# Mainnet configuration, verification, and wallet recovery

Nullbook private deals use SOL and SPL tokens on **Solana mainnet-beta**. Registration, public funding, deposits, settlement, and withdrawals affect real balances. Nullbook uses the existing Helius privacy program. It has no deployment key and requires no custom contract.

## Configuration

| Location | Setting | Purpose |
| --- | --- | --- |
| Server | `SOLANA_RPC_URL`, `SOLANA_WS_URL` | Use HTTPS/WSS mainnet endpoints for public wallet, market, and chain reads. |
| Server | `PRIVACY_MAINNET_HELIUS_KEY` | A Helius project key with mainnet SPR RPC, indexer and prover access. If absent, the service can use the key in a mainnet Helius RPC URL. Never expose this key through a public build variable. |
| Browser build | `NEXT_PUBLIC_PRIVY_APP_ID` and optional `NEXT_PUBLIC_PRIVY_CLIENT_ID` | Use an app configured for the preview or deployed origin. |
| Browser build | `NEXT_PUBLIC_PRIVACY_MAINNET_FEE_OWNER` | Optional registered mainnet private-wallet owner for the buyer’s 0.5% desk fee. Empty means no desk fee; normal Solana costs still apply. |
| Server | `DATABASE_URL` | Private rooms and registrations use mainnet-specific tables. Do not copy another network’s owner signatures, approval records or receipts into them. |

The live service ignores the legacy Anchor program and fee settings. The public-offer status flag is independent of the mainnet private-deals configuration; see `privateDeals` in `/api/solana/state`. The wallet and receipt verifier use the [existing mainnet program and Default Ring tree](https://www.helius.dev/docs/privacy/addresses). Discovery does not guarantee settlement support: an SPL mint must also have a mainnet privacy interface.

## Check your connection without moving funds

From the repository root, install the locked dependencies and configure the server credentials, then run:

```sh
pnpm privacy:check
```

This command verifies the mainnet genesis, reads the finalized program and registry accounts, checks the default tree owner, and queries the indexer using a newly generated, unfunded wallet. It checks the SDK’s signed mainnet prover policy, attestation and circuit keys. It does not load an existing spending key, create an onchain account, or sign or submit a transaction. The provider may charge normal API credits for reads. The mainnet RPC and indexer are documented in [Helius endpoints](https://www.helius.dev/docs/privacy/endpoints).

To check a specific token before funding, run `pnpm privacy:check --mint <mainnet-mint-address>`. It reads the initialized mint and its matching Helius registration. New deposits and deals accept classic SPL and base-layout Token-2022 mints without extensions. Existing-note recovery is separate.

For the full authenticated relay path, use a dedicated PostgreSQL test database and run `NULLBOOK_LIVE_MAINNET_RELAY=1 pnpm exec vitest run tests/privacy-relay.test.ts`. For the two-party browser negotiation, run `pnpm privacy:browser`; that harness uses isolated accounts and does not move funds.

**Checked November 15, 2026:** mainnet genesis, both executable programs, default tree ownership, Helius indexer access, AWS Nitro attestation and circuit keys passed. The USDC mint `EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v` resolved to six decimals and SPR asset ID 3 in a read-only lookup.

**Verification boundary:** a live read or unsigned simulation does not prove a funded trade, prove that a particular mint is spendable, or demonstrate a successful withdrawal on mainnet. The mainnet conversion did not broadcast a real-value swap or withdrawal.

## Recover a private wallet without the app

Use the encrypted **mainnet** backup and its passphrase. Backups from another network deliberately do not open here. Switching to mainnet does not move funds or convert an older account into a mainnet account. Keep your original backups and recovery tools for their original network.

```sh
pnpm privacy:recover /path/to/encrypted-mainnet-backup.json
```

In an interactive terminal, the recovery command requests your Helius project key (unless configured) and the passphrase, checks mainnet, and lists balances. You can exit after reading. Withdrawal requires selecting a private asset and amount in base units, reviewing a **public mainnet destination**, and typing the requested confirmation. Keep public SOL on the recovered owner address for network fees. The counterparty, Privy, and Nullbook’s database are not needed. If a deal was already signed, check its original receipt before attempting to spend those notes again.