LazorKit

LazorKit is an open-source execution layer for Solana that replaces seed phrases with passkey-based authentication, enabling Web2-quality onboarding without sacrificing on-chain security or self-custody.

What LazorKit Is

LazorKit describes itself as an "execution layer for Solana" — infrastructure that sits between user intent and on-chain execution, handling four friction points that most crypto wallets leave unsolved: authentication, session delegation, gas payment, and permission enforcement. Where a standard Solana wallet requires a seed phrase, a browser extension, and explicit SOL for every transaction, LazorKit replaces each of those with biometrics, session keys, a paymaster, and on-chain access-control rules.

The project is fully open-source under the MIT license, with core code in TypeScript and Rust. It received an honorable mention in the Infrastructure track of Solana's Breakout Hackathon, and its smart wallet program on mainnet has been audited by Accretion.

Core Mechanism: Passkey Smart Wallets

LazorKit's on-chain program (program-v2) is a smart wallet contract deployed on Solana mainnet at program ID LazorjRFNavitUaBu5m3WaNPjU1maipvSW2rZfAFAKi. Instead of using an ordinary Solana keypair, users authenticate via WebAuthn credentials — passkeys generated and stored in the device's Secure Enclave (Face ID, Touch ID, Windows Hello). The Secp256r1 (P-256) curve, used natively by passkeys and by Apple's Secure Enclave, is verified on Solana via the native Secp256r1 instruction; the private key never leaves the hardware.

The account model is PDA-based:

• Wallet PDA — the identity anchor
• Vault PDA — holds SOL and tokens; the program signs via PDA authority
• Authority PDA — per-key authentication record with role assignment and replay counter
• Session PDA — ephemeral sub-keys with configurable expiry of up to 30 days
• DeferredExec PDA — stores pre-authorized payloads that exceed Solana's single-transaction size limit

Replay protection relies on a monotonic u32 odometer counter per authority, which works correctly even when the same passkey credential is synced across multiple devices via iCloud or Google Password Manager.

Role-Based Access Control and Session Keys

LazorKit V2 implements three authority tiers: Owner, Admin, and Spender. Session keys — temporary, time-limited sub-keys — can carry up to 16 immutable permission rules per session. These rules cover SOL and token spending caps (lifetime, per-window, and per-transaction), per-mint restrictions, and CPI program whitelist or blacklist controls.

This design lets dApps offer a "log in once, act many times" pattern suited to gaming, subscription services, or any application that would otherwise require the user to sign every background transaction explicitly. For payloads exceeding Solana's single-transaction size limit, LazorKit uses a two-step deferred execution flow: the first transaction writes the authorized payload to a DeferredExec PDA, and the second executes it. The Pinocchio zero-copy serialization library keeps on-chain compute costs low throughout.

SDKs and Developer Tooling

LazorKit ships four integration options:

1. React SDK — A LazorkitProvider context wrapper and useWallet hook for web applications, handling WebAuthn ceremonies via a hosted portal URL and exposing connect(), isConnected, wallet.smartWallet, and signAndSendTransaction()
2. React Native SDK — Native iOS and Android bindings with Secure Enclave integration
3. web3.js v1 SDK — Direct contract interaction via LazorKitClient for existing Solana web3.js v1 codebases
4. web3.js v2 SDK — A forthcoming version built on Solana's updated APIs

Each SDK takes three configuration values: an RPC endpoint, a portal URL (where passkey ceremonies occur), and a paymaster URL (which sponsors transaction fees on behalf of users). Fee mode can be toggled between paymaster-sponsored gasless transactions and self-paid.

The LazorKit Cookbook is a companion open-source developer guide offering practical recipe examples including a Face ID wallet without seed phrases, gasless USDC transfers, and a subscription payment proof-of-concept with recurring automated payments. A separate commercial variant, LazorKit Protocol, adds protocol fees, a sharded treasury, and integrator reward tracking for teams building revenue-generating smart wallet products on top of the infrastructure.

Security and Audits

The program-v2 smart wallet contract was audited by Accretion, with all 17 identified security issues resolved before mainnet deployment. Additional protections include CPI reentrancy prevention via stack height checks, signature binding tied to payer, accounts hash, counter, and program ID, a 150-slot freshness window using the Clock sysvar to prevent stale-transaction replay, and the WebAuthn rpId stored on-chain to block cross-origin passkey substitution attacks.

Team and Ecosystem Fit

LazorKit was founded in March 2025. Core contributors visible on GitHub include @chauanhtuan185 and @onspeedhp. The project maintains an active presence on X (@lazorkit) and Telegram. No token has been issued.

LazorKit addresses one of Solana's most persistent onboarding barriers: the requirement for new users to safely store a seed phrase, install a browser extension, and hold SOL before interacting with any dApp. By anchoring authentication in device hardware via WebAuthn, it enables Solana applications to match the sign-in experience of mainstream mobile apps without compromising self-custody. The session key system is particularly suited to Solana's high-throughput, low-latency architecture, allowing games and consumer applications to execute many transactions after a single user approval — a meaningful UX advance for any product targeting non-crypto-native audiences.