SolSharp 4.0.0

SolSharp

A modern, contract-driven, Native AOT-ready .NET SDK for Solana — keys and signatures, program instructions, transaction wire formats, RPC, and WebSocket streaming. SolSharp is independently implemented in C# from pinned Anza Solana SDK, Agave, and SPL source contracts. No reflection is used by the library: JSON is source-generated, all four functional assemblies declare Native AOT compatibility, and CI native-publishes and runs a consumer of the packed package.

SolSharp is built for low latency with focused dependencies and a dependency-light Core. If you are writing bots, indexers, or backend services that talk to Solana from .NET and care about speed and control, this is aimed at you.

Upgrading from 3.x: HTTP transaction/block reads and WebSocket block subscriptions now advertise V1 support, and full options default MaxSupportedTransactionVersion to 1. Existing base58/binary configurations need an explicit 0 or null; use base64, JSON, or jsonParsed to accept V1. The 4.0 migration guide shows how to retain the previous behavior.

Why SolSharp

• Native AOT ready. Source-generated JSON (no reflection), trimmable, AOT-clean — ship a self-contained native binary with instant startup. CI runs a native-compiled smoke test on every push and pull request targeting main.
• Full pinned RPC coverage. The complete applicable non-admin JSON-RPC HTTP surface from the pinned Agave revision, including reads, send/simulate, airdrop, batching, and multiplexed WebSocket subscriptions with automatic reconnect. Explicit account/program subscription options preserve the effective legacy binary, base58, base64, jsonParsed fallback, and base64+zstd response union without publishing no-op Agave fields.
• Wire-level control. Spec-accurate legacy, v0, and feature-gated SIMD-0385 V1 transaction building, signing, and decoding — money-critical encodings are checked against exact vectors from pinned Rust contracts, not only against C# round trips.
• Complete signing workflows. Typed Ed25519 and BLS12-381 values, local/external/null signers, partial signing, Rust-compatible key import/export, vote-account-bound BLS proofs of possession, PoP-gated same-message BLS aggregation, and domain-separated Solana off-chain messages.
• Traceable parity. Exact upstream commit pins, coverage boundaries, and exclusions are published in the Rust parity matrix; SolSharp is independently written and is not an official Anza/Solana product.
• Purposeful dependencies. A dependency-light Core, allocation-free hot paths and span-based APIs; the RPC resilience pipeline and vetted Ed25519/BLS backends are included deliberately.
• Measured quality. Across the four functional assemblies, the reproducible .NET 10 Linux unit-coverage baseline covers 93.7% of hand-written production lines. CI merges overlapping reports, excludes generated sources, publishes line and branch details, enforces a 90% repository-wide line floor, and rejects documentation that overstates the current result.
• Automated security gates. Pull requests run direct/transitive NuGet auditing, dependency review, and CodeQL's extended C# queries; scheduled scans rerun the audit and CodeQL and report OpenSSF supply-chain posture. Ordinary CI/release restores are locked to committed dependency graphs, 5,000 deterministic property-based hostile-input cases exercise transaction decoding per CI run, and the release workflow attaches the verified package, SHA-256 digest, and Sigstore/SLSA build provenance.

Compared with Solnet and the official Rust contracts

Solnet is an established, ecosystem-oriented .NET SDK. This compact comparison uses its published 8.7.0 release; SolSharp is release 4.0.0; the reference column is the pinned official Rust parity matrix.

Solnet repository head contains newer unreleased work; in particular, its current class named V1 does not yet use the pinned SIMD-0385 message body and message-first signature envelope. The full evidence-linked comparison is in the repository README.

Quick start

using SolSharp.Rpc;
using SolSharp.Wallet;
using SolSharp.Programs;

// DI with a built-in resilience pipeline (or: new SolanaRpcClient(httpClient))
services.AddSolanaRpc("https://your-rpc-endpoint");

var lamports = await rpc.GetBalanceAsync(account);

// Build, sign, and send a transfer
using var payer = Keypair.Parse(secret);
var blockhash = (await rpc.GetLatestBlockhashAsync()).Blockhash;

var tx = new TransactionBuilder()
    .SetRecentBlockhash(blockhash)
    .AddInstruction(SystemProgram.Transfer(payer.PublicKey, recipient, 1_000_000))
    .Build(payer);

var signature = await rpc.SendAndConfirmTransactionAsync(tx.Serialize());

// WebSocket streaming
using SolSharp.Rpc;
using SolSharp.Rpc.Streaming;

await using var ws = new SolanaWsClient();
await ws.ConnectAsync(new Uri("wss://your-rpc-endpoint"));
await foreach (var slot in ws.SubscribeSlotsAsync())
    Console.WriteLine(slot.Slot);

var accountChanges = await ws.SubscribeAccountWithOptionsAsync(
    account,
    new AccountSubscriptionOptions { Encoding = RpcAccountEncoding.JsonParsed });

Learn more

• Usage guide — a task-oriented cookbook: keys, export, mnemonics, signed off-chain messages, reads, SPL token state, priority fees, v0 + address lookup tables, SIMD-0385 V1, durable nonces, decoding transactions, subscriptions, batching, and confirmation.
• GitHub repository
• Changelog
• Upstream parity and provenance
• Third-party notices

Security

SolSharp handles private keys and builds transactions that move funds. It has not been audited — use at your own risk. Never export a raw private key to an RPC provider, hosted service, or third-party transaction builder: keep signing behind ISigner, inspect and simulate, then send only signed bytes.

A green security badge means the automated checks found no known issue at the tested revision. It is not a guarantee that the package is vulnerability-free and does not replace an independent security audit.

BLS operations use the packaged native blst backend on linux-x64, linux-arm64, osx-x64, osx-arm64, and win-x64. Other RIDs can use the rest of SolSharp, but cannot call its BLS API.

To report a vulnerability, use the security policy — private reporting, not a public issue.