LazorKit

LazorKit is open-source passkey smart wallet infrastructure for Solana that replaces seed phrases with device biometrics. Founded in March 2025 and MIT-licensed, it describes itself as an "execution layer for Solana" — handling passkey authentication, session key delegation, gas sponsorship, and on-chain permission enforcement so developers do not have to build that infrastructure themselves.

What LazorKit Is

LazorKit is a suite of on-chain programs and client SDKs that let applications create non-custodial smart wallets secured by WebAuthn passkeys. When a user connects, the application initiates a WebAuthn ceremony that authenticates via Face ID, Touch ID, or Windows Hello. A Program Derived Account is derived from the passkey credential, so the same biometric maps to the same on-chain wallet address every time. The private key never leaves the device's Secure Enclave and is synced through iCloud Keychain or Google Password Manager.

How It Works

The core on-chain program deploys to Solana mainnet at LazorjRFNavitUaBu5m3WaNPjU1maipvSW2rZfAFAKi. It uses the Secp256r1 (P-256) curve — the same elliptic curve as WebAuthn and Apple Secure Enclave — allowing passkeys to sign Solana transactions directly on-chain. Signature verification costs approximately 9,441 compute units per passkey operation.

The account architecture consists of five PDA types. The Wallet PDA serves as the identity anchor. The Vault PDA holds SOL and tokens. The Authority PDA tracks each passkey or signer with its credential ID and a monotonic counter. Session PDAs represent time-bound ephemeral sub-keys. DeferredExec PDAs authorize large payloads that exceed a single transaction's byte limit.

For most operations, a user's passkey signs a challenge and the program verifies the Secp256r1 signature on-chain in a single transaction (immediate execution, ~574-byte capacity). For complex operations — like multi-instruction Jupiter swaps that exceed Solana's immediate byte limit — LazorKit uses deferred execution: a first transaction authorizes the payload via signature, a second executes it. This expands effective payload capacity to approximately 1,100 bytes.

Key Features

No seed phrases. Users create wallets using device biometrics in under 30 seconds. No browser extension is required and no 12-to-24-word recovery phrase needs to be managed.

Role-based access control structures authority into three tiers: Owner, Admin, and Spender. Each role has strictly enforced hierarchical permissions with self-removal protection.

Session keys are ephemeral Ed25519 signers with scoped permissions. One passkey prompt mints a session key that supports up to 16 immutable permission rules covering SOL spending caps, per-mint token limits, recurring window budgets, per-transaction maximums, and program whitelists or blacklists for cross-program invocations. Sessions expire by absolute slot (maximum 30 days) and are revocable by Owner or Admin at any time. Session-based execution uses 4,483–5,983 compute units versus 9,441 for passkey operations, substantially reducing costs once a session is established.

Gasless transactions are handled through the Kora paymaster, which sponsors transaction fees so end users do not need to hold SOL to interact with applications.

Developer SDKs

LazorKit ships four client interfaces. The React SDK handles WebAuthn passkey authentication for web applications. The React Native SDK targets iOS and Android with Secure Enclave integration via the @lazorkit/wallet-mobile-adapter package (requires React Native 0.70+ or Expo SDK 50+). Web3.js v1 and v2 SDKs cover direct contract interactions. All SDKs expose a consistent hook pattern: connect, disconnect, signAndSendTransaction, and smartWalletPubkey.

The project is listed as an official Solana Foundation developer template under both Vite and Expo starter configurations, indicating adoption as a recommended starting point for consumer-facing Solana applications.

Security and Audit

The V2 on-chain program completed a security audit by Accretion, a Solana-focused security firm with 60+ audits covering protocols securing more than $2 billion in TVL. All 17 identified issues were resolved before deployment to mainnet.

Several additional security layers are embedded in the protocol design. An odometer counter — a monotonic u32 per authority — prevents replay attacks. A 150-slot freshness window via the Solana Clock sysvar limits transaction staleness without depending on SlotHashes. CPI stack height checks block reentrancy attacks across cross-program invocations. Secp256r1 signatures are validated against an rpId hash, preventing passkey credentials from being used across unintended applications.

Note: the earlier v1 TypeScript SDK repository still carries a "Pre-audit. Do not use in production" warning. The audited program is program-v2 specifically.

Tokens and Assets

LazorKit has no native protocol token. A repository named lazorkit-protocol describes a "revenue-enabled smart wallet with protocol fees, sharded treasury, and integrator reward tracking," suggesting a future fee-sharing model for integrators is under development, but no token has been issued.

Wallet creation costs approximately 0.002399–0.002713 SOL in rent, and per-transaction fees remain at the standard 0.000005 SOL baseline. Session key setup incurs 0.001453 SOL in rent that is refunded when the session closes.

Team

No founding team members are publicly identified. The project is MIT-licensed, open-source, and community-oriented, with active repositories under the lazor-kit GitHub organization, a Telegram community at t.me/lazorkit, and Twitter at @lazorkit.

Solana Ecosystem Fit

LazorKit addresses one of the blockchain industry's most persistent adoption barriers: the complexity of wallet setup. Seed phrases and browser extensions remain a primary reason mainstream users abandon Web3 applications before completing onboarding. By anchoring wallets to passkeys already stored on users' devices and synced across their Apple or Google accounts, LazorKit brings authentication UX to parity with familiar Web2 applications.

The infrastructure is broadly applicable — gaming, DeFi frontends, social applications, commerce — for any Solana project targeting consumer audiences. Session keys reduce the friction of repeated transaction approvals that make most DeFi UX difficult for non-technical users. Gasless sponsorship removes the SOL onboarding requirement entirely.

Solana's native Secp256r1 precompile support, added in late 2024, makes this architecture possible without routing signatures through off-chain components. LazorKit is among the first projects to productize that capability with a complete SDK suite and an audited on-chain program deployed to mainnet.