What's Actually Live in Solidus Wallet Today
The unlinkability implementation described here is unaudited.
This page is the claims ledger for the product: every other wallet page links back here instead of restating what's shipped.
The wallet is a holder, not an issuer or a verifier, identity verification is verify.solidus.network's vocabulary and job, not this one's. What it does is hold a credential someone else issued and let its owner present it again, somewhere else, without redoing the original check. That re-presentation is the point of a non-custodial wallet built for identity, not only for token balances.
The ledger
| Claim | Status | Proof / caveat |
|---|---|---|
| Client-side key generation & signing | Shipped, by design | Architectural invariant, stated in the codebase. Not independently audited. |
| Credential holding & presentation, incl. BBS+ | Shipped, unaudited | @solidus-network/auth unlinkability demo ships in the published npm tarball. |
| Swap | Not shipped | No DEX exists behind the UI surface. |
| Buy / on-ramp | Not shipped | No on-ramp exists behind the UI surface. |
| NFTs | Not shipped | No indexer exists behind the UI surface. |
| Other-chain balances | Unconfirmed | No engineering confirmation either way, not asserted. |
| Token | None exists | No ticker, no token of any kind. |
| Independent audit | None | Targeted H2 2026, via NLnet NGI Zero. |
| Public app-store listing | Not shipped |
Most rows carry an internal-verification citation, not a command a stranger can rerun, the wallet frontend isn't in a public repo. Two rows do have public, rerunnable proof: did:solidus is registered in the W3C DID Method Registry (PR #713, merged 2026-07-04, curl -s https://api.github.com/repos/w3c/did-extensions/pulls/713 | jq '{title,state,merged}'), and credential presentation has a real public artifact, npm i @solidus-network/auth @solidus-network/bbs && node node_modules/@solidus-network/auth/demo/unlinkability-demo.mjs. Everything else, key generation, DID login, guardian recovery, rests on "verified end-to-end against the live node with real guardian accounts" and "by design, stated in the codebase": real internal verification, not something a stranger can rerun today. The credibility comes from naming exactly what's unconfirmed rather than gliding past it.
What's shipped
Client-side key generation is an architectural claim, not an audit result. Keys are generated and signed on the user's own device and never touch a server. Say "by design," not "verified."
Guardian social recovery, per guardian recovery: a chosen set of guardians co-sign an on-chain transaction that rotates the identity to a new key, once enough of them agree. The chain enforces the k-of-n threshold, no company or support desk holds that authority. Built chain-primitive → SDK → relay backend → recovery UI, and verified end-to-end against the live node with real guardian accounts, 2026-07-14. A completed recovery mints a new root key, and per-verifier "remember me" relationships reset as a result. This is not a Solidus invention, Argent shipped social recovery in 2018, and it composes the same seed-phrase alternative and HD wallet key-derivation ideas the rest of the industry already uses.
The wallet holds Verifiable Credentials and Verifiable Presentations issued elsewhere and re-presents them, including BBS+ selective-disclosure presentations. It does not issue credentials. The @solidus-network/auth unlinkability demo is the one row here with a genuine public, rerunnable artifact, cite it as the proof, not the internal-verification line used for the other rows.
The honesty block
None of that is a footnote here, it's the whole genre of this page: name what's verified, what isn't, and what doesn't exist yet.
Where to go next
Wallet Security covers how client-side generation actually works, what a verifiable credential wallet is covers the holder-only role in full, Social Recovery vs. Seed Phrases covers the recovery mechanism in full, and the FAQ has one-line answers to the questions this ledger answers in full.