Frank Olien
← Back to work Source

Solfare — a Solana wallet, built from scratch.

Stack: Flutter · Dart · Solana

Focus: Wallet security · Solana RPC · Self-custody

Frank Olien

2025Solana Wallet

Solfare

A deep-dive into wallet security, Solana RPC, and the mobile patterns a self-custody app has to get right.

Stack
Flutter · Dart
Chain
Solana
Role
Solo build
Tests
438
Commits
119
01

What is Solfare

The parts a user never sees.

Solfare is a self-custody Solana wallet — send, receive, swap, stake, tokens and NFTs — written solo in Flutter as a deep-dive into the parts of a wallet a user never sees.

“A wallet is judged on what a transaction will do before it's signed, which key is in memory and when it's wiped, and what the balance says when the socket drops mid wallet-switch.”
02

What it does

Everything a wallet is expected to.

Wallet onboarding

BIP-39 generate or import, confirm-phrase verification, biometric & passcode setup.

Multi-wallet

Create, rename, switch, and export multiple wallets, with lazy migration from the single-mnemonic format.

Send & receive SOL

Address validation, QR scanning, on-device signing, live WebSocket balances, polling fallback if the socket drops.

SPL tokens & NFTs

Helius DAS for both, with a local cache that survives a cold restart.

Swap

Jupiter v2 (/order + /execute) with v0 VersionedTransaction signing on-device.

Staking

A single bundled createAccount + initialize + delegate transaction so a partial land can't orphan a stake account.

Market data

CoinGecko prices and charts via a serialised queue with in-flight coalescing and stale-cache fallback on 429.

Transaction preview

Every instruction decoded against a program registry and run through a risk engine before the approval sheet.

03

Security model

Designed for the failure case first.

Keys at rest
FlutterSecureStorage (iOS Keychain / Android Keystore) with first_unlock_this_device accessibility.
Passcode storage
Versioned v1:salt:iter:hash envelope over PBKDF2-HMAC-SHA256, constant-time compare, silent legacy migration.
Key derivation
A single Keyring primitive — every signing path in the app goes through one place.
In-memory secrets
try/finally zeroing of seed and private-key bytes; export screen scrubs displayed bytes on dispose.
Screenshot leak
Android FLAG_SECURE; iOS paints a privacy overlay on the app-switcher snapshot via a MethodChannel.
Clipboard
copySensitive auto-clears after 30s, and only if the value hasn't already changed.
Biometric unlock
Wrap key bound to biometryCurrentSet — a newly enrolled face or finger invalidates it.
Brute-force
5-attempt lockout with backoff in the passcode bloc.
04

Style guide

Colours & type.

AaAa

FK Grotesk · display

Aa

FK Grotesk SemiMono · mono

Canvas
#0A0B12
Surface
#1C1F26
Flare
#F4D03F
Success
#4CAF50
Danger
#FF5252
Purple → teal · accent gradient
SecuritySelf-custodyPrivacySpeed
05

Design · hi-fi

The screens, flow by flow.

01Onboarding flow

Onboarding

Generate or import a BIP-39 phrase, confirm it, and lock the wallet behind Face ID or a passcode before a single key is written.

ONBOARD
02The wallet flow

The wallet

The home dashboard with live balances over WebSocket, sending SOL with on-device signing, and receiving to a scannable address.

WALLET
03Trade & earn flow

Trade & earn

Swap through Jupiter with v0 VersionedTransactions, read CoinGecko-backed price charts, and delegate stake in one bundled transaction.

TRADE
04Approve & protect flow

Approve & protect

Every transaction is decoded and risk-checked before the approval sheet, and the whole security surface is one screen away in settings.

SECURE
06

Where it's not

The honest limits, on purpose.

  • Flutter-only — no Secure Enclave, no hardware-wallet support, no SSL pinning.
  • solfare:// deep links are wired; the OS-verified Universal Links and Mobile Wallet Adapter are not.
  • Android release still signs with debug keys.
  • PBKDF2 at 100k iterations, below the 2025 OWASP ~600k — the version envelope is set up for the upgrade.
  • Solo project: no shipped-to-production scar tissue, only what I learned reverse-engineering Solflare.

Next

Let's build something.

Open to freelance, full-time roles, and interesting collaborations in mobile, Web3, and AI.

Get in touch More work