Sanctum docs
How to use each part of Sanctum, with the exact fees and limits. For the idea behind it, read How it works.
Getting started
Three steps take you from nothing to a first trade.
- Create an account. Press Sign in, then Create account. Save the key you are shown.
- Deposit. Open Deposit from the balance in the top bar and send SOL to your address.
- Trade. Search for a coin by name, or paste its address, in the bar at the top, and buy.
Accounts and keys
An account is a key pair made in your browser. The private half signs every request; the public half is the account's identity on the ledger. There are two ways to get one.
| Kind | How it's made | Other devices |
|---|---|---|
| Key account | A random key, created instantly. No wallet needed. | Paste your saved key under “I have a key”. |
| Wallet account | Derived from one free signature by your Solana wallet. | Sign the same message with the same wallet. |
Back up a key account. The key is stored only in this browser. If you clear the browser and have no copy, the account cannot be opened again and nobody can recover it for you. You can view it again from the account menu, under Back up my key.
Anyone holding the key can trade and withdraw from the account. Do not share it.
Deposits
Every account has one permanent deposit address. Send SOL to it from any wallet or exchange.
- Minimum 0.01 SOL. Smaller transfers are ignored.
- Send SOL only. Other tokens sent to the address are not credited.
- Credited when the transfer confirms, usually within seconds.
- A network cost of 0.000005 SOL is taken when the deposit is moved into the shared wallet.
Encrypted deposits. On a live engine, an account made from a wallet also gets an Encrypted option. Your wallet funds a private wallet that belongs to your account, which pays Sanctum through Helius Privacy Rings. The amount is encrypted on that last hop; the two addresses are still visible. It takes about a minute, and about 0.006 SOL stays in the private wallet to pay its own fees.
Buying and selling
Any Solana coin with a route on Jupiter can be traded, unless it fails the safety checks. Orders are market orders with 5% slippage tolerance.
- Buy: enter SOL to spend. The quote shows roughly how many tokens you get after the fee.
- Sell: choose a share of your position. A sale worth less than 0.01 SOL is refused.
- If a trade cannot be completed, the order is marked not filled and your balance is restored.
On the coin page, your fills appear as B and S marks on the chart and in the My trades tab. Only you can see them.
Auto orders
Rules that trade for you. They are stored in the ledger and are not placed on chain, so nobody can see your targets. Set them from a coin's Auto tab. Targets are entered as a market cap.
| Order | What it does |
|---|---|
| Limit buy | Buys a set amount of SOL when the market cap falls to your target. |
| Take profit | Sells 25%, 50% or 100% of your position when the market cap reaches your target. |
| Stop loss | Sells part or all of your position when the market cap falls to your target. |
| DCA | Buys a set amount on a schedule, a set number of times. |
- Prices are checked about every 10 seconds, so a fill can land a little past its target.
- Funds are not reserved. An order fills only if your balance covers it at that moment.
- Up to 20 open orders per account. Cancel any of them from the coin page or Portfolio.
Pay
Send SOL to another account by name. Claim a name on the Pay page: 3 to 15 letters, numbers or underscores.
- Payments are ledger entries. No transaction is created, so there is nothing to find on chain.
- Instant and free. Minimum 0.001 SOL.
- Share
/pay/@yournameto be paid, or/pay/@yourname?amount=0.5to ask for an amount. - A name is not linked to any wallet address.
Paying someone outside Sanctum. On a live engine the Pay page can also pay a Solana address privately. The shared wallet pays that address's Privacy Rings wallet: the chain shows Sanctum paid the address, the amount is encrypted, and nothing shows it came from you. The address must already have a Privacy Rings wallet; the page tells you if it does. The fee is the withdrawal fee, 0.002 SOL, and the limit is 2 SOL a payment.
Withdrawals
Withdraw SOL to any Solana address from the Withdraw tab of the funds dialog. The shared wallet sends it, usually in under a minute.
- The amount and the destination are public. The account that asked is not.
- To withdraw a coin, sell it first: payouts are in SOL.
- Withdrawals are processed ahead of trades, so they are not held up by a busy market.
Encrypted withdrawals. Wallet accounts on a live engine can choose Encrypted instead: Sanctum pays your private wallet through Privacy Rings with the amount hidden, and you then move it to your own wallet from the same dialog. That last move is public.
Privacy Rings
Helius Privacy Rings is a shielded pool on Solana. Inside it, the amount and the asset of a balance or a transfer are encrypted. Sanctum uses it wherever money crosses its edge, because an ordinary transfer there would show exactly how much went in or out.
| What | Who can use it | What the chain shows |
|---|---|---|
| Encrypted deposit | Accounts made from a wallet | Your wallet funded your private wallet (amount shown); your private wallet paid Sanctum (amount hidden) |
| Encrypted withdrawal | Accounts made from a wallet | Sanctum paid your private wallet (amount hidden); moving it on to your own wallet shows the amount |
| Private pay to an address | Any account | Sanctum paid that address's private wallet (amount hidden). Nothing links it to you |
- Your private wallet. Every account has one, made from the account key, so there is nothing more to back up. It is opened the first time you choose an Encrypted option.
- Its own fee money. A private wallet pays the network fee for its own transfers, so an encrypted deposit leaves about 0.006 SOL in it.
- Read from the chain each visit. The wallet's balance is worked out afresh every time it opens, which can take up to half a minute. If it ever looks wrong, press Refresh on the private wallet row in the funds dialog.
- Who can be paid privately. An address needs a Privacy Rings wallet of its own. The Pay page checks before it lets you send.
- Batches. Private payouts can be held briefly and sent several at a time in one transfer, so one can't be matched to a deposit by its timing. When this is on, the Pay page says how often they go out.
- The limit of the public ring. It hides how much, never who: the two addresses of a private transfer are visible on chain.
These options appear only on a live engine with Privacy Rings switched on. Elsewhere the dialogs say so.
Trading wallets
Sanctum does not trade from one address. A main wallet takes deposits and makes payouts, and several trading wallets buy and hold the coins. Without that, one address would appear in a coin's holder list as a single large holder.
- A trading wallet adds to a coin only while it stays under 1.5% of that coin's supply.
- The fullest wallet that still has room makes the next buy, so a coin sits in as few wallets as its size needs.
- When the wallets holding a coin are full, an empty one opens. When every wallet holds it and none has room, the buy is refused and nothing is charged.
- One order is one swap and is never split, so a single large buy of a very small coin can put one wallet above 1.5%.
- A sell comes from the wallet holding the most of the coin. If it holds less than you are selling, the rest is moved into it first, which adds a few seconds.
- None of this changes what you own: the ledger records your balance, whichever wallet holds the coins.
The trading wallets are not secret. They are topped up from the main wallet and listed on the Reserves page, because the reserves have to be countable. What they change is how Sanctum's holdings look to someone reading a coin's holders.
Fees and limits
| Item | Amount |
|---|---|
| Trading fee | 1% of the SOL in a buy or out of a sell |
| Network cost per trade | 0.0004 SOL, plus 0.00204 SOL if the shared wallet has to open a new token account |
| Withdrawal or private payment | 0.002 SOL |
| Payments between accounts | Free |
| Smallest trade | 0.02 SOL |
| Largest trade, withdrawal or private payment | 2 SOL each |
| A trading wallet's share of one coin | Up to 1.5% of its supply |
| Smallest deposit / withdrawal | 0.01 SOL |
| Open auto orders | 20 per account |
Safety checks on coins
Because every account's coins sit in one wallet, a coin that could freeze or seize tokens would put everyone at risk. These are refused outright:
- Coins with a freeze authority.
- Token-2022 coins with transfer fees, transfer hooks, a permanent delegate, or similar extensions.
The Safety tab on a coin page also shows the mint authority, how much the top ten holders, the creator and bots hold, and how many coins the creator has launched. Those are information, not a block: judge them yourself.
Reserves and proofs
The Reserves page shows what Sanctum owes and what the shared wallet holds.
- Every five minutes a snapshot is taken: each balance is split into four random pieces, hashed, and combined into a tree whose root commits to the total owed.
- Every hour the root is written to Solana in a memo transaction from the shared wallet.
- Verify my balance downloads your proof and rebuilds the root in your browser. A match means your balance is counted in the published total.
- A new balance appears in the next snapshot, within five minutes.
- The totals count the main wallet and every trading wallet.
Paper mode
When the banner at the top says Paper mode, nothing is real money. You get practice SOL from the Deposit dialog, and trades fill at the live Jupiter price without touching the chain. Deposit addresses are not watched, so do not send real SOL in paper mode.
Questions
Is Sanctum custodial? Yes. While your funds are in an account, the shared wallet holds them. The reserves proof and the withdraw button are how you check and exit.
Can Sanctum see my trades? The ledger has to know them to keep your balance. They are not published, and are not on chain.
Why was my order not filled? Most often the price moved past the slippage limit, the route disappeared, or the balance was short. Nothing is charged for an order that does not fill.
Why is trading paused? If the audit finds the wallet holds less than the ledger owes, everything stops until it is resolved. One coin can also be frozen on its own.
I lost my key. A key account cannot be recovered without it. A wallet account can always be reopened by signing with the same wallet.