Velon
GitHub Open test bench

Open source · Solana mainnet and devnet

Take back every approval.

Apps you used once can still move your tokens. Velon finds every key that can, proves the revoke before you sign, and proves it again after.

Try it on the test bench Read the source
  • Connecting signs nothing
  • You approve every transaction
Velon console card: a program-derived address may spend up to 194 base units from the wallet's token account, with a Revoke button. Velon review dialog before signing: who, what, limit, network, and the result Velon executed itself: delegate and allowance cleared, nothing else changed. Deployment verified. Velon result: Revoked and verified, with the transaction, finalized slot 419474793 and a verification ID.
Captured from a real revoke on a local Agave 4.3.2 validator, finalized at slot 419,474,793.
NetworksSolana mainnet, devnet and a local validator
WalletsAny Wallet Standard wallet
RevocableSPL Token delegates
Read onlySolana Subscriptions, Token-2022

The problem

An approval outlives the app that asked for it.

Swaps, aggregators, payment and subscription apps ask for a delegate on your token account. The tab closes. The delegate stays, and it can move tokens without asking again until you revoke it.

When one of those apps is compromised, every wallet that approved it needs a revoke it can trust, fast.

Why Velon

Proof on both sides of your signature.

Executed before you sign

Velon runs the exact Revoke instruction itself, on the finalized bank it observed, with that cluster's activated features and the verified SPL Token program. A provider's simulation must reach the same account state.

Cluster
Solana mainnet
Observed
finalized slot 460,066,667
Program
sha256 8190d3f7…f697
Deployed
slot 419,472,000
Runtime
Agave a2033000
Features
sha256 d19ca0d3…8f48

Names the delegate

Who holds the permission, read from the chain: a wallet, a program's signer or a known program.

Fails closed

If anything disagrees, nothing is offered for signing. Some of the runtime's refusals:

  • feature unknown to the pinned runtime
  • simulation precedes observation
  • simulation/context slot mismatch
  • feature evidence outside observed bank

Read again after finality

"Revoked" appears only after the chain confirms the delegate is gone.

Revoked and verified, with transaction, finalized slot and verification ID.

A receipt that replays without the chain

Every verified revoke keeps its evidence. Replay it later and the result still checks out.

Receipt: Revoked on the test chain, with account, finalized slot, signature, verification ID and a Replay proof button.

How it works

Four steps. Two of them are proof.

  1. 01

    Observe

    Reads your token accounts from a finalized bank and lists every delegate, with how much it may spend.

  2. 02

    Execute

    Runs the revoke on that bank itself. A provider's simulation must reach the same account state.

  3. 03

    Sign

    Your wallet signs the exact bytes that were reviewed, and nothing else.

  4. 04

    Verify

    Waits for finality, reads the account again, confirms the delegate is gone and issues a verification ID.

Who it is for

Wherever a key can still spend.

Wallets

Who can spend this, next to every balance.

The SDK turns token accounts into exact permissions and builds revokes your users review before they sign.

Treasuries

Know every delegate on the team's tokens.

List delegates across a treasury's token accounts. Squads V4 spending limits are modelled in the SDK.

Exploit response

A revoke people can trust when it matters.

When a protocol is compromised, each affected wallet sees the exact delegate, signs one reviewed revoke and gets a verification ID.

Developers

Open source, end to end.

The runtime that observes, executes and verifies, the SDK and the console live in one public repository. Run it with recorded evidence, point it at mainnet or devnet, or start a local validator with the real SPL Token program.

runtime/
Observes finalized state, executes and verifies revokes
sdk/
Protocol adapters and reviewed signing
arm/
The permission model
app/
The console
Run it locally 
$ git clone https://github.com/dakewamama/velon.git
$ cd velon/app
$ npm ci --ignore-scripts
$ bun run demo

Opens on http://127.0.0.1:3000 with recorded evidence. No RPC key needed.

Try a revoke on a disposable chain.

The test bench gives you a real permission on a test validator and a test wallet to revoke it. Nothing to install, nothing at stake.

Open the test bench Read the source