A mobile user running Solflare on their phone needs to know a concrete fact: when the application moves to the background, does it retain decryption keys in active memory, or does it purge sensitive material immediately? The answer affects whether an attacker with access to a running device—through physical theft, malware, or memory inspection—could potentially extract signing material without further authentication. Most users assume that closing an app returns the device to a secure state. The technical reality is more nuanced and depends on how the application manages key material across session boundaries and OS-level memory protections.
This distinction matters because Solflare is a non-custodial wallet, meaning the user’s private keys are stored on the device, not on a server. That design choice eliminates custody risk but concentrates device security into one application. The security of keys in background state therefore becomes as important as the encryption at rest and the biometric locks visible in the interface. Understanding what the application retains when backgrounded, how timeout and re-authentication work, and what the underlying iOS and Android security contexts provide is essential for informed usage, especially when the device may be left unattended or loaned to others.
How mobile wallets handle key material in background state
When a user switches away from the Solflare iOS app or Android app, the application enters a suspended state managed by the operating system. During this period, the app’s process can remain in memory but is not actively executing code in response to user input. The critical question is whether sensitive decryption keys—the material needed to authorize transactions on the Solana blockchain—remain available in that suspended state, or whether the application explicitly wipes them from RAM when backgrounded.
Best practice for mobile wallets is to treat backgrounding as a security boundary. When the app loses focus, it should clear any in-memory decryption keys, session tokens, or other sensitive material that was used during the active session. This is accomplished through lifecycle callbacks. On iOS, the applicationDidEnterBackground method allows the app to trigger cleanup code. On Android, equivalent lifecycle callbacks include onPause and onStop. An application that properly implements these callbacks will zero out memory regions containing keys, shut down decryption contexts, and force re-authentication upon return.
However, not all mobile wallets implement this uniformly. Some applications may retain keys in memory longer than necessary to avoid repeated decryption operations during frequent background transitions. This optimization can reduce latency when the user returns quickly, but it creates a window during which extracted memory could reveal key material. The trade-off is between convenience and security. A shorter retention window means more authentication prompts; a longer retention window means greater exposure to memory-scraping attacks if the device is stolen while the app is suspended.
Solflare’s documented approach involves storing private keys in encrypted form using the device’s secure enclave (on iOS) or keystore (on Android). These hardware-backed protections prevent the encrypted keys from leaving the device and provide additional resistance to key extraction. However, the question of how long decrypted key material remains in RAM after backgrounding requires careful implementation of session management and lifecycle handling.
Session timeout and forced re-authentication
A session timeout is a mechanism that invalidates a user’s authenticated state after a specified period of inactivity. When a timeout expires, the application should require the user to re-authenticate—usually through biometric authentication, PIN, or password—before accessing any sensitive functions such as signing transactions or viewing private keys. This is a critical control because it prevents an unattended, backgrounded app from remaining in a usable state indefinitely.
The Solflare iOS app and Android app both support biometric authentication, which means that after a timeout, the user must re-present their fingerprint or face to unlock the wallet. The duration of this timeout should be short enough to provide meaningful security in case of physical device theft or loss, yet long enough to avoid excessive friction during normal use. Common choices in the industry range from 5 to 15 minutes, though some wallets allow customization.
A session timeout is only effective if the application actually enforces it. This requires tracking the timestamp of the last user interaction and comparing it against the current time whenever the app returns from background. If the timeout has expired, the application must flush any remaining key material from memory before prompting for re-authentication. This sequence matters: clearing the keys before asking for authentication ensures that even if the re-authentication prompt is skipped or bypassed through a bug, no signing capability remains available.
Users can enhance this control by choosing a shorter timeout in settings if the wallet allows customization. Some wallets offer a “logout on background” option, which immediately invalidates the session regardless of time elapsed. This is the most conservative approach and should be standard for users who frequently switch between applications or work in shared environments. A user who keeps the wallet open for hours at a time on a personal device may accept a longer timeout; a user who handles the phone carelessly should assume that backgrounding may happen around any unlogged third party.
Encrypted key storage on iOS and the Secure Enclave
iOS provides a dedicated hardware component called the Secure Enclave, which is a co-processor physically isolated from the main processor. Keys stored using iOS’s Keychain framework with the Secure Enclave backing cannot be read directly, even if an attacker gains access to the device’s storage or main memory. The Keychain enforces cryptographic operations at the hardware level, meaning the wallet application never sees the raw key material. Instead, the app requests the Secure Enclave to perform signing operations and receives only a signature in return.
This architecture has significant implications for background security. Even if memory-scraping malware or a physical attack extracts the contents of the app’s RAM while the Solflare iOS app is backgrounded, the private keys themselves are not there to steal. What may be recoverable is session state, pending transactions, or other cached data, but not the material needed to forge new transactions. The actual keys are sealed inside the Secure Enclave, accessible only through biometric or PIN authentication controlled by the operating system.
However, this protection depends on whether the application is actually using Secure Enclave-backed storage for its sensitive keys. If Solflare instead chooses to decrypt keys into RAM during initialization and keeps them there for the lifetime of the session, the Secure Enclave provides no benefit during a backgrounded state. The correct implementation pattern is to keep keys encrypted in Keychain storage and request the Secure Enclave to perform cryptographic operations on demand, rather than decrypting and holding keys in application memory.
Users running Solflare on iOS should also verify that biometric authentication is enabled and that Secure Enclave-backed key storage is in use. This is typically indicated in the wallet’s security settings or backup creation flow. A properly configured iOS wallet should require biometric or device unlock to access any signing functionality, even for viewing private key recovery phrases. Testing this by backgrounding the app, waiting for the timeout period, and returning to verify that re-authentication is required is a practical validation step.
Android’s Keystore system and trusted execution environment
Android provides a similar but distinct secure storage mechanism through the Android Keystore system, which uses the device’s Trusted Execution Environment (TEE) if available. Phones with a compatible TEE—such as ARM TrustZone or Qualcomm’s Secure Execution Environment—can seal cryptographic keys at the hardware level, preventing extraction even by the Android kernel or applications with elevated privileges. This is analogous to iOS’s Secure Enclave but with more variability in implementation depending on the device manufacturer and chipset.
The Android Keystore framework allows applications to request that keys be generated and operated within the TEE without ever exposing them to the main operating system. When Solflare on Android uses Keystore-backed keys with biometric authentication, the wallet application cannot decrypt or extract the key. Instead, it asks the TEE to perform signing operations after biometric verification at the operating system level. This separation is powerful because it means even a compromised Solflare application could not sign transactions without passing through the biometric gate in the TEE.
However, not all Android devices have a compatible TEE, and older or budget devices may lack this hardware. In those cases, Android Keystore can still provide encryption using only software, but the keys are encrypted in the device’s main storage and decrypted in RAM, introducing more exposure. Users with devices that lack a TEE should be aware that their security depends more heavily on application-level session management and less on hardware isolation. Checking the device’s security settings or running a system information app can reveal whether a TEE is present.
The other consideration specific to Android is that the OS may aggressively reclaim memory, killing background processes to free resources. While this can reduce the window during which keys might be exposed, it also means that a session loss when backgrounded is more likely than on iOS. Some applications treat this as automatic re-authentication; others may require the user to re-enter credentials to restore the session. A user should test whether Solflare requires re-authentication after the Android system has killed the background process, which simulates a real-world scenario.
Practical backgrounding scenarios and real-world risks
Consider a concrete scenario: a user opens Solflare to check their SPL token balance, then receives a phone call and switches to the phone app while the Solflare wallet session is still active. The device remains unlocked and on. A second person picks up the phone while the call is ongoing. What can that person do with access to the running device? The answer depends on the wallet’s timeout settings and how its background lifecycle is implemented. If the timeout has not yet expired and the keys remain in memory, they might be able to access the wallet without further authentication. If the timeout has expired or if the application flushes keys on background, they would need to provide the biometric credential to access the wallet.
Another scenario involves a lost or stolen phone. If the device was running Solflare with an active session when lost, the finder would have immediate access to the wallet during the session timeout period. If the timeout is 15 minutes and the phone is recovered after 20 minutes, the session would have expired and the device unlock PIN would provide a first barrier. However, if the wallet implements a separate PIN or biometric gate that is distinct from the device PIN, the finder would need to bypass both. This is why using a strong device PIN, enabling device encryption, and configuring a short wallet timeout are all necessary controls.
The integration between the wallet application and the device’s OS-level security matters immensely. A solana wallet that relies entirely on application-level authentication without leveraging the device’s secure hardware is inherently weaker than one that delegates sensitive operations to the TEE or Secure Enclave. Users evaluating Solflare should verify in the documentation or security audit whether it uses OS-level protections or only application-level controls.
A user concerned about background security can implement several defensive practices. First, enable the shortest timeout available or use a “logout on background” option if offered. Second, set a strong device PIN or biometric, distinct if possible from the wallet’s biometric. Third, enable device encryption and automatic lock after a brief timeout. Fourth, avoid leaving the wallet open in the background while passing the device to others. Fifth, test the authentication flow by backgrounding the app, waiting past the timeout, and verifying that re-authentication is required before any sensitive operation is allowed.
Memory forensics and the limits of background security
Even with proper implementation of session timeouts and biometric re-authentication, a determined attacker with physical access to the device could potentially perform memory forensics—extracting and analyzing the contents of RAM while the device is powered on. This is a sophisticated attack requiring specialized tools and knowledge, but it is theoretically possible, especially if the attacker has a window of time while the app is backgrounded but before the timeout expires or the device is locked.
Mitigating this risk requires several layers. The first is ensuring that keys are cleared from RAM as soon as they are no longer needed for active signing. The second is using hardware-backed key storage so that keys cannot exist in main RAM at all; all operations occur in the TEE or Secure Enclave. The third is deploying anti-tampering protections that render the device unusable if physical attacks are detected. A fourth is ensuring that even if an attacker extracts memory while the app is backgrounded, the material they find is not immediately usable for signing—for instance, if keys are encrypted with a short-lived session key that is not in memory when backgrounded.
For everyday users, memory forensics is an extremely low-probability attack. The more relevant risks are theft during an active session, malware with memory access, or careless exposure of the device to a casual attacker. For these, the combination of biometric authentication, encrypted key storage, session timeouts, and hardware-backed cryptography provides substantial protection. The key is ensuring that each layer is actually implemented and tested, not merely advertised in marketing materials.
Comparing device-level and application-level security boundaries
A critical distinction exists between device-level security boundaries and application-level security boundaries. Device-level boundaries are enforced by the OS kernel and hardware, such as the requirement to unlock the phone with a PIN, the Secure Enclave, or the TEE. Application-level boundaries are enforced by code running inside the Solflare app, such as a session timeout or biometric prompt within the app’s UI. Device-level boundaries are generally more difficult to circumvent because they operate below the application layer. Application-level boundaries are useful but can potentially be bypassed by malware that has infected the device or by exploitation of the wallet application itself.
The most robust mobile wallet security uses device-level boundaries as the primary control and application-level boundaries as secondary controls. For Solflare, this means using the Secure Enclave or TEE for key storage (device-level) and adding a session timeout with biometric re-authentication (application-level) as a second gate. If Solflare fails to implement the second gate, the first gate—hardware-backed key storage—still protects the private keys themselves. If the first gate is not implemented, then a successful compromise of the application could directly expose keys or allow signing without authorization.
Users cannot directly verify whether Solflare uses Secure Enclave or TEE-backed key storage by inspecting the application; this requires auditing the source code or relying on security reviews. However, users can test whether the application enforces session timeouts and biometric re-authentication through practical testing. The simplest test is to backgrounded the app, wait longer than the configured timeout (or wait for the system to reclaim the background process on Android), then return to the app and verify that biometric or PIN re-authentication is required before any sensitive operation such as signing a transaction or viewing the recovery phrase.
Best practices for users concerned about background exposure
Users who wish to minimize the risk of wallet compromise through background access should implement a deliberate security model. Start by reviewing the Solflare documentation to understand its session management and timeout settings. If the application allows customization of the timeout, choose a duration of 5 minutes or less. If the application offers a “logout on background” mode, enable it. This ensures that even brief backgrounding followed by device theft results in a locked wallet.
Second, enable biometric authentication in the wallet if not already enabled. Verify that biometric or PIN authentication is required not just to open the wallet, but to perform any sensitive operation such as signing a transaction, viewing private keys, or initiating a send. Test this by attempting each operation and confirming that authentication is requested. Third, ensure the device itself has a strong PIN or biometric unlock and that automatic lock is enabled after 1–2 minutes of inactivity. This provides a device-level re-authentication gate that applies even if the wallet application has a longer timeout.
Fourth, avoid backgrounding the wallet app while it is in a state where it could immediately sign a transaction. If a pending transaction is displayed and the app is backgrounded, an attacker with brief access could potentially complete the transaction without additional authentication. The safer pattern is to close or cancel transactions before backgrounding. Fifth, periodically review the wallet’s connected applications and permissions, especially if the wallet integrates with DeFi platforms. A compromised external DeFi app could potentially initiate transactions that the wallet would sign if a session is still active.
Finally, consider the device itself as the primary security perimeter. A device that runs unknown apps, fails to receive security updates, or has been physically modified is less trustworthy than a device kept clean and up-to-date. Solflare running on a secure device with proper configuration provides substantially more protection than the same wallet running on a compromised device, regardless of the wallet’s own security features.
What Solflare’s non-custodial design means for background risk
Solflare’s non-custodial architecture—where users retain complete control of private keys and the keys are stored on the device, not on Solflare’s servers—has important implications for background security. Unlike a centralized exchange or custodial wallet, which could revoke access or freeze accounts remotely, Solflare cannot prevent unauthorized transactions if an attacker gains access to the device. This makes device-level security the decisive factor. If someone with physical access can unlock the device and access an active Solflare session, they could sign transactions and send assets without requiring any external authorization from Solflare.
This is both a strength and a responsibility. The strength is that Solflare cannot be hacked to lose all users’ assets simultaneously; each user’s security is independent. The responsibility is that each user must implement adequate device security because there is no remote lock or freeze available. A user who loses their device and has a long session timeout configured faces the risk that an attacker could drain the wallet during the timeout period. A user who configures a short timeout or logout-on-background mode significantly reduces this window.
The implication is that Solflare security cannot be separated from device security. A wallet running on an unlocked device with a long session timeout is effectively custodial from the perspective of anyone who picks up the device. The same wallet running on a locked device with a short timeout and hardware-backed key storage provides strong protection. The security boundary is not the application alone; it is the application in combination with the device’s configuration and physical security.
Frequently asked questions
Does Solflare keep my private keys in memory when the app is backgrounded?
Solflare uses encrypted key storage backed by the device’s Secure Enclave on iOS or Trusted Execution Environment on Android, so private keys are not stored in the app’s main memory at all. However, session state, decrypted transaction data, or other cached material may remain in memory during the timeout period. Configuring a short session timeout ensures that even this material is cleared if the device is accessed by an unauthorized person. Test your timeout by backgrounding the app, waiting past the configured duration, and verifying that biometric re-authentication is required before signing any transaction.
What is the difference between device-level and application-level authentication in Solflare?
Device-level authentication is enforced by the iOS or Android operating system and hardware, such as the Secure Enclave or TEE, which controls access to encrypted keys. Application-level authentication is enforced by Solflare’s code, such as a session timeout or biometric prompt within the app. Both layers are important. Device-level security protects the keys themselves; application-level security prevents active sessions from remaining usable indefinitely. For maximum protection, enable both.
What should I do if I hand my phone to someone while Solflare is still running in the background?
If your session has not yet timed out, the person could potentially access your wallet and sign transactions. To minimize this risk, configure the shortest session timeout available, enable logout-on-background if offered, and always close or cancel any pending transactions before backgrounding the app. For additional safety, set your device PIN to lock after 1–2 minutes of inactivity. If you frequently hand your phone to others, consider logging out of Solflare entirely rather than relying on a timeout.
