@censo-custody/censo-solana-wallet
Solana wallet adapter module for Censo Custody
Integrating Censo Custody to your dApp
At a high-level, supporting Censo Custody in your dApp is just like supporting any other wallet supported by the solana wallet adapter. But as a program-based multisig wallet, Censo Custody wallets work a bit differently from other wallets. Because Censo Custody wallets are PDAs (program-derived accounts), it is not possible for the Censo Custody wallet to physically sign a transaction or a message. There is also some transaction overhead the Censo Custody wallet imposes. We have worked hard to minimize the impact of these differences, but supporting the Censo Custody wallet may still require some small modifications from dApp developers.
How the Censo Custody Wallet works
Given that Censo Custody wallets are PDAs, it may not be immediately clear how we can support dApp transactions at all. To explain how we do it, it will be helpful to first describe how the Censo Custody wallet works in general. All transactions on a Censo Custody wallet, whether they are simple transfers, config changes, or dApp transactions, are executed in the context of a "multisig op" account.
First, an "initiation" transaction is executed, which creates and initializes the multisig op account. The multisig op account stores a description of the requested transaction and an "approval disposition" record for each of the multisig signers.
Subsequently, separate "set approval disposition" transactions record the disposition status (Approved or Denied) for each signer.
Once a threshold of approvals or denies have been recorded in the multisig op account, the multisig op may be "finalized", which executes the logic required for that transaction and then removes the multisig op account.
How the Censo Custody Wallet processes dApp transactions
As described above, when a dApp asks the Censo Custody wallet to send or sign a transaction, Censo first initiates a multisig op for that dApp transaction. The transaction instructions are serialized and persisted in the multisig op account in 1 or more "supply instruction" transactions. The multisig op is not considered "initiated" until all of those supply instruction transactions have executed.
When a threshold of approval dispositions have been received and
the finalization transaction is executed, the Censo Custody wallet
program then rehydrates the instructions and executes them using
invoke_signed().
If the dApp had called the signTransaction or signAllTransactions
methods in the wallet adapter, then the signed transaction which
is passed back is not the original transaction the dApp had requested,
but rather the finalization transaction. Similarly, if the dApp had
called the sendTransaction method in the wallet adapter and
supplied 1 or more additional signers, then the Censo Custody wallet
adapter will wait until it receives the finalization transaction
from the Censo backend, and it is this transaction which the
additional signers sign.
What this means for your dApp
There are two main impacts of the Censo Custody wallet design on dApp integration. The first is that Censo cannot support dApp transactions which are pre-signed before being passed to the wallet adapter, and the second is that the finalization transaction imposes a bit of overhead in terms of transaction size, heap usage, call depth, and compute budget.
If a dApp pre-signs a transaction before passing it to the wallet
adapter (whether via sendTransaction, signTransaction, or
signAllTransactions) then Censo will return this error message:
Censo does not support this signing mode. To work around this
error, the dApp simply needs to either wait to sign until the
transaction is returned (if signTransaction or signAllTransactions
was called), or use the signers option (if sendTransaction was
called). Note that it is possible to verify that the returned
finalization transaction does actually correspond to the requested
transaction by reading the instructions from the multisig op and
comparing them.
For most dApps, the main impact of the finalization transaction overhead comes down to how many accounts the dApp transaction uses. The finalization transaction requires 3 additional accounts -- the censo wallet program, the multisig op account and the Censo fee payer, which, to fit in the 1232 bytes available for a transaction, limits the maximum number of accounts available to a dApp transaction to 31 (when there is a single signer and the dApp transaction uses the wallet account). Note that any instruction parameters are already persisted in the multisig op and are not needed in the finalization transaction.
In terms of compute budget, the finalization overhead is fairly minimal, at about 21,500 compute units. The finalization transaction consumes one level of the allowed call depth of 4. Heap usage is harder to calculate, but at a minimum the finalization transaction needs to rehydrate the instructions of the dApp transaction in memory.