Private access layer for Solana · devnet beta
01 The connection
Every app starts the same way: connect your wallet. One click, and it can read your address, your balance, your history — and every other app you have ever touched. Then it asks you to sign bytes no human can read. One wrong approval, and it is all gone.
02 Exposure
Hand over your address, and your balances, your history and your other apps become readable by anyone who looks.
Then it asks you to sign. The popup shows bytes no person reads. Approving is an act of faith in someone else's frontend.
One malicious approval and the wallet is gone — drainer kits are an industry now. Access should never have meant exposure.
03 The break
For apps that integrate GhostLink, access can start with a proof instead of a wallet address.
03 Set up once
The trusted setup page asks for the same message twice to check deterministic signing. Treat the resulting identity secret like a key.
03 Prove, don't reveal
A verifier checks a claim such as “holds at least 100 USDC” plus an app ID, session binding and other public inputs. The proof omits the wallet address.
03 Ghost mode
Proofs reduce disclosure. Pockets add spending limits and owner recovery. Deposits, swaps and home addresses remain visible on-chain.
04 How it works
‹GhostLink domain› wants you to sign in with your Solana account:
7xF3…9Ka2
This signature derives your private GhostLink identity.
Sign a plain message to derive an identity in a trusted page. Registration is a separate on-chain step; the low-level SDK does not isolate secrets from its host page.
Apps check eligibility against a zero-knowledge proof built on your device. The proof discloses the claim and a per-app ID without including the wallet address. Other metadata and on-chain activity may still link users.
Each app gets its own small account with hard limits. It requests outcomes, never signatures — and the chain enforces the deal, or nothing moves.
05 The boundaries
The wallet adapter supports message sign-in. App actions use limited session keys. A malicious host page can still misuse identity secrets supplied to the low-level SDK.
registry: one binding per wallet, no update, no adminEach app sees a stable ID derived for that app alone. Proof IDs differ by origin. Public funding, home addresses and network metadata can still link activity; the registration set alone does not guarantee anonymity.
app_id = Poseidon(secret, domain, 1)Pockets fill intents atomically: the promised outcome arrives in the same transaction, or everything reverts. Configured oracle checks bound slippage; unsupported routes use a separate conservative cap.
fill_begin ⇄ fill_end, introspected in one transactionOwner sweeps return funds home. Swap fills can transfer input tokens to counterparties. Home changes require an owner proof and a 216,000-slot delay, roughly 24 hours.
sweep_home always available, even with no session06 Measured, not promised
07 Compare
| GhostLink | Direct wallet connect | Embedded app-wallets | Session-key wallets | |
|---|---|---|---|---|
| Address omitted from sign-in proof | Yes; host-page trust still matters | Address shared on connect | Depends on architecture | Depends on architecture |
| Prove holdings without revealing them | Zero-knowledge claim | No | No | No |
| Main wallet signs app transactions | Session keys sign intents | Wallet approves transactions | Separate app keys | A delegated key signs |
| Hard per-app daily cap enforced on-chain | Yes | No | Rarely | Sometimes |
| Price floor on every swap, checked on-chain | Configured routes; capped fallback | App-dependent | App-dependent | Policy-dependent |
| Owner recovery to a chosen home | Owner proof; delayed home changes | No | No | No |
| Recovery without a live session | Owner proof and relayer required | Per-token approval revokes | Depends on provider | Revoke only |
| Works with the wallet you already have | Deterministic Ed25519 signatures | Yes | New account or custodian | Varies |
Architecture-level comparison, not a product ranking. Implementations vary. GhostLink is experimental: its host page receives secrets, and pocket activity is public on-chain.
08 For developers
Explore the experimental SDK, circuits and services, published under Apache-2.0. The current SDK runs in a trusted page; an isolated identity broker is still future work.
// Work in a trusted host page. The current SDK // receives identity secrets and wallet witnesses. import { GhostLink, softwareSession } from "@ghostlink/sdk"; const gl = await GhostLink.init({ cluster: "devnet", indexer: INDEXER_URL, prover, }); const session = await gl.prove({ identity, witness, home, currentSlot, expirySlot, session: softwareSession(), // Omit claim for registration-only proof. }); // Backend: verify the proof AND a signature over // a fresh, single-use server challenge. // See the complete authentication quickstart.
09 On your terms
Share less with apps that integrate GhostLink. Start with the experimental SDK.