Skip to main content
Create blockchain wallets using deterministic keys derived from your application’s root key. Each wallet address is unique to your application and consistently reproducible.

Prerequisites

Your application must be running in the Phala Cloud TEE environment with access to the dstack socket. In your docker-compose.yml:
services:
  app:
    # your app configuration
    volumes:
      - /var/run/dstack.sock:/var/run/dstack.sock

Ethereum Wallet

ethereum.js
import { DstackClient } from '@phala/dstack-sdk';
import { toViemAccountSecure } from '@phala/dstack-sdk/viem';

const client = new DstackClient();
const keyResult = await client.getKey('wallet/ethereum/mainnet');
const account = toViemAccountSecure(keyResult);

console.log('Address:', account.address);

Solana Wallet

solana.js
import { DstackClient } from '@phala/dstack-sdk';
import { toKeypairSecure } from '@phala/dstack-sdk/solana';

const client = new DstackClient();
const keyResult = await client.getKey('wallet/solana/mainnet');
const keypair = toKeypairSecure(keyResult);

console.log('Address:', keypair.publicKey.toBase58());

Important Security Notes

  • Use secure functions: Always use toViemAccountSecure() and toKeypairSecure() (not the legacy versions)
  • Application-specific: Wallet addresses are unique to your application ID
  • Deterministic: Same path always generates the same wallet
  • Keep keys in TEE: Never expose private keys outside the secure environment

Multi-Wallet Support

Generate multiple wallets by using different paths:
multiWallet.js
// User wallets
const userWallet = await client.getKey('wallet/user/123/v1');

// Treasury wallet
const treasury = await client.getKey('wallet/treasury/v1');

// Hot wallet for operations
const hotWallet = await client.getKey('wallet/hot/v1');

Migration from v0.3.x

If you’re upgrading from dstack v0.3.x, wallet addresses will change when using secure functions. See the Migration from dstack v0.3 guide for detailed upgrade instructions and wallet migration strategies.
I