5

this seems like a cool concept : https://solanacookbook.com/references/keypairs-and-wallets.html#how-to-generate-a-vanity-address

with this i can generate custom addresses starting with custom words, but is there a security risk for generating the program id this way ?

Improve this question

5 Answers 5

Reset to default
4

No, It's the same as any randomly generated Keypairs. Some security precautions you should follow very very carefully like:

  • Keeping the corresponding secret key in a very very secure cage.
  • Use a secure server/computer to generate Keypairs.
Improve this answer
1
  • this isn't entirely true. fixing public key bits limits the private key search space
    – trent.sol
    Commented Jul 26, 2022 at 18:13
1

Yes. Technically, fixing bits in the output reduces the input search space. In the case of ed25519 it is still quite infeasible as this is effectively a preimage attack on SHA512

Improve this answer
2
  • but after the program is deployed it does not matter does it ?
    – Nabeel Naveed
    Commented Jul 26, 2022 at 22:10
  • so long as you strictly use the keypair for the program address reservation and destroy it afterwards, it should be fine. there was nothing about program deployment in the OP though, so if there's a new question, create a new post
    – trent.sol
    Commented Jul 26, 2022 at 22:51
1

Once you deploy a program using that uses the generated vanity address, it should not matter.

After the address is "taken" but a program, it will have an "update authority" stored on-chain. Only this "update authority" wallet will have the ability to publish a new version of the program, and effectively be the only address that can change the program.

Improve this answer
0

No, it is the same as a randomly generated Keypair, only harder/longer to obtain depending on how many characters you intend to grind.

Improve this answer
0

The only security issue is if someone accesses the server you generated the key pair file on.

Improve this answer
3
  • once deployed even if the private key of a program id json file leaks its useless no ?
    – Nabeel Naveed
    Commented Jul 26, 2022 at 10:58
  • Is that any different from someone accessing the server where a keypair was generated at random?
    – man0s
    Commented Jul 26, 2022 at 11:04
  • Yes, once the program is deployed the only key pair that matters is the key pair of the upgrade authority.
    – Henry E
    Commented Jul 26, 2022 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.