Phase 4 — Solana (Anchor programs)

Status: Planned.

payment_link and subscription Anchor programs. PDA per link; SPL delegate for subscriptions. Deprecates SOL HD derivation and the SOL sweep service for flagged links.

Scope

• Anchor workspace at contracts/solana/ with both programs.
• Helius webhook indexer (or Triton streams) emitting existing webhook events.
• Keeper SOL branch in subscription-auto-charge.processor.ts.
• SOL audit (OtterSec or Neodyme).

Code touched

• api/src/payments/wallet.service.ts — SOL branch of generateAddressForNetwork becomes PDA computation.
• api/src/withdrawals/services/solana-withdrawal-transfer.service.ts — bypassed for flagged links.
• api/src/scheduler/processors/subscription-auto-charge.processor.ts — SOL keeper branch added.
• api/src/withdrawals/services/bridge/solana-relay-bridge-executor.service.ts — still used; trigger moves to program events.
• New: contracts/solana/ Anchor workspace.

Runtime / UX impact

• SOL payment links show a PDA address; unchanged from the payer's perspective.
• SOL subscriptions ask the payer for one SPL Approve signature at setup.
• Revoke is via spl-token revoke or the wallet's standard UI.

Current limitations

• Wrapped SOL vs native SOL handled per-link via expected_mint.
• Priority fee spikes may delay charge(); retries bump priority.
• No Chainlink equivalent on Solana at rollout time; secondary redundancy is a second NestJS region or Clockwork (if acceptable).

Linked blog post

Phase 4: Non-Custodial Solana with Anchor PDAs

Status checklist

• Anchor workspace scaffolded
• payment_link program with all instructions + tests
• subscription program with all instructions + tests
• Helius webhook indexer shipping
• Keeper SOL branch live
• Audit report landed
• Mainnet deploy from Squads multisig
• Canary cohort stable for 14 days