SignLens

Clear signing and blind signing on Solana

Published

Clear signing means seeing what a transaction will actually do, in plain words decoded from the bytes you are about to sign, before you approve it. You read the action itself: deposit 4,635 USDC into Kamino Lend as collateral, let this key spend your USDC, or make that key the owner of this account. Blind signing is approving a transaction you cannot read: you see a hash on a hardware wallet's screen, or you trust the dapp to tell the truth about what its bytes do. Most Solana wallets show something in between: the balance changes a transaction would cause. The costliest attacks change no balance when you sign them.

What signing looks like on Solana today

On a hardware wallet
Ledger's Solana app shows in words only "simple instructions like a single transfer" and a few pairs, such as creating an account and funding it. Anything else needs its blind-signing setting turned on: "Blind signing must be on for the Ledger to sign SPL token transfers and smart contract transactions on Solana", says Solflare's guide, and every firmware or app update turns it off again. With it on, a swap, a deposit or a vote is approved on a screen that cannot display it.
In a software wallet
Phantom, Backpack, Solflare and other wallets simulate the transaction and show the balance changes it would cause, with warnings for some known dangers. That shows how much leaves your wallet, not why: a lending deposit, a liquidity position and a wallet drain can all produce the same balance preview. When the simulation fails, the wallets' own help pages say the transaction may succeed anyway.
In the dapp
The dapp builds the bytes and describes them: a button that says Claim, Swap or Sign in. That description is what an attacker who controls the page gets to write. In February 2025, on Ethereum, Bybit's signers saw a routine transfer from cold storage in an interface attackers had altered, and signed a change to their multisig's own logic: about $1.5 billion (what they saw, and what they signed).

Why it matters on Solana

The transactions that cost the most move nothing when you sign them: they hand over the right to take it later. A balance preview shows no change, and a hardware wallet in blind-signing mode shows nothing it can read.

What clear signing shows

Take a real deposit into Kamino Lend. A balance preview shows only 4,635.28675 USDC leaving the wallet. SignLens decodes its instructions and shows that it deposits the USDC into Kamino Lend as collateral:

OK

Deposit 4,635.28675 USDC into Kamino Lend as collateral

What this does

Full text, as the engine prints it
Deposit 4,635.28675 USDC into Kamino Lend as collateral
OK

== Deposit collateral | Kamino Lend (descriptor reviewed 2026-09-29, upgradeable by GzFg…kzkW)
  Deposit: 4,635.28675 USDC
  Obligation: 5iLEgayZ19eL6vGLEtELtCpYrGxZYGL4xEBsxMaYAfFz
  Reserve: D6q6wuQSrifJKZYpR1M8R4YawnLDtDsMmWM1NbBmgJ59
  From account: Your USDC account (4Pus…gpZ8)

== Also [collapsed]
  Compute unit limit: 213727
  Compute unit price: 70,182 micro-lamports per compute unit
  Create token account if missing: Token account: Your USDC account (4Pus…gpZ8)
  Create token account if missing: Owner: Your wallet (2P5t…sPxW)
  Create token account if missing: Mint: USDC mint (EPjF…Dt1v)
  Create token account if missing: Rent paid by: Your wallet (2P5t…sPxW)
  Create token account if missing: Token program: Token program (Toke…Q5DA)
  Refresh reserve: Reserve: 37Jk2zkz23vkAYBT66HM2gaqJuNg2nYLsCreQAVt5MWK
  Refresh reserve: Reserve: d4A2prbA2whesmvHaL88BH6Ewn5N4bTSU2Ze8P6Bc4Q
  Refresh reserve: Reserve: D6q6wuQSrifJKZYpR1M8R4YawnLDtDsMmWM1NbBmgJ59
  Refresh obligation: Obligation: 5iLEgayZ19eL6vGLEtELtCpYrGxZYGL4xEBsxMaYAfFz
  Refresh obligation: Additional accounts: 3, not named by this descriptor

== Signers
  Fee payer: Your wallet (2P5t…sPxW)

== Fee
  Total: 0.00002 SOL
  Base: 0.000005 SOL
  Priority: 0.000015 SOL
  Priority basis: 70,182 micro-lamports per compute unit × 213,727 compute units requested
  Rent deposits: up to 0.00148844 SOL, if the account this transaction creates when missing does not exist yet; refunded to whoever closes the account

== Validity
  Expires: in about a minute (recent blockhash)

Effects:
  - You send 4,635.28675 USDC from Your wallet (2P5t…sPxW) to Kamino Lend (KLen…gmjD)
  - Credit the deposit to the obligation as collateral
  - Create Your USDC account (4Pus…gpZ8), managed by Token program (Toke…Q5DA), depositing 0.00148844 SOL unless it already exists
  - Update the reserve's oracle prices and accrued interest; no tokens move
  - Update the reserve's oracle prices and accrued interest; no tokens move
  - Update the reserve's oracle prices and accrued interest; no tokens move
  - Recompute the obligation's collateral and debt values; no tokens move
  - You pay a fee of 0.00002 SOL
  - Valid for about a minute (recent blockhash)

Raw: solana v0 (507 bytes)
  digest: 00aceb9aa518bff00dfe2464dfe370cd22dc63e59126a1521d38557ae97a3612
Mainnet transaction 27n9…4bND, slot 451,717,610. Explained for 2P5t…sPxW as the signer, by the SignLens engine 0.3.0, on 2026-11-01. How to read this.

Three things make that possible: a description of each program's instructions, from a source you can trust, to decode the bytes into what they do; names checked by address, so that a token called USDC is Circle's USDC, not a token that copied its name (the verified badge); and decoding the bytes that will be signed, not what the dapp says they are. It is not a defence against everything: a compromised computer can show anything, and a stolen key needs no signature.

sRFC 39: a standard for clear signing on Solana

On 27 October 2025 a draft, sRFC 39 "Solana Clear Sign", was opened in the Solana Foundation's repository of standards proposals. Its starting point: the interface descriptions programs publish, their IDLs, "provide no guidance on how to present transaction data to users", so users "must blindly sign transactions, a process prone to error and misunderstanding, which often leads to loss of funds."

It proposes that each program's IDL carry display rules: an intent for each instruction, such as "Transfer 10 wSOL to toly.sol.", labels for its accounts and arguments, and how to format amounts, dates and durations. Wallets would fetch them with the IDL; hardware wallets would carry them in their firmware or be given them while signing, and must be able to show the intent from the IDL and the instruction data alone.

The open question is trust. An IDL is written by the program's own authors, and a drainer can describe its program as harmless: replies in the discussion propose curated lists of trusted programs, and verified builds to establish where an IDL comes from. Ledger has proposed additions, and published an extension that follows value across instructions to state what a whole transaction does. As of October 2026 sRFC 39 is still a draft. On Ethereum the equivalent is ERC-7730, the clear-signing standard Ledger started and handed to the Ethereum Foundation on 12 May 2026.

Clear signing on Solana now

Until wallets and hardware wallets read display rules like sRFC 39's, clear signing on Solana means decoding a transaction before your wallet asks you to sign it. That is what SignLens does: dapps connect it like a wallet, and it explains each transaction in its own window, from a reviewed description of each program it knows, then passes it on unchanged to your wallet (how it works). A program it has no description of is not guessed at: the request is blocked. It is free, works in front of Phantom, Backpack, Solflare and other Solana wallets, and runs in Chrome, Brave, Edge and Firefox on a computer. How it compares with wallet previews, scam lists, explorers and hardware wallets.

What to do before you sign

With SignLens or without it, and whichever wallet you use:

Try it: install SignLens for Chrome or Firefox.

Sources