sRFC37 Token ACL Demo

A JavaScript CLI demonstration of sRFC37 - a permissioned token mechanism for Solana using Token-2022's Default Account State extension with delegated freeze authority.

Overview

sRFC37 enables permissioned tokens where:

• New token accounts are frozen by default
• Freeze authority is delegated to the Token ACL program
• A gating program controls who can thaw/freeze accounts
• Users on an allow list can unfreeze their own accounts

Prerequisites

• Node.js >= 18.0.0
• Solana CLI configured with a funded devnet wallet

Installation

npm install

CLI Commands

Create a mint

node src/index.js create-mint [options]

Options:
  -k, --keypair <path>   Path to payer keypair (default: ~/.config/solana/id.json)
  -u, --url <url>        Solana RPC URL (default: https://api.devnet.solana.com)
  -d, --decimals <num>   Token decimals (default: 9)

Note: After this step, the freeze authority is the payer's keypair. Run delegate-freeze to transfer it to the Token ACL program.

Create config and delegate freeze authority

node src/index.js delegate-freeze -m <mint> [options]

Options:
  -m, --mint <address>         Mint address (required)
  -k, --keypair <path>         Path to authority keypair
  -u, --url <url>              Solana RPC URL
  -g, --gating-program <addr>  Initial gating program

Set gating program

node src/index.js set-gate -m <mint> [options]

Options:
  -m, --mint <address>         Mint address (required)
  -k, --keypair <path>         Path to authority keypair
  -g, --gating-program <addr>  Gating program (default: Token ACL Gate)

Enable permissionless thaw/freeze

node src/index.js enable-permissionless -m <mint> --thaw [--freeze]

Options:
  -m, --mint <address>   Mint address (required)
  --thaw                 Enable permissionless thaw
  --freeze               Enable permissionless freeze

Show program info

node src/index.js info

Testing Permissionless Thaw

Test 1: Thaw failure (non-allowlisted user)

WALLET=<user_keypair_path> MINT=<mint_address> node src/test-thaw.js

This creates a token account and attempts to thaw it. The thaw should fail because the user is not on the allow list.

Test 2: Allowlist a user

AUTHORITY=~/.config/solana/id.json \
  USER=<user_pubkey> \
  MINT=<mint_address> \
  node src/allowlist.js

This:

1. Creates an allow list
2. Adds the user to the allow list
3. Sets up extra metas linking the list to the mint

Test 3: Thaw success (allowlisted user)

WALLET=<user_keypair_path> MINT=<mint_address> node src/test-thaw-success.js

This should succeed because the user is now on the allow list.

Program IDs

Program	Address
Token ACL	TACLkU6CiCdkQN2MjoyDkVg2yAH9zkxiHDsiztQ52TP
Token ACL Gate	GATEzzqxhJnsWF6vHRsgtixxSB8PaQdcqGEVTEHWiULz
Token-2022	TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb

Architecture

┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│  Token-2022     │     │   Token ACL      │     │ Token ACL Gate  │
│  (Mint with     │────>│   (Freeze        │────>│ (Allow/Block    │
│   frozen accts) │     │    Authority)    │     │  List Logic)    │
└─────────────────┘     └──────────────────┘     └─────────────────┘
                                │
                                ▼
                        ┌──────────────────┐
                        │   MintConfig     │
                        │   - authority    │
                        │   - gating_prog  │
                        │   - permissions  │
                        └──────────────────┘