ElizaOS, and GOAT all start the same way: a base58 secret in SOLANA_PRIVATE_KEY, decoded with Keypair.fromSecretKey, held in the agent's process. It works in ten minutes. It also means one prompt injection, one leaked log, or one bad dependency is the whole wallet. ### Pick a private key in .env if - It is a devnet key and nothing of value is behind it. - You are prototyping and will replace it before mainnet. - You have deliberately capped the balance to what you can afford to lose today. ### Pick Coldstar if - The agent touches real funds. - The agent reads anything an attacker can write: web pages, emails, tool outputs, other agents. - You want the blast radius of a compromised agent to be a policy, not a balance. ### Use both when Keep the .env key for devnet. On mainnet the agent gets a Coldstar session key bounded by policy, and the root stays on the drive. ### Side by side (Coldstar | a private key in .env) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | The agent process. Whatever runs the model holds the full secret; so does anything that can read its memory, environment, or logs. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | An environment variable, a .env file, a secrets manager, a container image layer. Solana's cookbook warns never to embed it client-side or commit it, and points production users to a key-management backend. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | None. Any transaction the agent builds, it can sign. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | There is no such thing; every transaction is in policy. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No. The key is on an online host by definition. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Universal: Solana Agent Kit's KeypairWallet, ElizaOS's Solana plugin, GOAT's examples all read SOLANA_PRIVATE_KEY. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | Free; it is the Solana SDK. - Pricing: Free software plus a ~$10 drive. | Free. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | It is how most agents run today, and how most agent wallets get drained. ### Where a private key in .env wins - Zero setup. Copy a string, run the agent. - Zero latency and no extra process. - Every tutorial assumes it. ### Where Coldstar wins - Bounded blast radius. A hijacked agent can spend up to the per-transaction limit and daily cap, to allowlisted programs and recipients, and nothing else. - No root on the host. The root is encrypted on a drive, offline; the agent holds a disposable session key. - Escalation. Anything over the threshold waits for a human over air-gapped QR; a blocklisted recipient gets no signature at all. ### What you are trusting An agent with a raw key is trusting every input it reads. A malicious string in a web page, a tool result, or another agent's message can instruct it to send everything to an attacker, and the key in its process will oblige. Logs, crash dumps, and container layers can leak the key without any injection at all. Solana's own cookbook tells developers not to ship this to production. Coldstar turns the agent into a proposer. It builds transactions and hands them to the signer; the signer evaluates a fixed rule list, first match wins: blocklist, program allowlist, escalate threshold, per-transaction limit, recipient allowlist, daily cap. Allowed transactions are signed by a disposable session key that the cold root authorised offline. Rejected transactions never get a signature. Over-threshold transactions wait for a human. Coldstar is beta and pre-audit. It is still categorically safer than a root key in an environment variable, because the failure mode changes from "lose everything" to "lose at most the policy". ### Using a private key in .env and Coldstar together Every major Solana agent framework has a wallet abstraction. Coldstar ships one for Solana Agent Kit (ColdstarWallet, MIT); implement the same five methods for any other framework and the rest of your agent code does not change. ### FAQ Q: My agent only reads trusted sources. Isn't a raw key fine? A: Trusted sources get compromised, dependencies get hijacked, and logs get shipped to third parties. Policy is cheap insurance against the day your assumption fails. Q: Will a policy signer slow my agent down? A: Routine transactions are signed by the session key on the same host, so latency is a local policy check. Only over-threshold transactions wait for a human. Q: Which frameworks default to a raw key? A: Solana Agent Kit (SOLANA_PRIVATE_KEY into KeypairWallet), ElizaOS's Solana plugin (SOLANA_PRIVATE_KEY, with a fallback that generates and stores a key if none is set), and GOAT SDK's examples (SOLANA_PRIVATE_KEY). All three also let you plug in an external signer. Q: What does Coldstar do when an injected agent tries to drain the wallet? A: The recipient is not on the allowlist, or the amount exceeds the limit, or the daily cap is hit. The policy returns REJECT or ESCALATE. No signature exists for a rejected transaction. ### Sources - Solana cookbook: restore a keypair (handling warning): https://solana.com/developers/cookbook/wallets/restore-keypair - web3.js Keypair.fromSecretKey: https://solana-foundation.github.io/solana-web3.js/classes/Keypair.html - Solana Agent Kit README (SOLANA_PRIVATE_KEY, KeypairWallet): https://github.com/sendaifun/solana-agent-kit - ElizaOS Solana wallet plugin (env.example, keypairUtils): https://github.com/elizaOS/eliza/tree/develop/plugins/plugin-wallet/src/chains/solana - GOAT SDK Solana example (Keypair.fromSecretKey from env): https://github.com/goat-sdk/goat/tree/main/typescript/examples/by-use-case/solana-send-and-receive-tokens - coldstar-agent-signer on npm / GitHub: the policy-gated replacement (MIT): https://github.com/ExpertVagabond/coldstar-agent-signer ## Coldstar vs Solana Agent Kit: a policy-gated wallet for Solana Agent Kit URL: https://coldstar.dev/compare/coldstar-vs-solana-agent-kit Category: Agent-safe signing · Agent framework Solana Agent Kit is the de-facto toolkit for connecting an LLM to Solana protocols: LangChain, Vercel AI, and OpenAI adapters, dozens of protocol plugins. It is not a signer. Its default wallet is a raw keypair in memory, and its BaseWallet interface exists precisely so you can replace that. Coldstar is a replacement. ### Pick Solana Agent Kit if - You need the protocol coverage: swaps, staking, NFTs, lending, and the rest, as agent tools. - You want framework adapters for LangChain, Vercel AI SDK, or OpenAI. - You are on devnet and the default KeypairWallet is fine for now. ### Pick Coldstar if - You are asking a different question: what signs. Coldstar answers that; Solana Agent Kit does not try to. - You want the agent's key bounded by policy with a cold root. - You want a signer that is not a hosted vendor. ### Use both when This is the intended pairing. Solana Agent Kit builds the transactions; a Coldstar-backed BaseWallet decides whether they get signed. ### Side by side (Coldstar | Solana Agent Kit) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | By default, the agent process: the README builds a KeypairWallet from Keypair.fromSecretKey(bs58.decode(SOLANA_PRIVATE_KEY)). The BaseWallet interface lets you substitute any signer. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | In-process memory and an environment variable by default. Examples ship for Turnkey, Privy, Crossmint, Para, and Phantom embedded wallets. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | None in core. Any policy comes from whatever signer you plug in. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Not applicable in core. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | It is the agent integration: tool adapters for the major frameworks and protocol plugins. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes; Solana only. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | Apache-2.0, fully open, self-hosted. - Pricing: Free software plus a ~$10 drive. | Free. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production toolkit with a large plugin ecosystem; v2 default branch. ### Where Solana Agent Kit wins - Coverage. The broadest set of Solana protocol actions as agent tools. - Adapters. LangChain, Vercel AI SDK, OpenAI, and more. - Pluggable wallets. BaseWallet makes the signer a swap-in. ### Where Coldstar wins - It is a signer. Policy, cold root, escalation; Solana Agent Kit has none of these by design. ColdstarWallet implements the kit's BaseWallet interface. - Self-hosted signer. The other shipped examples are hosted vendors. - Bounded default. Replacing KeypairWallet with a Coldstar session key turns "lose everything" into "lose at most the policy". ### What you are trusting Solana Agent Kit's BaseWallet interface is five methods: public key, sign transaction, sign all, sign and send, sign message. The shipped KeypairWallet implements them with a raw Keypair and tweetnacl, which is the right default for a toolkit and the wrong default for money. The maintainers know this; the embedded-wallet examples exist to move the key out of the process. A Coldstar-backed BaseWallet signs with a disposable session key inside a policy envelope the cold root authorised offline. Sign-transaction calls pass through the local rule list first; a REJECT returns no signature; an ESCALATE waits for a human over QR. Solana Agent Kit is production tooling. Coldstar is beta, pre-audit. ColdstarWallet implements BaseWallet today, with a devnet starter showing all three decisions against the kit. ### Using Solana Agent Kit and Coldstar together ColdstarWallet implements BaseWallet, so it drops in where KeypairWallet was and every plugin and adapter keeps working. Nothing above the wallet changes; the wallet just says no sometimes. ### FAQ Q: Is Solana Agent Kit insecure? A: No. It is a toolkit that, by default, signs with a keypair you give it. Security is the job of the signer you plug in; the kit makes that pluggable. Q: Which signers does Solana Agent Kit ship examples for? A: Turnkey, Privy, Crossmint, Para, and Phantom embedded wallets, plus the default KeypairWallet. All of the vendor options are hosted; Coldstar's ColdstarWallet is the self-hosted, cold-rooted one, MIT-licensed on GitHub. Q: Does Coldstar replace Solana Agent Kit? A: No. Coldstar has no protocol plugins or framework adapters. It replaces the wallet underneath them. ### Sources - Solana Agent Kit repository (README, KeypairWallet, BaseWallet, embedded-wallet examples): https://github.com/sendaifun/solana-agent-kit - SendAI docs: introduction: https://docs.sendai.fun/docs/v2/introduction - coldstar-agent-signer on npm / GitHub: ColdstarWallet source and tests (MIT): https://github.com/ExpertVagabond/coldstar-agent-signer ## Coldstar vs Lit Protocol: Lit Protocol alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-lit-protocol Category: Agent-safe signing · Decentralised key network Lit is the most ambitious design in this set: key authority defined in smart contracts, enforced by a sealed TEE that reads the chain on every request, and programmable conditions in JavaScript. Vincent layers agent delegation on top. Coldstar is the least ambitious: a file, an offline machine, and a short rule list. ### Pick Lit Protocol if - You want multichain (EVM, Solana, Bitcoin) programmable signing with no infrastructure of your own. - You want conditions expressed as code: sanctions screens, price thresholds, dispute windows. - You want an existing agent-delegation framework (Vincent) with user-facing consent. ### Pick Coldstar if - You want the root offline and in hand rather than authority anchored on Base and executed in a hosted TEE. - You want Solana as the first-class chain, not an Ed25519 wrapped key inside an EVM-anchored system. - You want a rule list you can read rather than a JavaScript runtime you must secure. ### Use both when Lit for cross-chain conditional signing in a product; Coldstar for the treasury root and the agents that spend your own funds. ### Side by side (Coldstar | Lit Protocol) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Lit's network. Current docs: key authority lives in contracts on Base; a sealed TEE reads them on every request; nothing off-chain, including Lit, can sign outside the on-chain rules. Solana historically via Wrapped Keys: threshold-encrypted Ed25519 keys decrypted inside a Lit Action, and exportable. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Attested TEE (Dstack stack); wrapped keys are encrypted blobs decrypted in-enclave. Whether PKPs are MPC-sharded across nodes or single-enclave was not stated on the fetched page. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Lit Actions: JavaScript conditions evaluated in the TEE, gated by on-chain scopes. Vincent adds Policies as guardrails on Abilities plus an on-chain app registry. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Signature refused by the enclave. Vincent's Connect Page handles grant-time user approval; per-transaction human escalation not documented. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No. Root of trust is on-chain plus TEE; self-hosting of nodes is documented. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Vincent: open framework for user-controlled agents and vaults, with delegated permissions. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes via Wrapped Keys and Sign-in-with-Solana; Vincent claims Solana, EVM, Bitcoin (its docs site was unreachable during review). - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | Core (API server, Actions runtime, contracts) published; TEE stack is Dstack; JS SDK MIT; crypto libraries Apache-2.0. Vincent repo showed no licence to GitHub's API. - Pricing: Free software plus a ~$10 drive. | Credit-based: $0.01 per second of management calls and Action execution, roughly $0.01 per signature; packages from $5; token discount; reads free. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production network; current architecture ("Chain Secured") is recent. ### Where Lit Protocol wins - Programmability. Any condition you can write in JavaScript, evaluated next to the key. - Multichain by design with one authority model. - Agent delegation framework already built (Vincent). ### Where Coldstar wins - Solana-native root. A plain Ed25519 keypair, offline, on your drive. - Auditable in minutes. Six ordered rules instead of a JS runtime and an on-chain registry. - No network dependency. Nothing to pay per second, nothing to be down. ### What you are trusting Lit asks you to trust a sealed TEE that reads authority from contracts on Base, the correctness of the Lit Action code that expresses your conditions, and for Solana the wrapped-key path where an Ed25519 secret is decrypted inside the enclave to sign. The upside is that rules are on-chain and the network is decentralised. The downside is surface area. Coldstar asks you to trust an encrypted file, an offline machine, and a short rule list evaluated locally. The agent holds a disposable session key; the root never goes online; anything over threshold waits for a human over QR. Lit is a production network. Coldstar is beta, pre-audit. ### FAQ Q: Is Lit non-custodial? A: Lit's current docs say no off-chain party, including Lit, can make a key sign outside the on-chain rules. The key material still lives inside Lit's TEE network. Coldstar's root lives on your drive. Q: How does Lit handle Solana? A: Through Wrapped Keys: an Ed25519 key that is threshold-encrypted and decrypted inside a Lit Action to sign, and that can be exported. Vincent also claims Solana support; its documentation site refused connections during our review. Q: Can Coldstar express conditions like price thresholds? A: No. Coldstar's policy is amounts, program and recipient lists, an escalate threshold, and a daily cap. If you need arbitrary conditions, Lit or Cubist are the tools. ### Sources - Lit docs: Chain Secured architecture: https://developer.litprotocol.com/architecture/chain-secured.md - Lit: Solana (Wrapped Keys): https://spark.litprotocol.com/solana/ - Vincent repository: https://github.com/LIT-Protocol/Vincent - Lit: user-owned guardrails for AI agents: https://spark.litprotocol.com/user-owned-guardrails-for-ai-agents/ - Lit pricing: https://developer.litprotocol.com/management/pricing.md ## Coldstar vs Openfort: Openfort alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-openfort Category: Agent-safe signing · Hosted TEE signer Openfort is the hosted signer whose Solana policy rules look most like Coldstar's: recipient lists, value limits, program IDs, and instruction data validated against an Anchor IDL, checked before a TEE-held key signs. The difference is that the key is in Google Cloud and the check runs in Openfort's backend. ### Pick Openfort if - You want Solana-aware rules including Anchor-IDL instruction validation from a hosted API with published pricing. - You want an agent-focused product with sub-200ms signing and a self-host option for the signer. - You are fine with key export and a cloud TEE as the root. ### Pick Coldstar if - You want the root offline and non-exportable by design. - You want policy enforced on the signing machine, not in a vendor backend. - You want the whole stack free and open. ### Use both when Openfort for app-side wallets under its policy API; Coldstar for the treasury root and the agents that spend from it. ### Side by side (Coldstar | Openfort) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Openfort's TEEs for hosted backend wallets, driven by your API key. Key export supported. Self-hosting via OpenSigner (MIT) and Shield (GPL-3.0, Shamir shares) is offered. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Google Cloud TEE hardware, or self-hosted OpenSigner/Shield. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Solana rules: recipient address, SPL address, SOL value, SPL value, mint address, program ID, instruction data against an Anchor IDL, network, message regex. Enforced by Openfort's backend on sign, send, sign-message, and sponsor calls. Marketing also lists limits, allowlists, anomaly detection, alerts, and multi-party approvals. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Denied. "Human in the loop" and multi-party approvals are claimed on the solutions page; docs detail not confirmed. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No offline root. Self-hostable signer only. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | AI-agents solutions page: spend limits, allowlists, secure signing, policy rules in one API. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: Solana mainnet-beta and devnet, EOA wallets (smart accounts are EVM-only). - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | OpenSigner MIT, Shield GPL-3.0, JS SDK Apache-2.0; the hosted policy engine and TEE service are not open. - Pricing: Free software plus a ~$10 drive. | Free for 2,000 operations per month, then $0.01 per operation; Growth $99/month; Pro $249/month; Scale $599/month; Enterprise custom including self-hosted. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; Solana support is recent relative to its EVM history. ### Where Openfort wins - Instruction-level validation against an Anchor IDL. - Agent-focused product with published pricing and fast signing. - Self-host option for the signer component. ### Where Coldstar wins - Non-exportable, offline root. Openfort supports key export from its TEE; Coldstar's root is never on a networked machine to export. - Local enforcement. The policy runs where the signature is made. - Fully open and free, including the policy engine. ### What you are trusting Openfort keeps backend-wallet keys in Google Cloud TEEs and checks its policy rules before signing. The design is sound and the Solana rule set is thorough. You trust Openfort's backend for enforcement, its TEE for the key, and your own API key hygiene; the key can be exported, which is convenient and also a capability an attacker would enjoy. Coldstar's root cannot be exported because it is never anywhere exportable: an encrypted file on a drive, decrypted into locked RAM offline for microseconds. The agent's session key is disposable, and the policy that bounds it is evaluated on the signing machine. Openfort is production. Coldstar is beta, pre-audit. ### FAQ Q: Does Openfort support Solana? A: Yes: mainnet-beta and devnet with EOA wallets and a Solana policy rule set. Smart accounts and the 4337 bundler remain EVM-only. Q: Can Openfort validate instruction data? A: Yes, against an Anchor IDL. Coldstar's policy works at the program and recipient level with amount limits; it does not decode instruction data against an IDL today. Q: Is OpenSigner the same as running Coldstar? A: OpenSigner is Openfort's open-source signer for self-hosting one component; the policy engine and TEE service remain Openfort's. Coldstar is self-hosted end to end with the root offline. ### Sources - Openfort docs: Solana policy rules: https://www.openfort.io/docs/configuration/policies/solana-rules - Openfort docs: chains (Solana mainnet-beta, devnet): https://www.openfort.io/docs/configuration/chains - Openfort: backend wallets (TEE, key export): https://www.openfort.io/blog/backend-wallets - Openfort: AI agents: https://www.openfort.io/solutions/ai-agents - Openfort pricing: https://www.openfort.io/pricing ## Coldstar vs Magic: Magic alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-magic Category: Agent-safe signing · Hosted TEE wallets Magic is a mature embedded-wallet vendor whose server wallets hold keys in AWS Nitro Enclaves and sign only with a short-lived operation token. It has Solana support and enterprise SLAs. It does not have a policy engine, and its keys are exportable. For an agent, that makes it a well-guarded hot key. ### Pick Magic if - You want hosted TEE wallets with JWT-bound signing and enterprise support for a consumer app. - You want Solana and Bitcoin alongside EVM from one vendor. - You can enforce limits in your own backend and only need the key held safely. ### Pick Coldstar if - You need the signer itself to enforce limits, allowlists, and caps. - You want a cold, non-exportable root. - You want an explicit agent story; Magic's docs have none beyond AI-assisted documentation. ### Use both when Magic for your users' embedded wallets; Coldstar for your own agents and treasury. ### Side by side (Coldstar | Magic) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Magic's enclaves. Server wallets sign only with a short-lived operation JWT bound to the identity at creation. Private key export is supported for both embedded and server wallets. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | AWS Nitro Enclaves with key sharding, hosted by Magic. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | None found in the documentation index: no spending limits, allowlists, or policy pages. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Not applicable; whatever holds the operation JWT can sign anything. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | None documented. The only AI reference is an MCP for browsing Magic's docs. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: embedded and server wallets support Solana. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | Not confirmed as open source. Hosted. - Pricing: Free software plus a ~$10 drive. | Free to 1,000 monthly active wallets, $0.045 per extra; Startup $99/month to 2,500; Enterprise custom, down to $0.001 per transaction. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; long-running vendor. ### Where Magic wins - Enclave-held keys with token-bound signing and enterprise support. - Multichain including Solana and Bitcoin. - Consumer onboarding maturity. ### Where Coldstar wins - A policy engine. Magic has none; Coldstar's is the point. - Non-exportable, offline root. - Agent-first design with escalation to a human. ### What you are trusting Magic's server wallets are a safe place to keep a key that your backend uses: Nitro isolation, sharding, and a short-lived JWT per operation. But there is no rule between the JWT and the signature. Compromise the backend that mints operation tokens and the enclave will sign whatever it is asked to, and the key can be exported. Coldstar puts the rule where the signature is made. The root is offline and cannot be exported; the agent's session key is bounded by limits, allowlists, and a daily cap evaluated locally; over-threshold transactions wait for a human. Magic is production. Coldstar is beta, pre-audit. ### FAQ Q: Does Magic have spending limits? A: We found none in its documentation at review time. Limits would have to live in your backend, in front of the operation-token minting. Q: Is a JWT-bound enclave key safe for an agent? A: It protects the key from theft at rest. It does not protect the funds from an agent that has been talked into spending them, because there is no policy between the request and the signature. Q: Can Coldstar keys be exported? A: The root is an encrypted file you already hold, so there is nothing to export from a vendor. It is never decrypted on a networked machine. ### Sources - Magic docs: server wallets core API overview (Nitro TEE, op_jwt): https://docs.magic.link/server-wallets/core-api/overview.md - Magic docs: export private key (server wallets): https://docs.magic.link/server-wallets/express-api/export-private-key.md - Magic docs: Solana (embedded wallets): https://docs.magic.link/embedded-wallets/blockchains/non-evm/solana.md - Magic pricing: https://magic.link/pricing ## Coldstar vs Web3Auth: Web3Auth alternative for AI-agent signing on Solana URL: https://coldstar.dev/compare/coldstar-vs-web3auth Category: Agent-safe signing · MPC embedded wallets Web3Auth, now MetaMask Embedded Wallets, is the social-login-to-Solana-key onboarding layer. Shares are split between the user's device and an auth network, then reconstructed on login into an Ed25519 key the app can use. That is good for onboarding humans. For an agent it means the agent ends up holding the root. ### Pick Web3Auth if - You are onboarding consumers with social login and need a Solana key per user. - You want the MetaMask brand and a free tier to 1,000 monthly active wallets. - You will enforce limits elsewhere. ### Pick Coldstar if - You are running an agent, not onboarding a person. - You need the signer to enforce policy. - You do not want the root reconstructed on an online client. ### Use both when Web3Auth for your users; Coldstar for your agents. They do not overlap. ### Side by side (Coldstar | Web3Auth) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Reconstructed on the client at login from a device share and an auth-network share; neither MetaMask nor the login provider can use one share alone. Full private-key export is supported and toggleable in the dashboard. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Shamir shares across device and auth network; the reconstructed key is exposed to the client app. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | None found. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Not applicable. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | None found. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: users receive an Ed25519 key suitable for Solana. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | SDKs on GitHub; licences not confirmed. Hosted auth network. - Pricing: Free software plus a ~$10 drive. | Free to 1,000 monthly active wallets plus $0.05 per extra; Growth $69/month for 3,000; Scale $399/month for 10,000; Enterprise custom. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; now part of MetaMask. ### Where Web3Auth wins - Onboarding. Social login to a Solana key in one step. - Distribution under the MetaMask brand. - Price for consumer scale. ### Where Coldstar wins - The root never reconstructs online. - Policy at the signer. - Designed for processes, not people. ### What you are trusting Web3Auth's MPC protects the key from the provider and the login service, which is the right threat model for a consumer who might lose a password. Once reconstructed on the client, though, the key is a normal secret in a normal process, and it can be exported. An agent using it is an agent with a raw key. Coldstar never reconstructs the root anywhere online. The agent works from a disposable session key under a local policy; the root is decrypted only in locked RAM on an offline machine, to sign the policy envelope. Web3Auth is production. Coldstar is beta, pre-audit. ### FAQ Q: Can an agent use a Web3Auth wallet? A: Technically yes; the Node SDK returns a signer after login. It would hold the full reconstructed key, with no policy, which is the situation Coldstar exists to prevent. Q: Is Web3Auth non-custodial? A: By its description, yes: no single party can use a single share. The full key exists on the client after login and can be exported. Q: Does Web3Auth have spending limits? A: None found in its docs at review time. ### Sources - MetaMask Embedded Wallets architecture (Shamir shares): https://docs.metamask.io/embedded-wallets/architecture/ - MetaMask Embedded Wallets: key export: https://docs.metamask.io/embedded-wallets/dashboard/advanced/key-export/ - MetaMask Embedded Wallets: Solana: https://docs.metamask.io/embedded-wallets/connect-blockchain/solana/ - Web3Auth pricing: https://web3auth.io/pricing.html ## Coldstar vs Alchemy Smart Wallets: the Solana answer to EVM session keys URL: https://coldstar.dev/compare/coldstar-vs-alchemy Category: Agent-safe signing · EVM session keys Alchemy's agent pitch is right: don't put a private key in a prompt or a .env; grant scoped, time-bound session keys instead. Its implementation is an ERC-4337 smart account, which means it is EVM-only. On Solana, Alchemy offers gas sponsorship and no smart accounts, bundler, or session keys. ### Pick Alchemy Smart Wallets if - Your agent is on Ethereum or an L2 and you want on-chain-enforced session keys with big infrastructure behind them. - You want cumulative ERC-20 allowances, function-selector allowlists, and expiry validated on-chain. - You already run on Alchemy's node and API stack. ### Pick Coldstar if - Your agent is on Solana. Alchemy's session keys do not exist there. - You want an owner-held cold root rather than a BYO or Turnkey-hosted owner signer. - You want the same scoped-permission idea without a smart-account program. ### Use both when Alchemy session keys for the EVM side of a multichain agent; Coldstar for its Solana side. ### Side by side (Coldstar | Alchemy Smart Wallets) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Owner key is bring-your-own or a hosted embedded signer (historically Turnkey enclaves). Permissions live in the on-chain ERC-4337 account. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | External signer or TEE for the owner; permissions on-chain (Modular Account v2). EVM. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Session keys: native transfer limit, ERC-20 cumulative allowance, gas limit, contract and function-selector allowlists, expiry. Validated on-chain. EVM only. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Reverted on-chain; sessions revocable from the dashboard. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | Owner can be a hardware wallet in principle; no documented cold-root workflow. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Agents page: scoped, time-bound permissions; CLI scoped sessions. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | Partial. Solana: gas sponsorship yes; bundler, smart accounts, and session keys no. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | aa-sdk MIT (EVM/viem). Hosted APIs. - Pricing: Free software plus a ~$10 drive. | Compute units per call (e.g. prepareCalls 1,750 CU, sendPreparedCalls 3,000 CU); plan tiers vary. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; a leading EVM account-abstraction stack. ### Where Alchemy Smart Wallets wins - On-chain session keys with cumulative allowances and expiry, on EVM. - Infrastructure at Alchemy's scale. - Clear agent guidance against raw keys. ### Where Coldstar wins - Solana. Coldstar signs Solana natively; Alchemy's smart wallets do not. - Owner-held cold root instead of a BYO or hosted owner signer. - No smart-account program to depend on. ### What you are trusting Alchemy's model anchors permissions in an on-chain smart account: the session key can only do what the account's validation logic allows, and anyone can verify that. The owner signer is yours or a hosted enclave. This is a good design for EVM agents and it simply does not exist on Solana, where Alchemy's supported-chains table lists gas sponsorship only. Coldstar's model is off-chain but local: a cold root signs a policy envelope; a session key acts inside it under a rule list enforced before signing. It works on Solana today and has secondary EVM support. Alchemy is production. Coldstar is beta, pre-audit. ### FAQ Q: Can I use Alchemy session keys on Solana? A: No. At review time Alchemy's supported-chains table showed Solana with gas sponsorship only: no smart accounts, no bundler, no session keys. Q: Does Coldstar work on EVM? A: Coldstar's core is chain-agnostic and EVM signing exists, but Solana is the first-class chain. For an EVM-only agent, Alchemy's session keys are the more mature option. Q: What is the equivalent of session keys in Coldstar? A: The policy envelope: the offline root authorises a disposable session key bounded by limits, allowlists, and a daily cap, enforced locally rather than on-chain. ### Sources - Alchemy Wallets docs: https://www.alchemy.com/docs/wallets - Alchemy: supported chains (Solana columns): https://www.alchemy.com/docs/wallets/supported-chains - Alchemy: session keys reference: https://www.alchemy.com/docs/wallets/reference/wallet-apis-session-keys - Alchemy for agents: https://www.alchemy.com/agents - aa-sdk source (MIT): https://github.com/alchemyplatform/aa-sdk ## Coldstar vs Safe + Zodiac Roles: the Solana answer to Safe + Zodiac Roles URL: https://coldstar.dev/compare/coldstar-vs-safe-zodiac Category: Agent-safe signing · EVM smart-account permissions If you have run an EVM treasury, you know the pattern: a Safe owned by hardware wallets, with a Zodiac Roles Modifier that lets a bot or agent call specific functions with specific parameters within limits. It is the gold standard for on-chain agent permissions, and it does not exist on Solana. Coldstar is the nearest thing that does. ### Pick Safe + Zodiac Roles if - Your agent is on an EVM chain and you want fully on-chain, audited permission enforcement with cold-wallet owners. - You need function- and parameter-level scoping plus rate and threshold limits. - You want LGPL-licensed contracts with years of production history. ### Pick Coldstar if - Your agent is on Solana, where neither Safe nor Zodiac is deployed. - You want the cold-owner idea without a smart-account program: the root is a plain keypair on your drive. - You want a human escalation step rather than a hard on-chain wall. ### Use both when Safe plus Roles for the EVM side of a multichain treasury; Coldstar (with Squads for on-chain quorum) for the Solana side. ### Side by side (Coldstar | Safe + Zodiac Roles) - Who holds the root key: You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | The Safe's owners, typically hardware wallets. No provider can sign. Role members hold whatever key they use, usually hot. - Where the key lives: On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | On-chain smart account (EVM). The Roles Modifier is a module attached to the Safe. - Policy engine: Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Scoped target addresses, functions, and allowed parameter values, plus rate and threshold limits. Fully on-chain. - Out-of-policy transactions: ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Reverted; out-of-role actions need the Safe's normal owner multisig. - Cold / offline root: Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | Yes, structurally. Owners can be hardware wallets. Not a feature, an architecture. - Agent integration: Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Not documented on the first-party pages we fetched; widely used for bots in practice. - Solana support: Solana mainnet. Core is chain-agnostic; EVM signing exists. | No. Safe's supported networks are EVM chain IDs; the Roles Modifier is deployed on 19 EVM networks. - Source & self-hosting: Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | safe-smart-account LGPL-3.0; zodiac-modifier-roles LGPL-3.0+. Contracts free to use. - Pricing: Free software plus a ~$10 drive. | Gas only for the contracts; Safe's commercial offerings not confirmed. - Maturity: Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; among the most battle-tested contracts on EVM. ### Where Safe + Zodiac Roles wins - On-chain enforcement of function- and parameter-level permissions. - Cold owners by default in practice. - Track record securing very large treasuries. ### Where Coldstar wins - Exists on Solana. - No smart-account program; a plain keypair root. - Escalation to a human over QR for over-threshold transactions. ### What you are trusting Safe plus Roles puts everything on-chain: the owner set, the role scopes, the limits. A role member's key can be hot because the contract will refuse anything outside scope. Owners approve the exceptional cases with their hardware wallets. It is a complete answer for EVM. Coldstar is an off-chain answer to the same shape of problem: a cold root that authorises a bounded session key, with the bounds enforced locally before a signature exists. Pair it with Squads for on-chain quorum and spending limits and you get most of the Safe plus Roles pattern on Solana. Safe and Zodiac are production. Coldstar is beta, pre-audit. ### FAQ Q: Is there a Safe for Solana? A: No. Safe's supported networks are EVM chains. Squads is the Solana multisig standard, and Coldstar is a cold, policy-gated signer you can put in its seats. Q: Can Coldstar scope function parameters like Zodiac Roles? A: No. Coldstar's policy works at the program, recipient, and amount level. Parameter-level scoping is a strength of on-chain modules that Solana tooling has not matched. Q: Why include an EVM-only tool here? A: Because Solana teams coming from EVM search for it. The honest answer is that the pattern does not port directly, and this page says what does. ### Sources - Safe docs: smart account supported networks: https://docs.safe.global/advanced/smart-account-supported-networks - Zodiac Roles Modifier docs: https://docs.roles.gnosisguild.org/ - zodiac-modifier-roles source (LGPL-3.0+, deployments): https://github.com/gnosisguild/zodiac-modifier-roles - safe-smart-account source (LGPL-3.0): https://github.com/safe-global/safe-smart-account