Protocol
Where Trana sits
in the stack.
Every Trana-protected instruction needs two approvals: a standard Solana wallet signature and a live FIDO2 device proof. Both verified onchain. Neither alone is enough.
Trana Guard and the FIDO2 device ship as a pair. The guard is useless without the device. The device signature is useless without the guard in the program.
Each layer explained
Your wallet key signs the transaction. Same as any other Solana program. Trana adds one requirement on top: that signature alone is no longer enough to execute.
A passkey (Touch ID, Face ID, iCloud Keychain) or hardware key (YubiKey, Google Titan) holds a P-256 private key that never leaves the device. It signs an intent hash — a SHA-256 commitment to the exact action, parameters, accounts, program, nonce, and expiry.
Trana Guard — secp256r1 verification
The guard program verifies the P-256 signature using the Solana secp256r1 precompile (SIMD-0075, live since February 2025). It recomputes the intent hash from the live transaction at execution time and rejects anything that doesn't match. No server involved.
Your program calls guard::cpi::enforce() at the top of any instruction you want to protect. One CPI call. No changes to your account structure beyond adding three Trana accounts.
Solana provides the ledger and, via SIMD-0075, a native secp256r1 signature verification instruction. This precompile is part of the validator software itself — not a Trana contract. It is the cryptographic root of trust.
Protocol properties
Trustless
Verification runs inside the Solana validator. Trana holds no admin key and no custody.
Non-custodial
Your wallet key and your FIDO2 device are both under your control. No third party holds either.
Replay-proof
The enforcement nonce increments after every successful proof. Captured proofs are useless on the next call.
Parameter-bound
The intent hash commits to exact accounts and params. Any modification after approval fails verification.
Expiry-enforced
Proofs expire in 120 seconds by default. No pre-collection, no timed replay attacks.
Composable
Any Anchor program can add Trana protection with one CPI call. No vault, no migration, no custody change.