Solana checkout addresses

Every Solana checkout pays to a fresh address that no other payment uses. 402pay derives these addresses from a public key your browser shares, as EVM, Tron and Bitcoin checkouts do from an account's extended public key, so it never holds a key that can move your funds. This page publishes the derivation, so anyone can reproduce it.

When you create or import a wallet, your browser derives a Solana checkout key from the recovery phrase and shares only its public half: a public key and a chain code. 402pay derives checkout address n from it for checkout n. Only the recovery phrase makes the private keys behind these addresses, so only you can move what they hold. The checkout key can't spend anything, but it links every checkout address to your wallet, as any extended public key does.

• The main address, m/44'/501'/0'/0', is the one Solana wallet apps show when you restore your recovery phrase, and the one Receive shows in the dashboard.
• Checkout addresses sit on a branch of their own, m/402'/501'/0', whose children use public (soft) derivation. Wallet apps don't scan it, so they don't show these funds.
• Move them with Send in the dashboard, which signs for checkout addresses in your browser, or with nothing but your recovery phrase on the Solana recovery page.

402pay Solana checkout keys, version 1, is BIP32-Ed25519 (Khovratovich and Law, the V2 scheme of Cardano's ed25519-bip32) from a SLIP-0010 root. Below, B is the Ed25519 base point, l its group order, 2^252 + 27742317777372353535851937790883648493, numbers are read and written little-endian, x[a..b] is bytes a up to b, and || joins bytes.

1. seed is the BIP39 seed of the recovery phrase, its words in lowercase and one space apart, with no passphrase.
2. SLIP-0010 derivation for Ed25519 of seed along m/402'/501'/0', all three steps hardened, gives a 32-byte key k and a 32-byte chain code c. Purpose 402' keeps the branch apart from the m/44'/501' accounts wallet apps show.
3. h = SHA-512(k), kL = h[0..32] and kR = h[32..64]. Clamp kL: kL[0] &= 0xF8, kL[31] &= 0x1F, kL[31] |= 0x40. The root public key is A = kL * B.
4. The checkout key your browser shares is base58(A || c): 64 bytes in Bitcoin's base58 alphabet, with no checksum. A valid one decodes to exactly 64 bytes, is at most 88 characters with no whitespace, and its A is a canonical encoding of a point in the prime-order subgroup that isn't of small order, what libsodium's crypto_core_ed25519_is_valid_point accepts.
5. Child i, for 0 <= i < 2^31: Z = HMAC-SHA512(key = c, data = 0x02 || A || le32(i)), ZL = Z[0..28] and ZR = Z[32..64]. Its public key is A_i = A + (8 * ZL) * B, and checkout address i is base58(A_i). Its private key, which only the phrase can make, is kL_i = kL + 8 * ZL (a 256-bit addition, not reduced) and kR_i = (kR + ZR) mod 2^256, and kL_i * B must equal A_i.
6. To sign message M with child i: r = SHA-512(kR_i || M) mod l, R = r * B, x = SHA-512(R || A_i || M) mod l and S = (r + x * (kL_i mod l)) mod l. The signature is R || S, and it verifies under standard Ed25519 verification (RFC 8032), strict checks included.

• Solana index 0 is the main address's slot, so child 0 of the checkout key is never handed out.
• Checkout n, from 1 up, pays to child n. Indexes count up per wallet and never go back, so an address never serves two payments. Card payments that settle on Solana take one too.
• To find funds, scan from child 0. address_counts.solana on GET /wallet is one more than the highest Solana index handed out, so it says how far to look.
• A child whose public key would be the identity point is skipped and never handed out. The chance of one is about 2^-250.

From the published BIP39 test phrase, which is never a wallet to send funds to. Independent implementations give the same values. The message to sign is hex, the bytes of "402pay".

{  "phrase": "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about",  "main_address": "HAgk14JpMQLgt6rVgv7cBQFJWFto5Dqxi472uT3DKpqk",  "checkout_key": "sHz8kwCJhANstUZXuSv3SDDFbcVmqpH2ojjvY1VNvCPSTcqm9rx2r65ECEryDo3oxWpZCv9mMmi4twijuvbf7F7",  "children": [    { "index": 0, "address": "FFWTFNVcavC2RVTDsjNHfJwPAZuSaKhvABNk7goBWkTX" },    { "index": 1, "address": "EgsxatR8QNRxCBkf6ZBf3Z9uoaeN23yBhFWn2sk91h3E" },    { "index": 2, "address": "ERRm1NNCfSnBaf9YzrSJwKVDYR5LfREkaRarxGWbyJpf" },    { "index": 2147483647, "address": "7FMbTxB3Ke1NFknB1SCZJ2crt4pwmSTz3WNPSmzhtqB9" }  ],  "signature": {    "index": 1000,    "address": "HP3xenGuaNHgbeLhrZ4W7th5nqxCxwscYNHLi2KtSU5p",    "message": "343032706179",    "signature": "1095be7d64ba627ddd82081fc35a7f76e00a64a289656949ea2e0db101905f6f40cc8fb2ea410ae779bf8a90e67673bb5e81b18ecab3f277b876da13ba796d06"  }}

You don't need 402pay's code to move these funds. Anything that follows the steps above finds the same addresses and makes the same keys: any Ed25519 library that signs with an expanded key (kL, kR) can sign for a checkout address, and BIP32-Ed25519 libraries, such as Cardano's ed25519-bip32, derive the same children from the root key (kL, kR, c). The signature is a standard Ed25519 signature, which Solana validators accept like any other, so a transfer from a checkout address is an ordinary Solana transaction.

1. Derive the main address and the checkout key from your recovery phrase.
2. Derive checkout addresses from child 0 up, and read each one's SOL and its USDC and USDT associated token accounts from any Solana RPC.
3. For each funded address, sign a transaction with its child key that moves its tokens and SOL where you choose, with an address that holds SOL, such as the main address, paying the fee.

• Wallet and deposits The three kinds of wallet, how each payment lands in yours, and who holds the keys.
• Security best practices Narrow keys, rotations without downtime, a locked-down webhook endpoint and a secure account.
• Supported networks Every coin and network checkout accepts, and the confirmations each one needs.