SSP Wallet v1.40.0 gives enterprise vault signers something most multisig tooling still asks you to do without: a clear, ranked picture of what a transaction will actually do — cross-checked against the raw bytes on your own device before you approve it.
The release also brings byte-level Solana vault decoding, privacy mode, QR address scanning and a refreshed look. It shipped on 15 July 2026 — full release notes on GitHub.
A risk strip before you approve
Enterprise vault signing now opens with a risk strip on the sign screen itself:
- Server-side transaction simulation, with a balance-change preview of what the transaction moves
- Severity-ranked warnings — critical, high, medium, info — surfaced where you approve, not buried in a details panel
Simulation is display-only and deliberately conservative. It tells you what a transaction is expected to do; it never decides for you, and it never relaxes a check.
The part that makes simulation trustworthy
A server-side simulation is only as honest as the server running it. So the device does not take it at face value.
Your device independently decodes the transaction and cross-checks the server's preview against its own trustless decode. If the server preview contradicts what the bytes actually do, a critical SIMULATION_DECODE_MISMATCH warning fires and the server's preview is downranked in the display.
The device decode always stays authoritative. That ordering is the whole design: a helpful preview you can read quickly, backed by a local check that assumes the helpful thing might be lying. It is the same instinct behind 2-of-2 multisig — no single party, including our own infrastructure, gets to be trusted on its own word.
Trustless Solana vault decode
Solana enterprise-vault transactions are now decoded byte by byte on the device, using the open-source @runonflux/solana-multisig library.
The relay is treated as untrusted throughout. Recipients, amounts and token mints are verified against the raw transaction bytes rather than believed from the relay-supplied payload, and any contradiction between the two hard-blocks signing — a mismatch there is an active-attack indicator, not a display glitch, so the correct response is to stop.
Two more guards landed with it:
- An independent hard ceiling on paymaster fee reimbursement, bounding any attempt to drain a vault through fee routing
- An instruction allowlist guard on approvals, protecting against leaf-key-drain patterns
All of it is backed by an extensive new test suite. This work builds directly on the self-initiating multisig design we shipped when Solana joined SSP.
Privacy mode
One click blurs every balance and amount across the wallet — for open-plan desks, screen shares and calls where your net worth doesn't need to be part of the conversation. The preference persists across sessions.
Sending, sharpened
Send picked up several improvements that matter on the chain where mistakes are permanent:
- QR scanning — scan a recipient address with your camera, with a dedicated camera-permission flow
- Address validation — stronger recipient checks run before a transaction can even be constructed
- Accessibility improvements across the Send screens, plus an expanded transaction-construction test suite
A refreshed look
New SSP logos and a unified colour scheme across light and dark mode, consistent theming from a single design-token theme, the Inter typeface, and a new pillar loading animation. This was the first step of the design work that would land in full with SSP Wallet v2.0.
Also in this release
Flux node delegates got improved delegate configuration and selection, with a clearer nodes table and actions. SSP Connect gained more robust connection handling and request flow. Translations were updated via Crowdin, and dependencies bumped — including @runonflux/solana-multisig 0.11.0 and Reown WalletKit.
As always, v1.40.0 ships as a deterministic build with GPG-signed checksums for both Chrome and Firefox, so anyone can rebuild it from source and verify the bytes match.
