SolMate | Crypto Wallet and Community Flutter App for Solana With Node Backend

SolMate | Crypto Wallet and Community Flutter App for Solana With Node Backend

Looking for a memecoin launchpad instead? If you want a pump.fun / FOMO style launch platform rather than a wallet, take a look at FunPump: funpump.foundrcode.com

Questions before you buy? Email ezeematrix@gmail.com or message us on WhatsApp.

SolMate is a complete, ready to launch non-custodial Solana wallet with a community built in. Users create a wallet from a recovery phrase or import one they already have, hold and send SOL and SPL tokens, browse their NFTs, and talk to each other in a real social feed. The private key is created on the user’s own device, encrypted there, and never sent anywhere. SolMate ships as three connected apps that share one backend, so you get a mobile app, a website with a white label admin panel, and the API that powers both in a single package. It also ships with the ways a wallet actually makes money: a token swap that pays you a fee on every trade, a card purchase flow that pays you an affiliate share, and marketing placements you can fill yourself or sell.

This item is built for founders and agencies who want to launch their own branded crypto wallet, for communities that want a wallet their members actually talk inside of, and for developers who want a solid Solana starting point instead of building key management, transaction signing, asset lookups, and a social layer from scratch. It runs out of the box with zero third-party accounts. Everything points at Solana devnet on install, so you can create wallets and move test funds for free, and the API can even start on a bundled in-memory database with no MongoDB installed.

Please read before you buy. SolMate is software, not a financial service, and it is sold without any license, registration, or approval. Operating a crypto wallet for other people can be a regulated activity, and the mobile app stores apply their own rules to crypto apps. You are responsible for compliance in every market you serve. The full notice is further down this page, and you should take legal advice before you go live.

Features

Non-custodial wallet

• Create a brand new wallet from a standard twelve word BIP39 recovery phrase, generated on the device.
• Import an existing wallet from a recovery phrase, a private key, or a full keypair. The format is detected automatically.
• Recovery phrase backup screen with tap to reveal, a numbered word grid, and a mandatory acknowledgement before the user can continue.
• Keys are encrypted at rest on the device and unlocked with a six digit PIN or biometrics (Face ID, Touch ID, or fingerprint).
• Keys never reach the server. There is no endpoint that accepts, returns, or stores key material of any kind.
• Users who already have a wallet can connect Phantom or Solflare instead, over the official encrypted deep link session.

Send and receive

• Send SOL and any SPL token, with an optional memo. The website also supports mints on the newer SPL token program.
• Transactions are built and signed on the device and submitted straight to the network. The server never touches a key or a signature.
• Receive screen with a QR code, a copyable address, and a clear reminder to send only Solana assets.
• QR scanning from the camera in the mobile app, reading both plain addresses and Solana Pay links.
• Address validation, a fee aware MAX button that leaves enough SOL for the network fee, and a warning when the balance cannot cover the fee.
• Recipients who do not yet hold the token get their token account created and funded as part of the send, with the small rent cost shown up front.
• An explicit review step showing amount, recipient, memo, the network fee, and an irreversibility warning before anything is signed.
• A success receipt with the transaction signature, a copy button, and a link straight to the block explorer.

Tokens and collectibles

• Holdings list with token names, symbols, logos, balances, and live USD values, plus a portfolio total.
• Well known assets are recognized and listed first, with USDC, USDT, wSOL, mSOL, JitoSOL, JUP, and wrapped ETH among them, so airdropped spam does not bury real balances.
• Tokens with no known price simply show no fiat line, instead of a misleading zero.
• NFT gallery with artwork, read from on chain Metaplex metadata, with graceful fallbacks for missing images.
• NFT detail view with full size artwork, the copyable mint address, and a link to the block explorer.
• Wallet transaction history read directly from the chain, with send and receive direction, fees, status, and per transaction explorer links.
• Live SOL price, shown on the website with a daily change indicator.

Community

• Community feed with posts and images, an All tab and a Following tab, and paged loading as you scroll.
• Likes and threaded comments, with optimistic updates so the interface never feels like it is waiting.
• Follow and unfollow other users, with follower and following lists.
• Public profiles addressed by wallet, linked from every post and every comment.
• Notifications for follows, likes, comments, and admin announcements, delivered live over a socket connection.
• Optional push notifications through Firebase Cloud Messaging on mobile.

Ways to earn

A wallet costs money to run, so SolMate ships with three revenue lines. All of them are switched on and configured from the admin panel with no code change, all of them are off or unconfigured on a fresh install, and none of them ever takes custody of a user’s funds.

• Swap fee. Users swap SOL and SPL tokens without leaving the wallet, with routes priced by the Jupiter aggregator. You take a cut of every swap, set in basis points in the admin panel, and it is shown to the user before they confirm rather than hidden in the price. The swap does not change the trust model: the server returns an unsigned transaction and the client signs it on the device, exactly as it does for a transfer.
• Buy with a card. A Buy button hands the user to an on-ramp partner (Onramper, MoonPay, Transak, or any provider through a custom URL template) with your affiliate key attached, and you earn the provider’s affiliate share. The purchase happens on their checkout and the SOL is delivered straight to the user’s own address. No funds pass through this product.
• Marketing placements. A rotating carousel, a slim banner and an interstitial popup, on both the website and the mobile app. Create campaigns with an image, headline, link and button, schedule them with start and end dates, target them by platform and language, weight how often each one wins the slot, and cap how often a popup repeats. Impressions and clicks are counted per campaign, so you can promote your own things or sell the slot and price it on real numbers. Every placement is labelled Sponsored.

The swap runs against mainnet liquidity, so on the devnet demo you will see live quotes with execution disabled and a clear explanation why.

Sign in with your wallet

There are no passwords anywhere in SolMate. To sign in, the client asks the server for a single use challenge: a random nonce bound to that wallet address, valid for five minutes, held server side. The user signs that exact text, and the server verifies the signature, confirms the challenge is one it issued to that address, checks it has not expired, and destroys it in the same atomic step that reads it. A signature is therefore good for exactly one login, so a captured message and signature pair cannot be replayed. The server then issues a session token bound to that address. Endpoints that read wallet material or act on a user’s behalf require that session, and a user can never act on another user’s account. The session is stored in secure device storage on mobile and is invalidated automatically when the connected wallet changes.

Admin and white label

SolMate includes a full white label admin panel on the website, so you can run the product as your own brand without touching code. The panel is organized into clear sections:

• Overview: a revenue and audience dashboard. Swap fees earned, swap volume, ad impressions with their click through rate and ad revenue, then users, posts, verified and banned accounts, each over a thirty day trend chart, with your best performing campaigns and your most recent swaps listed underneath.
• Branding: set the product name, tagline, description, logo, primary color, and social links, with a live preview. Your chosen color retints the whole interface at runtime.
• Legal pages: edit the terms, privacy policy, and risk disclaimer in place. Your saved copy replaces the bundled template on the live site.
• Users: a searchable, paginated user list with ban, verify, and promote to admin controls.
• Broadcast: push an announcement to every user, or to a specific list of wallet addresses.
• Marketing: create, schedule, target and weight ad campaigns for the carousel, banner and popup placements, and read their impressions and clicks.
• Earning: switch the swap, the card purchase and the marketing placements on or off, set your swap fee and the accounts it is paid into, and store your on-ramp affiliate key.

Access is tied to the admin wallet you configure. The reviewer or an admin signs in with that wallet and the admin link appears in the wallet menu. Access is verified on the server, not just hidden in the interface.

Localization and design

• Website localization in English, Arabic, and Spanish, with full right to left support for Arabic including mirrored icons and a no flash language switch.
• Mobile app localization in English and Arabic, again with right to left layout.
• A single gold on dark visual language across mobile and web, with skeleton loaders, motion, empty states, and toasts already built.

How SolMate protects a user’s keys

This is the part that matters most in a wallet, so it is worth being precise about. When a user creates a wallet in the mobile app, a twelve word BIP39 recovery phrase is generated on the device and the Solana keypair is derived from it there. Nothing about that process involves the server.

Before the keypair or the phrase is written to storage, it is encrypted. The app generates a random 256 bit device key once per install and puts it in the operating system’s own secure store, which is the iOS Keychain or the Android Keystore. From that device key it derives two separate sub keys, one for encryption and one for authentication. Records are encrypted with AES in CBC mode using a fresh random initialization vector every time, then an HMAC SHA256 tag is computed over the initialization vector and the ciphertext. The tag is verified with a constant time comparison before anything is ever decrypted, so tampered data is rejected rather than parsed.

The unlock PIN is treated as what it is, a four to six digit secret, so it is never hashed straight into a key. It goes through PBKDF2 HMAC SHA256 with a random per wallet salt and 210,000 iterations, the OWASP floor for that construction, and anything encrypted under it uses AES GCM so a tampered record fails to open instead of decrypting into something the app might act on. The PIN itself is never stored in any form, only a salted verifier that is compared in constant time. When a user disconnects their wallet, the app clears the encrypted records, the PIN hash, and the device key itself, which makes any residue left on the device permanently undecryptable.

Sending funds follows the same rule. The transaction is assembled on the device, signed there, and submitted to the Solana RPC endpoint directly. The only credential the app ever sends to the API is a signature proving ownership of an address. If you audit one thing in this package, audit that: there is no send endpoint on the server to find.

Mobile app

The Flutter app is the full product on a phone, for both iOS and Android: onboarding, wallet creation and import, recovery phrase backup, PIN and biometric unlock, balances and portfolio value, send with QR scanning, receive with a QR code, NFT gallery, on chain history, the community feed, profiles, notifications, in app support chat, and a settings screen with language, security, and wallet management. It talks to the same Node API as the website, so activity stays in sync across both.

What is included

• Flutter mobile app: the full native app for iOS and Android, with wallet creation and import, on device encryption, PIN and biometric unlock, client side signing, assets, NFTs, history, and community.
• Next.js website: TypeScript and Tailwind, with the landing page, the wallet dashboard, the community feed, public profiles, editable legal pages, localization, and the white label admin panel.
• Node and Express API with MongoDB: the shared backend that powers the app and the website, including wallet signature authentication, asset and NFT lookups, on chain history, the social layer, notifications, admin settings, the swap and on ramp endpoints, and ad delivery with impression and click tracking.
• Documentation: a standalone HTML guide that walks you through install, configuration, branding, going to mainnet, and the optional integrations.

Requirements

• Node.js and MongoDB to run the API. A bundled in-memory database option lets you run it with no MongoDB installed at all, which is the fastest way to see it working.
• The Flutter SDK to build the mobile app for iOS and Android.
• Node.js to build and run the website.
• A Solana RPC endpoint. The free public devnet RPC works out of the box, so you can run and test the whole product with no paid services.

Live demo and test access

Try the full product on the live demo: https://solmate.foundrcode.com

The demo runs on Solana devnet, so no real funds are involved and nothing on it has monetary value. To use it as an ordinary user, open the site, choose Connect, and either connect a browser wallet or generate a test keypair right there in the page. Approve the one time sign in signature, then get free devnet SOL from the official faucet at https://faucet.solana.com and try sending, receiving, and posting in the community feed.

To open the white label admin panel, import the temporary test wallet below. Choose Connect, then the import option, and paste this base58 private key:

4sAzV3FLavQT3n8L6DWvagvamQ96UYpigmBLYfMz15RfiWP8Ubq9XEpi7s1ayFS2avL212GdSaa3XARTP9fvYu5g

These are temporary credentials, strictly for testing this demo. The wallet is shared, devnet only, and holds no real value. It is not part of the product you buy: your own deployment ships with no preset wallet and no preset admin. Never reuse this key on mainnet or fund it with real assets.

With that wallet connected, the admin link appears in the wallet menu. Use it to explore Overview, Branding, Legal pages, Users, and Broadcast on the live site.

Going to mainnet

Everything ships pointed at Solana devnet so you can test for free and so a mistake costs nothing. Moving to mainnet means pointing the API and the website at a mainnet RPC endpoint in their environment files, and updating the RPC constant in the mobile app. The documentation walks through it, along with what you should have in place before you serve real funds.

Third-party services and costs

SolMate runs out of the box on Solana devnet with no paid accounts. Every third-party service below is optional, and each one is billed by its own provider directly to you, the buyer. These costs are not included in the item price.

• Firebase Cloud Messaging (external service): optional, and used only for push notifications on mobile. It is operated by Google, not by us. Enabling it requires you to create your own separate Firebase account and project, and Google may charge you for it under their own pricing, which can change at any time. Those charges are billed by Google directly to you and are not included in the item price. Leave it switched off and the product runs normally — in-app and website notifications still work, and only device push is unavailable.
• AWS S3 or Firebase Storage: optional image hosting for post images and avatars. Local disk storage is the default, so this is only needed if you choose cloud storage, and it is billed by the provider you pick.
• Supoora: optional support chat widget. Leave it unset and the widget simply does not load. Billed by Supoora if you enable it.
• Jupiter: optional. The swap aggregator that prices and builds in wallet swaps. The public endpoint needs no account and no payment; a paid plan is only worth it at volume, and the swap can be switched off entirely. Billed by Jupiter if you take a paid plan.
• On ramp provider: optional. Onramper, MoonPay, Transak or any provider you prefer, used for the Buy with a card hand off. You sign up with them directly, they pay you an affiliate share, and with no key set the Buy button simply does not appear.
• Solana RPC provider: optional for mainnet. The free public devnet RPC works out of the box, and a paid RPC provider is only recommended once you have production traffic. Billed by the provider you choose.
• MongoDB hosting: optional. You can run MongoDB on your own server at no extra cost, or use a managed provider, which bills you directly.

These providers and their plans can change, so please check each provider’s current pricing before you commit to it.

Trademarks and affiliation

SolMate is an independent, third-party product. It is compatible with the Solana blockchain and works with the services named on this page, but it is not affiliated with, endorsed by, sponsored by, or officially connected to Solana Labs, the Solana Foundation, Phantom, Solflare, Jupiter, Google or Firebase, Onramper, MoonPay, Transak, MongoDB, or any other project or company mentioned. All product names, logos and trademarks belong to their respective owners and are used purely to describe what this software interoperates with.

Important legal and regulatory notice

SolMate is a software product and developer starter kit, not a financial service, not a custodian, and not a licensed provider of anything. You, the buyer, operate any wallet you build with it and are solely responsible for legal and regulatory compliance in every jurisdiction you serve. Please review the following before you launch, ideally with a qualified lawyer.

• Self custody and irreversible transactions: your users hold their own keys. Solana transactions are final and cannot be reversed, cancelled, refunded, or charged back by you, by your users, or by anyone else. A transfer sent to the wrong address is gone. Your interface and your terms must make this unmistakably clear to users before they send anything.
• Lost keys cannot be recovered: because the key exists only on the user’s device, there is no reset link, no support ticket, and no administrative override that can restore it. If a user loses their recovery phrase and their device, their funds are unrecoverable, and that is a property of self custody rather than a defect. Users are responsible for backing up their recovery phrase and for keeping their device and unlock method secure.
• Licensing and registration: depending on your country, distributing a wallet, and especially enabling any feature that exchanges, converts, or transmits value on a user’s behalf, can be a regulated activity. This item includes exactly such features: an in wallet token swap that can take a fee for you, and a hand off to a third party card on ramp that can pay you a commission. They are off or unconfigured until you enable them, and enabling them is a decision you should take advice on first. You may need to register as a money services business or virtual asset service provider, hold a license, or meet other financial regulations. Requirements vary widely by jurisdiction and change often.
• KYC, AML, and sanctions: you may be required to verify user identities, run anti money laundering checks, keep records, and block sanctioned or prohibited jurisdictions and individuals. This starter kit does not include a KYC or AML provider and does not perform any such screening.
• App Store and Google Play policies: Apple and Google apply specific rules to crypto wallets and apps that hold or move digital assets. Apple’s App Review Guidelines and Google Play’s financial products and services policies may require that you are a licensed or registered entity, may restrict certain features, and may limit where the app can be distributed. Store approval is not guaranteed and is your responsibility. Many publishers distribute wallet apps directly rather than through the app stores.
• Advertising: the marketing placements let you promote anything you choose, including things you were paid to promote. Advertising financial products and crypto assets is separately regulated in many markets, and the app stores apply their own rules to promotional content. Label promoted content clearly, avoid anything that reads as investment advice, and check what disclosures your market requires.
• User content and privacy: the community feed carries content posted by your users, and you will hold user data such as wallet addresses, profiles, and posts. You are responsible for moderation, for takedown handling, and for meeting the data protection law that applies to you. Editable legal pages and user moderation tools are built into the admin panel for this purpose.
• Financial risk to your users: crypto assets are volatile and can lose value quickly. Your users can lose funds through market movements, their own mistakes, phishing, or a compromised device. You should present clear risk warnings and terms.

Nothing in this item or its documentation is legal or financial advice. The bundled terms, privacy, and disclaimer pages are templates and must be reviewed and replaced by a qualified lawyer before you go live. The software is provided as is, without warranty of any kind, and you are responsible for how you configure, deploy, secure, and operate it.

Get started

SolMate gives you a working Solana wallet on day one: a mobile app, a website, and the API behind them, with real on device key handling, client side signing, a community layer people will actually use, and a white label admin panel you control. Install it, create a wallet on devnet, send yourself a test transfer, and change one endpoint when you are ready for mainnet.