Implementation and evidence · 18 October 2026
What works today.
Sona connects Solana wallets, verifies Raydium CPMM Fee Keys, stores authenticated listings and builds an atomic exchange signed by both buyer and seller.
Public implementation. Runtime and source availability verified.
The public Cloudflare Workers/D1 service has been checked with anonymous requests, a fresh wallet’s authentication signature, replay and origin rejection, session invalidation and current Raydium account reads. Atomic settlement has separately executed on an isolated Solana validator. No Sona mainnet sale or independent security audit is claimed.
The exchange
A seller lists a verified Fee Key at a fixed SOL price. A buyer requests the purchase. The seller signs a short-lived transaction, then the buyer reviews and signs the same transaction. It creates the buyer’s token account if needed, transfers exactly one Fee Key and pays the seller. All instruction effects succeed together or roll back together; transaction fees may still apply.
Listings and requests are hosted by Sona. Assets stay in the parties’ wallets until settlement. There is no Sona custody or new escrow program to deploy. Seller approval is required for each buyer, and an approval already released cannot be revoked by merely canceling a listing.
Current implementation
| Capability | Implementation and evidence |
|---|---|
| Wallet connection | Wallet Standard and injected Phantom, Solflare and Backpack support. Public key, account changes, disconnect and exact-message signing are handled. Automated adapter tests do not substitute for an independently observed extension session. |
| Wallet balances and inventory | Solana RPC reads and program-account validation. No seeded market, fictional balance or browser-local purchase state. The watchlist alone stays local. |
| Raydium eligibility | CPMM Burn & Earn Fee Keys only. Checks cover the current holder, NFT mint, canonical lock, pool, LP escrow and vault relationships. Live mainnet read evidence is linked below. |
| Listings and requests | Signed nonce authentication, shared D1 persistence in the hosted implementation, exact lamport prices, listing expiry and authorized updates. The local reference service uses SQLite. Each sale requires both wallets. |
| Atomic settlement | Canonical transaction checks in the browser and server; finalized confirmation before a completed sale is recorded. Local validator artifacts include actual instruction logs and before/after balances. |
| Public receipts | The receipt endpoint exposes actual completed trades from this running service. Local test receipts are kept in separate evidence files and never inserted as marketplace trades. |
| Release status | Public HTTPS service and source repository are available. Recorded public checks cover Workers/D1 authentication and read-only protocol verification. A real mainnet Fee Key sale and independent security review remain unverified. |
Verify a Fee Key
Read current Solana account state without connecting a wallet. This checks the mint, current holder, canonical Raydium lock, pool, LP escrow and vaults. It does not list an asset or authorize a transaction.
Inspect the evidence
Internal security review · Review execution record · Read-only mainnet sale verification. The internal review is AI-assisted and is not an independent audit. No completed mainnet sale is claimed.
- Public runtime verification — anonymous API access, actual Ed25519 authentication, persisted-session checks, replay and foreign-origin rejection, logout and a current third-party Raydium read. No transaction was sent.
- Local workerd/D1 runtime verification — the same request and authentication checks in the actual local Workers runtime, with a read-only mainnet observation. This is separate from validator settlement tests.
- Local validator execution — atomic transfers, failure rollback and transaction-integrity cases using purpose-created SPL NFTs.
- Local HTTP-to-chain execution — authentication, persistent listing, both signatures, finalized receipt and restart persistence.
- Hosted adapter execution on a local validator — real HTTP requests, a D1-compatible SQLite adapter, fresh request instances and durable recovery. This is not execution in Cloudflare’s deployed D1 runtime.
- Hosted release settlement checks — actual atomic transfer, exact payment, rollback, replay and signature-integrity checks on the same isolated local validator using purpose-created SPL NFTs.
- Mainnet read-only observation — an existing third-party Fee Key, with account hashes and a recorded slot. This is not a Sona sale, listing or customer.
- Raydium source provenance — pinned official references, account layouts and eligibility limits.
- Structured capability status and release declarations.
- Build manifest — repository revision and SHA-256 hashes for the published implementation and migrations. Compare the recorded revision and files with the public source; a manifest alone is not an independent audit.
Read and reproduce
- Sona source repository · Public service. Use the build manifest to identify the deployed source revision.
- Marketplace UI source · wallet signing and browser transaction checks.
- Fee Key verification · atomic settlement · local Node marketplace reference.
- Hosted implementation: marketplace lifecycle · HTTP handler · D1 persistence. This is separate from the Node/SQLite reference tested in the local execution artifacts.
- Local integration runner · validator runner · read-only mainnet verifier.
- Offline evidence gate — detects source changes after recorded execution; matching hashes are not an independent audit.
- Full implementation notes and reproduction commands.
Scope and costs
The current integration transfers an entire CPMM Fee Key held by an ordinary signing wallet. Program-owned and multisig-held keys are not supported by this signing flow. It does not support CLMM positions, partial rights, LP redemption, fee claiming, new liquidity locks or confidential settlement. Public RPC can throttle; read failures are shown instead of fabricated holdings.
No paid RPC key is required. Listing does not require a deposit. A real purchase still costs Solana network fees and, when needed, buyer token-account rent. Hosted operation is subject to platform and public RPC limits; an independent security review remains outstanding.