Solana Swap Security

Scope

SwapKing is a non-custodial Solana frontend aggregator. We do not deploy Solana smart contracts that hold user funds. We do not hold Solana keys. We do not hold SPL balances. Every Solana swap is a single Solana transaction signed by you, on your device, in your Solana wallet, and broadcast to the Solana network. That means the security properties of SwapKing are largely the security properties of your Solana wallet, your device, and the Solana DEXs the router selects.

If you want a step-by-step explanation of a Solana swap, see How Swap Works. If you want to understand what "best rate" means on Solana and how we measure it, see Methodology.

Architecture

Solana Wallet → SwapKing (quote + routing) → Solana DEX → Solana blockchain → Solana Wallet.

Solana Wallet. Your Solana wallet holds your keys. It signs Solana transactions locally. SwapKing never has access to your private keys or seed phrase.
SwapKing frontend. Runs in your browser. Requests Solana quotes, aggregates routes, builds a Solana transaction. It has no ability to sign or send a Solana transaction on your behalf.
Solana DEX. The liquidity source the router selects. There may be one or several Solana DEXs per swap. Each has its own Solana smart contracts.
Solana blockchain. The transaction is submitted to the Solana network and confirmed by validators.
Solana Wallet. You receive the output SPL token. If the Solana swap fails, the transaction reverts and no SPL tokens move.

Solana wallet permissions

When you connect a Solana wallet, the site requests two things: your Solana public key (to build the Solana transaction) and, at swap time, a signature (to authorize the Solana transaction). The connection itself does not grant any ability to move SPL funds. A Solana signature is scoped to a single transaction and cannot be reused.

SwapKing does not request SPL token approvals of the kind that grant a third party ongoing spending authority. If your Solana wallet UI ever shows an "approve unlimited" prompt while using SwapKing, stop and verify the source before signing.

What SwapKing can and cannot do

Can: read public Solana on-chain data, request Solana quotes from public APIs, build a Solana transaction, ask your Solana wallet to sign it.
Cannot: access your Solana private keys, sign a Solana transaction on your behalf, move SPL funds without your signature, freeze your Solana wallet, reverse a confirmed Solana transaction, or block a specific SPL token at the protocol level.

Third-party dependencies

SwapKing relies on external Solana services. Each one is a dependency and a potential failure point:
Solana RPC providers - for reading Solana blockchain state and submitting Solana transactions.
Solana aggregator and DEX APIs - for SPL token quotes and routes.
Price feeds - for USD displays and reference prices on cross-chain assets.
Hosting and CDN - for serving the site and protecting it from abuse.
Current status and recent incidents are published on the Status page.

Routing and slippage on Solana

The router splits and compares routes across Solana DEXs. It picks the route that maximizes the output SPL token for your specific input amount at the moment of the quote. Solana rates move every block, so the quote you see is a snapshot. Your slippage tolerance is the maximum difference between the quoted Solana rate and the execution rate that you are willing to accept. If the Solana market moves outside that band, the transaction fails and only the Solana network fee is consumed. See Slippage Explained.

Phishing and impersonation

The most common attack against non-custodial Solana users is not a flaw in the aggregator: it is a fake site, a fake SPL token, or a malicious Solana approval prompt. To reduce risk:
- Verify the URL before connecting a Solana wallet.
- Never enter your Solana seed phrase anywhere, for any reason.
- Verify Solana mint addresses on Solscan before swapping into an SPL token you have not seen.
- Revoke old Solana approvals periodically.
See Avoid Scam Tokens, Rug Pull Protection, and Verify a Contract.

Incident history and disclosure

Confirmed incidents affecting the Solana frontend, the Solana quote engine, or the Solana routing layer are published on the Status page with the date, scope, and resolution. We do not publish speculative reports.

Reporting a security issue

Write to [email protected]. Please include reproduction steps, affected URL or Solana route, and any relevant Solana transaction signatures. We acknowledge receipt and follow up as quickly as possible.

What we do not claim

We do not claim that SwapKing is "safe" in an absolute sense. Non-custodial Solana architecture removes a specific class of risk (custodial loss) and does not remove others (SPL token risk, Solana smart contract risk, phishing, Solana wallet compromise, market risk, third-party outages). We do not claim any specific audit or certification unless it is explicitly listed on this page. If we publish an audit or bug bounty program, the scope, the auditor, and the date will be listed here and on the Status page.

Frequently Asked Questions