Associated token accounts
Apple Watch derives the canonical sender and recipient token accounts from each owner and mint. A phone-supplied account cannot redirect the transfer to another owner.
Solana · SOL
Keep your Solana keys off your phone.
Your iPhone prepares SOL and token transfers. Apple Watch verifies the destination, token accounts, mint, program, amount, and fee.
Current support
Solana in Cryptograph.
Native assets, token standards, and connection methods differ by network.
- Native asset
- Solana (SOL)
- Tokens
- Supported SPL tokens and Token-2022 transfers.
- Transfers
- Native SOL and token transfers prepared inside Cryptograph.
- Approval management
- Find and revoke active SPL and Token-2022 delegates. Close durable nonce accounts.
- WalletConnect
- Message signing only. Raw transaction methods are not enabled.
On Apple Watch
What you approve.
On Solana, the account receiving a token can matter as much as the owner address. Cryptograph binds the approval to the exact transfer shape it knows how to show.
- 01The recipient and amount are derived from the signed Solana payload.
- 02Token transfers show the mint and whether the signed instruction uses Token or Token-2022.
- 03Apple Watch derives the sender and recipient associated token accounts. Both must belong to the same token program.
- 04An uncurated token is identified by its full mint and marked unverified instead of receiving a familiar symbol.
- 05The watch derives the base fee and any new-account rent deposit from the signed transfer shape.
- 06A recent blockhash must leave enough time for approval, return to the iPhone, and broadcast.
Network-specific security
Solana account routing is verified on Apple Watch.
Token value lands in a token account rather than the owner address itself. Apple Watch derives the canonical account for the owner, mint, and token program.
The sender and recipient accounts must use the same Token or Token-2022 program. Mixed programs, redirected accounts, and nonstandard auxiliary accounts are refused.
Solana security
The watch verifies accounts, programs, fees, and the time left to broadcast.
A Solana transfer names accounts as well as a recipient. Cryptograph checks those relationships before signing.
Token program and identity
The signed accounts determine whether the transfer uses Token or Token-2022. The mint, decimals, program, and verification status appear on the watch, and mixed-program pairs are refused.
Fees and blockhash freshness
The watch derives the signature fee and includes the rent deposit when a recipient token account must be created. An expiring blockhash or conflicting phone fee requires the request to be rebuilt.
Transfer-only send path
A normal send request can authorize only a native SOL or supported token transfer. A token/native mismatch, different operation, or payload the watch cannot decode is refused before approval.
Raw signing boundaries
Both raw WalletConnect transaction methods are disabled, and address-lookup-table transactions are refused at the watch boundary. A message that decodes as a Solana transaction is also refused.
Delegate revocation
Cryptograph finds active SPL and Token-2022 delegates and labels their program risk. A revoke request emits one SPL Revoke instruction through the correct token program and is approved on Apple Watch. Durable nonce accounts can also be closed to return their SOL.
Verified Solana programs
Recognized programs appear by name.
Cryptograph checks Solana program IDs and delegate addresses against reviewed lists built into the app. Known identities can be named during review. Unknown identities keep their full address and warning.
Program recognition does not replace instruction-by-instruction review. Raw WalletConnect transaction signing remains disabled until every account and instruction can be disclosed on Apple Watch.
The published registry lists reviewed protocol program IDs. Verification does not promise that the program has no bugs.
Current limit
Raw WalletConnect transactions are not enabled.
A raw Solana transaction can authorize several programs, accounts, signer roles, and value movements. Cryptograph will not sign one until every consequential instruction can be disclosed on Apple Watch.
The decoder can identify known hazards. A warning does not replace a complete account-by-account review.