Solana payment gateway risks unpaid merchants

On Sept. 3 the Solana Foundation published a payment-channel design and a benchmark showing about 1.09 million verified off-chain vouchers per second on a 128-core AVX-512 host during a sustained 10-minute run. The benchmark measured the gateway’s response and signature checks without an upstream AI service or independent mainnet transactions. The Foundation also noted deployments using Alibaba Cloud API endpoints and a listed mainnet deployment.

The gateway moves repeated single-use payments into signed off-chain vouchers that spend against a prepaid escrow ceiling. The customer funds the channel escrow, the merchant delivers service and builds a bill, and the operator advances SOL to pay transaction fees and refundable account rent. When the gateway accepts a voucher it updates the channel’s cumulative spending record off-chain, allowing fast confirmation without an on-chain transaction for every delivery.

If an operator becomes unresponsive, the protocol provides an on-chain forced-close flow. The forced close is recorded on-chain and starts a configured grace period the Foundation recommends at 900 seconds (15 minutes). During that grace window the payee must present its final voucher through a payee-authorized settle-and-seal path and record the final settled amount on-chain. After the grace period anyone can seal the channel and either withdraw the customer refund minus the recorded settled amount or submit a distribution transaction that pays recorded merchant shares and the pending refund according to the opening transaction’s payout split.

Off-chain vouchers that have been accepted but not settled on-chain can be lost if an operator restart clears volatile in-memory storage or if the final voucher is not recorded before the grace deadline. Funds already recorded on-chain as settled remain reserved for distribution, provided token accounts are usable. A missing final settlement that never reached the blockchain before a forced close cannot be added later against the on-chain recorded total.

Practical recovery depends on a functioning network, usable token accounts and an available party to submit transactions and pay fees. Customers who do not hold SOL must rely on a fee-paying submitter or a replacement submitter to initiate forced-close and collection steps. The session draft allows permissionless recovery by third parties but those parties must be willing to submit transactions and cover fees.

The draft describes two signing arrangements. In client mode the customer holds the voucher-signing key. In operator mode the operator signs vouchers from a reusable bearer proof. The escrow ceiling limits total settlement in either mode. The program also allows a drained channel account’s refundable SOL rent to remain committed until roughly a 1,500-slot opening window has passed, which affects account deallocation timing but not customer refunds or merchant payouts.