Solana Blockchain

SPL token custody, deposits and withdrawals on Solana — a licensed chain module for Ecosystem, what it adds, the two gates that must both pass, and the RPC constraint that decides whether it survives production.

4 min readUpdated 3 August 2026solana, spl, custody, deposits, withdrawals

Solana Blockchain is one of four licensed chain modules that extend Ecosystem's custody to a chain the base addon does not carry. With it installed and enabled, an ECO wallet gains a Solana deposit address, the platform detects and credits native SOL and SPL token deposits at that address, and it signs withdrawals back out.

It is not a trading feature and it is not a wallet connector. It is custody: the platform holds a private key for every user's Solana address, and when a withdrawal fails, nobody else is going to fix it.

What it requires

Solana is a chain module for Ecosystem. Installing it without Ecosystem gives you an unreachable code path and a database row.

Requirement	Why	If it is missing
Bicrypto	The platform, its database, Redis and processes	Nothing runs
Ecosystem	ECO wallets, the vault, master wallets, the deposit and withdrawal engines	The chain has nothing to plug into
An activated Solana licence	Envato item `54514052`	The chain toggle refuses with 403 and the service reports itself inactive
The chain service files	`backend/src/blockchains/sol.ts`	Diagnostics report "Chain service installed: no" and every flow is dead

ScyllaDB is an Ecosystem requirement, not a Solana one — but Ecosystem is not optional here, so plan for it. Read Ecosystem's install page and Master wallets and the vault before you touch anything on this page. The vault must be unlocked before a single Solana key can be created or read.

What it adds

A per-user Solana address. Every ECO wallet whose currency exists as an active Solana token gets an address in its address map. Coins sent there are the customer's; the platform holds the key.

Native SOL custody. SOL is a NATIVE token in Ecosystem's model. Deposits land at the user's own address and native withdrawals are signed by that same address, paying the network fee out of the balance being withdrawn.

SPL token custody. SPL tokens are carried as PERMIT tokens. They also land at the user's own address — there is no custodial contract on Solana and the platform never asks for one — and their withdrawals are signed by the user's key with the master wallet as fee payer.

SPL mint deployment. Admin → Ecosystem → Tokens can create a new SPL mint signed by the Solana master wallet, then mint an initial supply to a holder you nominate, as a background job.

Chain diagnostics. Solana appears in Admin → Ecosystem → Blockchains → Requirements with its own probe: cluster resolution, getHealth, getSlot, licence and service checks, and per-flow readiness for deposits and withdrawals.

The two gates

Solana is gated twice, and both gates must pass before the service will do anything. This is checked at service construction and re-checked whenever the service is used while inactive, so enabling the chain does not require a restart in order to clear the gate — although a .env change does.

The licence file. Activation writes lic/54514052.lic — encrypted and machine-bound. Enabling the chain without it returns 403 "Cannot enable blockchain: License not activated."
The database row. ecosystem_blockchain is seeded with a Solana row carrying product ID 54514052 and status: false. Admin → Ecosystem → Blockchains flips it.

Fail either and the service throws "Solana service not available. Please ensure your license is activated and the blockchain is enabled." on every call — address generation, deposit monitoring, withdrawal signing and mint deployment alike.

The constraint that decides your production experience

The Solana service builds its connection from SOL_NETWORK alone and always uses the public cluster endpoint for the chosen cluster. It does not read a URL from anywhere. SOLANA_RPC_URL exists, but it is consumed only by the admin token-deployment cost estimate — the runtime ignores it.

Every deposit subscription, every balance read, every withdrawal broadcast and confirmation on your install goes to api.mainnet-beta.solana.com, on the same anonymous quota as everybody else pointing at it.

This is the single most important thing to understand before you sell SOL deposits to customers. The code carries retry, de-duplication and result-caching logic specifically because 429s are expected, and the background deposit scanner paces Solana at 0.5 address scans per second for the same reason. It is survivable at modest volume and it is not something you can buy your way out of by adding a paid RPC key.

Network and RPC covers what that means in practice, what degrades first, and what you can actually control.

Where to start

Install and enable

Licence, the chain toggle, SOL_NETWORK, the restart, and the master wallet — in the order that does not strand a key.

Network and RPC

Cluster selection, the two network variables that are not the same variable, and why a public RPC is the ceiling on this chain.

Wallets and key custody

What the Solana master wallet pays for, how user addresses are created, and why Solana addresses are not derived from the master wallet.

Deposits

How a native SOL transfer and an SPL transfer are each detected, and what has to run before the balance moves.

Withdrawals and fees

The queue, the platform fee, the fee reservation that can shrink a full-balance send, and the TIMEOUT status that exists to stop a wrong refund.

Environment reference

Every variable this chain reads, the ones that only affect metadata, and the ones that are read by nothing.

Three facts worth knowing on day zero

SOL_NETWORK fails towards devnet, silently. Unset, misspelled, or set to the plausible-looking mainnet-beta, the service connects to devnet and everything appears to work — addresses generate, the diagnostics pass, deposits never arrive. Only the literal strings mainnet and testnet are recognised.

Solana token rows are never network-filtered. Ecosystem skips tokens whose network disagrees with the chain's configured network, but Solana is on the network-agnostic list, so a token row labelled devnet is still offered on a mainnet install. On this chain, the token row's network label is your responsibility, not the platform's.

Nothing here is in .env.example. SOL_NETWORK and its siblings are not shipped in the sample environment file. You add them by hand, and a fresh install that has never had them is, by definition, on devnet.