Vault Standard Suite

⚠️ Reference implementation only - not audited for mainnet use. Review and audit before deploying to production.

A standard factory program for tokenized vaults on Solana, inspired by ERC-7540. It standardizes the subscription (deposit) and redemption (withdrawal) flow so teams can build on a shared, audited primitive instead of deploying bespoke vault programs.

Design Decisions

See DESIGN_DECISIONS.md for the catalog of features requested by ecosystem teams and how each is handled — implemented in the template, spec'd as an extension, integrator-side, or intentionally excluded.

Deployments

For demo purposes the program is deployed on devnet.

Network	Program ID
Devnet	vaLtx8Su1t5P1CZG5GFEMc94sN4K7A4AUUiciadtvUi

Not deployed to mainnet-beta.

Overview

Real World Asset (RWA) issuers and other institutions repeatedly build the same vault primitives — deposits and redemptions into a managed strategy, with role-based access control and KYC. Today every team ships its own implementation, increasing integration work and the surface area for vulnerabilities. The Vault Standard Suite provides a shared, customizable vault program so that critical Solana infrastructure can be reused safely while still allowing innovation on top.

The design follows ERC-7540 and the lessons of Token-2022, keeping the core minimal and pushing optional behavior into extensions.

Key Features

• Async deposit/redemption — requests are queued and settled by a vault authority once NAV is updated; shares and assets are not distributed atomically.
• Bring-your-own share mint — a vault accepts a pre-configured mint as its share token rather than creating one, decoupling the program from future mint/extension combinations and reducing the need for upgrades.
• No forced ATAs — the program does not initialize token accounts or enforce ATAs; callers initialize accounts beforehand, preserving flexibility for non-ATA usage.
• Extensions — opt-in modules (fees, min subscription/redemption, pausable flows, subscription/redemption queues) that add conditional logic to core instructions.
• Composable with sRFC-37 — designed to pair with the Token Access Control List (ACL) standard, an improvement to Transfer Hooks, for KYC'd tokens without compromising composability.

Programs

Async Vault

The primary implementation, supporting asynchronous deposit and redemption flows where requests are queued and settled by the vault authority. Targeted at RWA issuers, teams running off-chain strategies, and any context requiring regulatory compliance.

Documentation

• Design Decisions — requested features and how each is approached
• Glossary — vault terminology
• Sequence Diagrams — deposit, redeem, and authority withdraw flows
• Subscription Queue — FIFO queue extension mechanics

Local Development

Prerequisites

• Rust (see rust-toolchain.toml)
• Node.js (see .nvmrc)
• pnpm (see package.json packageManager)
• Solana CLI
• Anchor CLI (see Anchor.toml)

Build & Test

# Install dependencies
just install

# Build IDL + clients
just build

# Run unit + integration tests
just test

# Format and lint
just fmt

Tech Stack

• Anchor — Solana program framework
• Codama — IDL-driven Rust + TypeScript client generation
• LiteSVM — fast in-process testing

Security

This program has been reviewed by Cantina (APEX). See the audit report and audit status for scope and the audited baseline commit.

This remains a reference implementation and is not audited for mainnet use — review and audit before deploying to production.

To report a vulnerability, see SECURITY.md.

Token-2022 Considerations

The vault assumes exclusive custody of the tokens it holds. Some Token-2022 extensions break that assumption and are not rejected by the program — vet both the asset mint and the share mint before use.

Enforced: nonzero TransferFeeConfig asset mints are rejected; the share mint's mint authority moves to the vault PDA.

Vet yourself:

• Asset PermanentDelegate — can drain reserve/pending_vault directly, leaving total_asset_balance stale.
• Share MintCloseAuthority — closing the mint at zero supply bricks refund/claim paths.
• Freeze authority / default-frozen — can freeze reserve/pending_vault and block transfers.

Notes

These programs are unoptimized and written in Anchor simply for the speed of development. Feedback is welcome and optimizations will be implemented once there is consensus that the structure of the program in question is relatively stable.

Contributing

To suggest a feature or change, open an issue with a detailed explanation of the request and the reasoning behind it.

Acknowledgments

Thanks to Exo Technologies for the initial design and implementation of this program.

---

Built and maintained by the Solana Foundation.

Licensed under MIT. See LICENSE for details.

Support

• Solana StackExchange — tag anchor
• Open an Issue