AllWalletDevs #8

Transcript

so we don't have a ton on the agenda for this week I mean we never do but um what do we have we've got um Victor's supposed to be presenting 54-53 but I don't know if he's made it um so we can probably skip over that one for now um we can talk a little bit about um my webrtc experimentation I don't know if anybody's been following along with that but the summary is basically that uh we want to use webrtc for the next generation of wallet dap communication but we ran into a roadblock where you need to have some active server components to be able to initial initiate a webrtc connection um specifically at minimum you need a

signaling server which just has to pass messages between both sides the connection um that can go a little bit more into depth on that but uh you know we can talk about that after two once everything else is out of the way signaling server is only necessary for the initial connection setup is that correct uh the initial connection setup and if one of the peers changes like Network conditions so like if you go from like a cell phone tower to a Wi-Fi connection you'd have to Signal there I'm not too worried about the case where someone is trying to use their wallet

from a mobile device that is transitioning between cell towers Yeah well yeah I I don't think it's too problematic and like so the big worry about the signaling server and um you know the ice and stun servers and stuff is that you need an active server so for ipfs hosted sites you wouldn't be able to connect um there are public ones but they would be able to censor correct um there are public um ice and Ice servers um they don't so it gets really deep into the nitty-gritty when you're when you're investigating this so there's there's

two types of ice servers um there's uh stun and turn um stun is the one that allows you to uh punch through gnats but doesn't do any relaying and that one can't censor you all the only information it gets is the IP address of both sides of the connection and that's it so as long as um you you aren't censored on an IP level you're fine right so if you're using the ipf website all that knows is your two devices are talking to each other exactly and like Google hosts these like Facebook everybody hosts these giant servers for them and they're very reliable and I mean they're

incredibly easy to sell post too if you want to like if you're going like super privacy focused um but they don't work normally pardon what is the use case normally what are they used oh yeah applications that are using for them it's like jitsi uses them Discord uses them um anybody who uses webrtc for anything uses one of these servers okay so so the uh the big problem though is the the signaling server so this would be there are no large signaling servers that I can find um and the signaling server gets a little bit more not not that much more but a little bit more context um it gets the uh each each device's um IP addresses all of them

um but that message can be encrypted end to end so it's not that risky does the signaling server get the origin uh it gets whatever we send to it we get to choose well so I mean browsers automatically append origin with the if you're starting half the connection up from a web page is it going to get whatever the browser sends and it says it doesn't even need to be a web page right like we could do the website displays a QR code the wall that displays a QR code and then you scan them like that's it it doesn't even need to be http so for the the wallet side yes I thought web pages could only open HTTP HTTP

connections and only through the browsers sorry I thought browsers could only open HTTP and I thought it was only through the browser's like fetch which automatically pen setters um yes but the browser wouldn't need to open a connection really like so so the I guess it would to receive it um but you can send like no referrer on on the links right so that they don't put the origin in there I also put origin this won't query for so if you go to you know tornado no cash or whatever and you then try to connect

through the signaling server you're going to tell the signaling server from your browser the browser end will tell the signaling server hey I am coming from tornado.cash are you sure I am quite confident that browser will automatically add the origin to every external column mix like you're talking about it's usually an HTTP referrer is that what you're referring to yeah that's yeah yeah like the HTTP header origin if you clicked on the link on that site if you typed it in the URL it wouldn't right right so you go to some website let's say tornado.cash and turn it up cash needs to make an external HTTP

request and it uses browsers window.fetch to do so right yeah that that fetch request is going to have an origin header on it and then origin header will be 20. you know the refer is as different the referrer is okay where you came from before the origin so like if you went to google.com search for tornado and then clicked on the link to trainer.cash the referrer would be Google the originally thanks for the clarification and um or browsers are incredibly anal about making sure the origin is always there like they have no way to override it I don't even know if plugins can override

the origin they might be able to though foreign to uh look into but yeah it doesn't yeah so I guess webrtc I guess there are discussion from the chat ended up with um we can't really use webrtc with this and also preserve all of the nice properties of uh like window.etherium so uh we're thinking of a little bit less um ambitious protocol which

uses uh like a steam Handler um so like we've discussed previously and then just using that to um do like window.post message so that takes care of extensions having to ask for a ton of permissions uh but it doesn't solve mobile wallets and Hardware wallets as elegantly um but yeah if anybody else is like a front-end developer and knows this stuff inside and out please feel free to contribute to the discussion in extension registry because I am way outside of my element with this uh um yeah I guess I guess we're trying to solve different problems so that that I'm just listening in um picking a single extension by using uh a URL scheme seems

Overkill but if you have multiple ones then it's kind of a necessity yeah exactly so like the whole discussion started because uh the sequence wallet um their extension was fighting with metamask uh so for people who had them both installed yeah we have a similar problem except sometimes we wanna still talk to metamask and that kind of warps the whole requirement a little bit yes like sometimes you want to talk so as a dab you want to pick a wallet specifically to talk to and sometimes you want to allow the user to pick the wallet to talk to is that the kind of the problem sometimes we want to talk to

two different wallets from the web app and sometimes we just want to use the default one okay yeah I I guess and sometimes we want to talk to one other specific one so all all the different cases happen yeah yeah so I think um wallet connect has kind of an interesting approach to that I think it's World connect where they um they have wallet specific schemes as well as one generic one um so yeah I mean we played around with wallet connect the thing is that in terms of the registered wallet there's only one so wallet connect can kind of

provide you to connect to the other wallets but in terms of the registered one like the the one that actually puts the ethereum provider it's it's always the current one yeah okay and using the window.pose message thing we've been talking about would solve that right yeah the only annoyance is that um if you wanted to connect to two Wallets on the same dap it would pop up the Chooser twice and would rely on the user having to select the two wallets they want to use um but I don't think that's like a horrible experience right but I couldn't actually get that to work

really yeah it's nice and Chrome or Firefox and chrome so yeah so chrome doesn't have a Chooser at all right now right exactly so the only thing that we've reliably been able to do is to disable all the extensions and then just enable the one by clicking and that's just progress problems yeah yeah it's um somewhere like sorry go ahead are we ready to drop the um scheme Handler given Chrome's position I thought their position changed I remember that was the thing we talked about in the extension registry like two months ago that's that somebody

at Chrome was reconsidering that do we have any more details about that I feel like that's pretty critical I mean the thing with the schema Handler is that you can't have a schema to pick up a curricular one so you're kind of saying you know the browser has to ask the user every time and once the user says oh this is the schema I want to use then it won't ask you again I think that's okay um the vast majority of users will have one wallet most likely and so they'll set it and never get a prompt can't pick a certain wallet it just

means the user is completely under control which wallet I mean it isn't that that feels very desired to me I feel like the user should be the one in control of which wallet that they're presenting but that should have no control over that yeah um I I guess in in in our scenario we have some jobs that only work with our wallet but that doesn't mean the user should have all their funds on a wallet it just means that when they go to our DOT Benito I think this gets into then

some sort of capabilities negotiation where you say I need a wallet and the wallet needs to support X Y and Z and that would work that would work yeah that's tricky to do a schemehandler with the window.post message that's very easy and um right yeah the scheme Handler would be pretty pretty simple to pick a particular wallet like let's say we just standardized like the format for the URL and it's going to be like web plus ethereum slash wallet Dash um so that it matches the 631 I think is the the number format for ethereum URLs and then you could just say you know any

wallet that wants to have their own thing that follows a similar pattern could have you know web plus metamask web plus uh candid or whatever and then um they follow the same format but they aren't officially standardized as like this is the way to connect to any wallet it's just like vendor specific stuff but yeah capabilities would be really really difficult to do with the Handler because the user would have to cycle through every wallet that they have there's no broadcast functionality right one thing I was playing around if all the wallets actually registered themselves at the end of the document rather than the start of the document then the d-app could add a proxy for ethereum and then they would see each

wallet assigning the ethereum object oh that's clever so that that would really work for um if we still want to inject providers but that doesn't solve the problem where we want to remove permissions from wallet extensions yeah like I don't want I don't want metamask seeing that you know I'm browsing whatever websites I'm on so right yeah it's a tough problem and you know I think I think we're basically just stalled until we find out what Chrome is doing so if anybody has any contacts at Chrome and wants to introduce me please do uh all right the Google Kool-Aid yeah exactly I don't know I I have some

friends at akamai2 I can talk to they might know someone at Chrome um so yeah I'll I'll do some digging on that and see what the the status is um so I guess Victor is not here yet so we'll have to deal with that later so uh the the next topic is eat 5139 authentication um so this is the standard for like provider lists that I've been pushing um how do uh like RPG providers do authentication as far as I'm aware there's just username and password like HTTP basic auth and HTTP Bearer auth is there anything else I need to consider yes uh a lot of them like Imperial use

like the the keys and the path um oh so like it's a query parameter or something or I've seen query parameter as well um but I was talking about like the um just like the path param like uh you know remember what their time is uh yeah it's like slash key oh but it's in the it's in the URL though yeah okay so that should be okay cool so that's easy enough um no no one should be putting secrets in URLs we all know this right put all the secrets and URLs it's all over https anyways a uh

I think the reason they do like click mode I think does this as well and fear does it I think the reason they do it is because tools all were built without any sort of authentication like they don't support Bearer or HTTP off and so it was kind of a fallback of well we got to put a key somewhere and the literally the only place we can put it that will actually work with existing tools like metamask and whatnot it's in the past so I think if if we can start getting everyone to support bear off then hopefully we'll start to see them switch to better off as well so to be clear for Bearer off it's just a HTTP header you have to add there's

nothing fancier than that more or less yeah okay cool I mean there's I think there's some specifications on like what that header contains like you can do JWT tokens and things with respect for that but yeah as far as far as this file like the list is concerned though it's just adding a string of text yeah that's easy cool um my partner and I made a mock-up of an all wallet devs website um it's in the agenda I can link it again in the chat if you guys like uh if you if anybody has any suggestions feel free to open a PR uh it's really simple neither of us are front-end designers so yeah there's that

and uh I guess last um is there are there any wallets that have cool features they want to show off for the recording that I can tweet about or you're just going to ask um Micah if he's interested in seeing what I was what I was working on in my wallet because I do have one ear that I can show briefly no don't ask me it's yeah go for it yeah or the group then awesome I didn't know if this is I didn't know if this is the Forum or not or if uh if other people followed the um any of the thread earlier but I do have a I do have a wallet and this is just kind of the dashboard you get to when when you first come in I

don't know how well it's coming through it it's pretty rough uh at the moment but I only added one wallet to it um and for those of you that are curious because you see one button here which is which is called the checkout button and the idea of the wallet is really for payments and I have hard-coded it to only support tokens that I issue and what else um I also have the concept of different types of wallets so this particular wallet that I have imported is just the public wallet address so the concept here is creating an app that a small business owner could uh could run and they could use it in their store for

generating payment requests and I did follow eip681 for the payment request I'll show you here what happens when I click the uh the checkout so what it does is because if you kind of think of if I'm a merchant and I've just somebody purchased something and I would normally go to a payment terminal and type in however much they uh they needed to pay so let's say I type in um a dollar a dollar twenty three that somebody owes me and then I hit the hit the checkout at the bottom uh then there is the uh payment code uh payment request uh code that it it does

you actually can scan that it should it should generate an eip681 a payment request and it basically says what chain uh what token and the token amount there of uh of 123. and so that that's the concept of the wallet right now but the discussion I had with Micah uh earlier on this week was this is really good for in-person transactions like a small business owner I go into the shop let's say paying for a cup of coffee um but because this is just um my ad this right now in this mode it's just a glorified QR code generator because I imported this wallet address just by

scanning um a QR code generated by metamask let's say which is the wallet address this wallet doesn't have the private keys on the phone um which which is kind of great for a merchant because they can set up an app like this for all of their employees each one with a different wallet address and then in the back end they can sweep sweep the accounts type of thing for any of the incoming payments obviously returns different story because they can't send transactions from here but because this is a QR code it is very possible or it would be very easy to implement a plug-in in something like woocommerce or or any any kind of

e-commerce application because they don't need to store private keys but they could generate a a payment request similar to that but problem is if I have two people on a website and they each make a payment or their order their cart when they hit the checkout they both have a five dollar order and then the the merchant this the store only gets a payment one payment of five dollars how do they know which person to credit that five dollars to or let's say they don't receive the full amount they've receive a partial amount um and so that's one of the things that Micah was was helping me with this week

and so we have this concept now of including a payment ID with that QR code so that when the sender scans the code and approves the transaction in their app uh they can include the payment ID along with the transaction so I pushed out a an erc20 contract with that uh with that in it anyways I can go on and on and talk about this but anyways there's there's the high level it's looking pretty sick so how does the payment ID work is it just like uh tacked on to the end of the call data or uh so the first thing I had to do was modify the ERC um erc20 contract so we included the

ability for when the sender is signing the transaction they can include um this additional parameter so we actually created a new uh a new transfer type I forget what the function was called it was probably transfer with payment ID is what I called it in the um in the smart contract so that when I send the trans when I send the token I send it using this new transfer method and it accepts the payment ID in that transfer method and if it's blank if there is because it's optional if it's if there is nothing then it's just it's just considered zero this way I've actually was able to query

the the transaction it hash in uh on the blockchain and polygon scan and I can see in the input data payment ID is there so now when the when the merchant or I can have an app that when it pulls that transaction from the blockchain it can parse out that payment ID and they can reconcile it on the back end with whatever that's the ordering system they have so yeah um so playing The Devil's Advocate a little bit what what's different about adding like random dust to the um payment amounts and then using that to track it and and thank you everyone for the

thumbs up you mean in just uh the standard erc20 contract yeah just you do like uh you know a dollar 25 die plus you know 64 or like bits of uh like fractions of a die oh well so first of all I use my own erc20 token yeah yeah okay great um I'm not sure if I follow you putting so so okay so the the balance you have to pay is five tokens and then point eighteen zeros or whatever right in in the smallest fraction so just I have two two decimal places because the idea is to use a stable coin so it would be simulate a dollar let's say go ahead I

recommend doing 18 decimal places even if you only need two uh because there's a lot of stuff will break if you only used to usdc causes no ends of problems because they use six and they're like the only token in all of existence uses anything other than 18. usdt as well but they also cause problems more problems yeah right they don't return when they should exactly I do other stable coins and all right I might have to ask you for professional type of work that I do this one's just a hobby so I might ask snap to ask you the impact of that then yeah it's just lots lots of apps it's one of these situations where like everybody

uses 18 except for like two people and those two people cause no end of problems because they are the ones that don't follow and unfortunately when the Saturn understand is written people thought it was a good idea to allow everybody to choose their own decimal amount but it turns out that was actually kind of we all regret it like everybody was around about me or C20 was was written we were all like God damn it why'd we add that it just encourages people to use something other than 18 and it causes problems uh just little bugs here and there just everywhere it's like one of those things that's there's not one specific problem that it causes it just life becomes miserable for you and everybody who tries to integrate with your stuff yeah just use at if I'm gonna I know I'm gonna ask you

more details about that and I'm probably going to Google it now because I never thought of that yeah um but yeah so like let's say you did have a token with 18 like die and USD USD C at least has six so if you took like the last you know the the least significant two decimal places um and randomized them so that each person who paid that address gets a random amount of of dust uh like payment and then you use that as your payment ID because that would work with basically every token I will take your Devil's Advocate and respond uh before bug can and um a lot of uis get very unhappy when you have number

number.000 or what um and so just the user experience ends up kind of bad and I I also felt that um if there was partial payment I might need to reference the same payment ID and make additional payment um one of the other scenarios that I haven't worked out yet is and the scenario I just showed you for like a copy that was a dollar twenty three the what if when the the customer wants to leave a tip right now I don't have the ability to tip but I can imagine that the app could have a

hey do you want to add a one dollar tip or a 10 tip type of thing and then it would be sent as a different amount but that that doesn't necessarily talk about your dust but um no it totally does like if you add like a three percent tip like that would screw it up entirely so the payment ID is definitely more resilient yeah yeah no that's that's great thank you the other option for this sort of thing is um if you don't have your own tool so if you have your own token then what you just described works fine if you want to work with other tokens like usdc or eth or whatever then um I think the other solution is to just append call

data and this is one of those things that probably shouldn't work but it does and then you can just look for the transactions that are sent to your address and then the call data will have the normal transfer stuff but then it'll have extra bytes that the contract will ignore and so oh but it is still recorded on uh on chain you're saying yes it's still part of the transaction so it's still recorded everywhere it just is ignored by the contract so you can put any data you want basically at the end of the call um it's it's not the best pattern to follow like it's yeah it's very obscure and opaque but if you're in a situation where you know you need this information and you're using someone else's token it's an option and some people and I

actually in fact I intend to use my own token um and the app would be hard-coded to use just my token yeah I think I think what you've done with the special specific method but that token could be used in other wallets there's nothing prevented sure um so I'm assuming you've extended 681 to include the payment ID as well or I have not yet okay theoretically theoretically but that was one of the things that is it an extension of um 681 in fact when I was reading 681 it's really just a way of representing the request in a URL and it includes additional parameters that you

can add on to the URL so technically it may not need to be Rewritten it's just in my use case I add a parameter of payment ID equals whatever yeah I know 681 is just arbitrary method call oh okay yeah it's not uh yeah so I think I don't think 681 needs to be modified um but perhaps an extension to erc20 could be suggested for uh to include probably not calling it a payment ID it might get suggested even something a little bit more generic I forget what you said but some type of unique ID to go along with it yeah that's what we do with the with the

Luxo standards we basically have a key value addition to the erc20 so you can put whatever data you want on top oh did you do did you do that as well and which in which token it's generic do we have lsp7 and lspa tokens which are like a subset or a sub version of erc20 and they have key value storage built in do you have a link for those you can stick them in the chat because that'd be cool I'm writing this down so I don't forget lsp7 and lsp-8 yeah and like you said if there's a link I'd love to look it up to see how you

did it as well I think it's a it's a very useful feature so this kind of goes into another idea I've been kicking around for way too long um would there be any interest in standardizing a URL format for requesting payment in one of n token types so like I am willing to accept seven usdc 7 die 0.05 eth and you pack that all into a QR code and send it to the other wallet and they decide how to pay would that be something useful for anybody it just had to be some time some deadlines how long it's valid if you ask multiple ones correct yeah it's volatile it's too volatile

yeah this would be literally for like I'm splitting a bill at a restaurant and I'm showing the code to my friends and this is how much currency yeah oh um I would do I would I wouldn't do ERC I would actually just say um array of functions to call so it's more generalized so basically call one of these and basically do an array of 681s more or less so then how would the wallets display the UI for that I feel like it'd be really difficult particularly the same way the display UI for 681 no um well it only accepts one URL and it could be multiple parameters then and

perhaps currency one equals whatever currency two equals bought currency three equals whatever but then it all depends on the the wallet that you're scanning to interpret it unless again it was um standard parameter names let's say I know me personally I think what's going to happen is stable coins are probably there's probably going to be a move more towards stable coins for use cases like that to Me Maybe other people feel otherwise but yeah no I think you're right is your argument here Sam that's um someone could send to transactions one of which is a token

transfer and one of which is a go place a bet on a lottery like they don't need to be related whereas if you live and constrain it to just an array of token transfers you know they all use the same UI exactly so like I'm thinking like the scenario I'm thinking more in like the L2 world too right where like I'm on arbitrome you're on optimism and I have to figure out how to get you know one hamburger's worth of money from one person to another person in this multi-chain world how can we do that with a QR code that's kind of the scenario here's a QR code send me money somehow and here's the 73 different ways I accept payment exactly yeah I think I

think I interpreted your request slightly different not even just the seven different ways but you even said hey somebody owes me ten dollars and that ten dollars can be XE um xmatic or X Hello Kitty token is that I thought that that was my interpretation that you kind of did the forensic the currency conversion and priced it to them in multiple different tokens that they could pay you with yeah it's kind of like announcing that like I want to receive enough currency to cover some purchase oh exactly yeah or would you would you

require certain percentages of each or or you're just saying you want X and you want the other ones to sum to that same thing I haven't thought too much about the details just about the use case like if you took all of the currency that you received from this URL and convert it into like a hamburger it should equal one hamburger however that money gets there is is irrelevant yeah exactly as long as in the end you get some equivalent amount of value out of it right I I was just asking because you were talking about splitting a bill I

think you would have to split the bill first and then say well this part of the bill you can pick whatever exactly so like if there were five people you generate five five QR codes right yeah exactly right I know I think I think the payments are going to move to stable coins so it's a long jail which one something like that well well but at least gonna be it's gonna be yeah it doesn't have to be a specific stable coin but the value of this the the underlying asset in the stable coin is going to be US dollar which equates to the the US dollar that you want to pay in foreigners the point is

the I think the stable coin for sure but like I I would never receive usdc I think it's a terrible like the fact that it has a blacklist means I won't touch it so I won't accept you a payment in usdc okay okay so you yeah I'll expect any one of these these four um payment whatever you want but it's got to be one of those today and my wallet is is hard coded to a specific token anyways so it only requested in my token right would you want uh Sam would you also want to support um Bitcoin and see cash Monero Dash I mean I'm I'm happy just standardizing it on for ethereum related contracts but

if somebody else wants to take on the you know Universal payment URL uh RFC they can go and do that what is that what is this Universal payment URL I'm not familiar with it or is this the 681 that you're talking oh I'm just I'm joking about it right now just like oh okay yeah like a URL that supports Bitcoin and ethereum and venmo and PayPal and just pack it all into one uh one standard that's what 681 is it talks about it the very first little bit talks about because you do include the chain it includes ethereum at the beginning um but you're right it could say Bitcoin at the beginning uh I believe 681 does foreign looking at my little demo might show and

tell yeah it looks awesome and and do wallet support 681 now like if I were to scan that with with metamask what did you just if you did scan it with metamask um that's actually how I learned about the the format because I was going to create my own format which would have been proprietary but then I looked at what metamask generated because almost all wallets have the request payment but all they ever do is just show their public address they don't do a enter the amount you want to receive right often or what token you want even but metamask does and um I believe it did anyways that's how I discovered it was doing it with metamask

so if you scan that code with metamask it will ask you for that dollar 23 in my standard token in in my custom token you won't have it in your wallet but if you want some just let me know I'll forward it on to you there's no details right now leaking some Alpha here you know yeah actually I'm going to do a um in a couple months I've been planning to do a a pilot at a local bar where I'll uh give people enough credit in their wallet for like three drinks and let let the uh the store owner run the merchant wallet on their app and accept payment I want to see oh

that's gonna be a great test yeah whereabouts I am in Hungary at the moment so it'll be it'll be in Hungary which is great because one drink is going to cost you about a dollar if I give them if I give them five bucks that that five bucks is gonna go a long way you're buying for everyone I I will do a that's exactly it um I will buy for everyone who pays using my wallet and um whatever the merchant collects in their wallet I won't even give them the wallet in case if they're worried about losing the private keys or something but the way that this works um from a

merchant perspective it's essentially a cold wallet it's just the right it's just a it's just a view wallet um a watch wallet that's cool yeah what we have with our uh Universal profile you can basically go in and take away the permissions so you can go in and you can configure that particular wallet on that browser to not be able to to do certain things so you can just have the permissions to only show things which uh this is the ls8 or seven and eight you're talking about part of the universal profile which is the the extension that we're building that that's why it needs to like connect to

different um things like in order to if you wanted to um control your wallet yeah I use so I I this is this is a project what I just showed you um but I I also happen to issue um tokens using ERC 3643 uh that's kind of my day job so I so I'm familiar with that that token standard right and we can do permissions um cover your ears Sam but we can uh block an address we white list addresses we can do recovery of our tokens yeah basically what it what it is is that yeah exactly it's Universal profile

Cloud so when you go to universalprofile.cloud if you wanted to control your profile you would have to use our wallet but if you wanted to use the that wallet to do something else you don't really need to use a wallet right so it's Universal profile is the wallet it's called the universal profile extension it's not it's not public yet so oh okay the best versions and we're that's what we are building when you can download it but it only runs on on a test net it's not uh okay is that did somebody just put that in the chat well

yeah I put the tech documentation for the Luxo stuff all right cool I can also do more about the Interceptor if people are interested about that absolutely you you followed me so yeah do we want to show it off or color you want me to do it you want to do it either is fine do you have some nice demo cast yeah I think so okay is it cool if I share my screen all right yep I just noticed that white Alec has six

thousand eight so it's going to be better this time yeah I know he he refreshed a bit um maybe maybe he listened to me all right so this is my first meeting have we shown this off at all yet is there anything is any of this going to be like I don't know I don't think duplicated this is the first time yeah this first time I don't think anymore even what the Interceptor is all right all right cool so uh yeah all right so the team that we formed is called the uh dark floor we are working on a product called the Interceptor

um the Interceptor is a browser based extension that um that that offers a whole lot of functionality but works in conjunction with metamask so we have here um kind of you know the normal flow is that you know your your dap will talk to metamask and you'll get like a bunch of garbage and have have no idea what it's about to do um the Interceptor actually replaces the window dot ethereum object in order to take control of the uh of how the DAP talks to ethereum and only in certain cases does it bother asking metamask for anything and it does so via signing so it's really only going to forward a signing requests so the the Interceptor

never holds on to a private key it just provides read helpfulness to you know prior to that um so we have a download right here unfortunately because the whole Chrome stuff that I'm sure many of you are all aware of we don't have a working Chrome version yet it will work in Chrome it just won't get approved in signs because it's a V2 it's based extension but yeah uh it works for Fox and we have yeah so I think we'll probably include some instructions here for now just if you're kind of interested as a developer to try to load up probably not difficult but you just have to go through you know a you know a

debugging page that looks pretty scary but for Firefox you know you can just click on this I already have installed so I'll cancel but if you click on this it'll it'll load it right into your um right into your your Firefox this is Firefox right here um see here okay so I already have this thing loaded up here uh and so uh actually I wasn't prepared for this God so because we have replaced the window.etherium object we can do all sorts of things probably the first and most obvious thing that we can do is lie about who we are right we can say whoever you know we can say we're metallic even though we don't have his um his private key which kind of allows us to test what daps look like from various you know perspective of of other

application of other users and change balances and pretend that we have more money uh so for example we have a button here called make me Rich which is really just a template that kind of begins to Fork main net right in your browser it doesn't actually Fork it it has another technical means that it does this but if you if you do this see we add a simulation outcome here which is uh adding 200 000 ether accounts and now you can see we've gone from having six thousand each to 206 000 eth and because we've created this this the simulation stack this isn't just a single transaction that we run we can actually add lots of things to it for instance we can use let's say so he had six thousand each before so we can actually spend seven thousand each and buy a and buy some token so let's say I don't

know what some token how about uh that's a good one ens so it is again currently only talking to um to the the Interceptor so uh you know we're going to experience some pretty serious slippage here let's go ahead and do it anyway because it's fake money yes I totally want to spend all this fake money so in in doing so again we have not talked to metamask yet this is the Interceptor and it has taken the transaction that was about to be executed and it has simulated it and it described it so it's not looking at the call data to do this it's actually conducted a test version of this call after the make me Rich the

saying like hey if you do this you are going to lose 7000 eighth and you're going to gain 86 000 ens tokens uh you know kind of see these these these outcomes here there's there's lots of other contracts that are changing their balances but the only one we really care about that's highlighted here is you the user lose this gain this and we say simulate um you know we can we can add this to the simulation stack and we will see these these balances updates it's a little slow because unit swap only refreshes on on new blocks um but yeah you can see now we actually have less than 200 000 either right so we spent if we didn't have we gained a whole bunch of of EMS tokens um and you know because we're creating a simulation stack we'd even go back the other way right we can take all these

DNS that we just acquired you know and experience you know a pretty significant loss right we we need to approve in order to to operate with with unit swap right so it won't even show us the swap button until we approve right but we can just fakely approve by adding it to our our Fork like simulation stack and again it tells us what's happening it's like hey you are allowing uniswap to spend all of your ens at it you know again we're starting to create the simulation stack and every single call that happens on this page because it goes through the interceptors web3 object every single call gets the result after all of those requests having been done

first right so we're going to sell these things back yes we just turned 10 000 eighth into 510th like in one minute that's greater right here you're a good Trader um yeah and so yeah we can see we can see all these things uh we're working on some apis to actually uh export this simulation stack so the the actual transactions we're trying to run in order to create bundles of transactions similar to you know how flashbots might land things so it allows you to kind of construct bundles in a really really user-friendly way without having to to do some some programming and then one last thing that I want to show which is kind of the reason we started creating this before we kind of found out how cool all the other

um simulation stuff was um so this is just a kind of a low level transaction creating service that just allows you to basically run you know really really simple queries um one of the things that we noticed was that there was a lot of scams like I come from kind of like the scam industry of like trying to protect users and help users recover funds um and so there's lots of terrible things that can happen probably one of the worst things that happens with erc20s is that people accidentally send them to themselves people will say I want to send 100 you know die to my friend but they accidentally had the die contract address in their clipboard which when they when they did it and so here we're going to try to send one die to die itself and metamask will let you just happily do this and you'll

just burn all your money even though it's really really easy to detect um so yeah you can see our simulation stack is still there but um here we see we're going to send one die to die and it's like hey you're probably not doing the right thing and actually won't even let you proceed until you deal with some blocking UI elements that make you understand like what it is you're about to do and normally this is going to be enough to kind of break somebody out of their you know their trance of like wait I'm about to do the wrong thing and hopefully save people money we've got a whole bunch of these in there from really high gas price to approving EOS which is another common scam method so we're hoping that we can prevent a lot of users from getting scammed both through allowing them to simulate things

before they do that and by actually providing built-in protections for various known problems that people experience with ux and crypto that's a great idea I've been working on some fraud protections as well that I do in wallet and out wallet we'll have to yeah yeah that's awesome well yeah and it's funny though this is operating on ethereum without having the private key is very similar to the stuff that you were showing on on Europe right that's how to become a thing it's like you know you don't need to have the private key to kind of do and who do useful things and interact with um you know with ethereum and learn things and have you know conduct transactions I didn't understand how do you do the

simulation part so the simulation is something that we're we're working on standardizing but in the meantime we have written our own API that allows us to simulate like a stack of transactions so just like there's an eth call we basically wrote our own version of each call that takes an array and every time we get a let's say we like the unit swap says hey can you get me the balance of of ens right how much how much ens does this person have instead of turning around and doing an eth call we do this multi-call where we stuff all of these transactions into this array and then append to this one to the end of the array and conduct the transaction so we're doing a lot of simulation in order

to return this this value here of you know 0.001852 right we're running every single transaction before using a customized RPC method there are standards that are being pushed forward that I think would be really really great to get through but they're not in Mainline guest yet although their rpr's open and we're trying to get the resources and you know political uh alignments in order to actually get those merged because it's going to help a lot of people it's quite similar how hard had this doing the my net forking but kind of we have got a more efficient solution to do it but it kind of at saves the same thing yeah yeah she's the same thing but using

a very different method right you don't have to like go through and say I want to start forking you're just like yeah we just create stacks of transactions and keep track of them and always ask questions with the perspective of those transactions um yeah the there are ways that we can save users from scams using this as well a lot of times people like if they're going to buy a token that that they can't sell they could literally go through the process of buying it and selling it before they ever actually buy it I think there's a lot of um you know I think people can explore ethereum a lot more if they can you know run transactions that they can't afford or that they don't want to to do um you know with their own money yet until they've seen how it works I think

it's gonna be really it's gonna I think open up a lot of people to see what what ethereum is capable of even if you know you can't yourself create a you know 10 million dollar uh you know liquidity position it'd be kind of cool to see it like in simulation modes foreign the way that website access is tracked I think is a lot more meaningful um it has a better breakout of like addresses that are that are kind of correlated because you use them on the same website we also have um you know address books that we're hoping to try to push forward more on that

you know so again users make that mistake where they send money you know die to the die contract because the ux around address books hasn't really been great especially in metamask and so you know hoping we can um you know basically solve a lot of the security and scam and you know just users make mistake problems with with better ux that I think that metamask kind of hasn't really I'd love to share some What I've Done uh with you and get ideas and collaborate on that yeah that'd be awesome yeah I think there's there's a lot of ideas in this space and I think that yeah well so yeah um if you're if you're running Firefox I recommend you know checking it out and and um we'll we'll post some instructions about how to do it in

Chrome as well it probably only takes about just a couple minutes to do but it's not something I would want an end user to do but just if you're interested from a development standpoint so you know checking out what what we do and how we get it done yeah I think again the website was dark dark dot florist and we are doing all that development open in the Discord as well so if you're interested in following you can just hop in there and follow that development yep exactly yeah this is this is all is all open source this is the extension here I think uh one important thing you didn't mention is that you can actually

have things signed with metamask at the end oh sure you mentioned demo yeah yeah yeah totally so um I don't think I have any money loaded in this stuff but um yeah so you could you could absolutely do the same things with your Live accounts so you know if this guy had any money sorry I wasn't prepared to to demo this right now but um yeah if you if you have money's account you do the same thing where you know you would say I want to you know trade this for um you know for some EMS I mean you hit swap you're gonna see the same exact tools that pop up that allow you to to simulate that allow you to um you know see the transactions before they occur and you can even take your own address and start creating a simulation stack based on it

um and and those are where the those bundles become a lot more interesting because you can see all the things that are happening before you try to land them all in chain at the exact same time um one of the big pushes we're also making is trying to get users that are able to like white hat recover their own accounts but then they've been scammed there's like a whole series we basically need to use bundles for that and we have some work that we're doing to um basically convert the that simulation stack I showed before into a bundle itself that allows I mean hopefully allows users to recover funds that are kind of Locked Up by scammers that part's not finished yet but I think it's pretty close [Music] um how do you handle things like uh

getting sandwiched or or somebody sneaking a transaction in before yours and then changing the outcome of the simulation yeah I mean like basically is there like a is there a window for a new type of attack where somebody crafts a contract that does one thing in simulation and then a different thing on chain so I mean basically it is possible that somebody could kind of Target the Interceptor I mean it's it's almost always possible to tell that your evm code is running in the simulation versus not running on a simulation and so you know even without doing any sort of crazy front running it's it's probably possible to do that um you know this will be a bit of a cat

and mouse game so basically somebody could create a token that says okay you can buy this and sell this if you're in Interceptor simulation mode but you can't sell it on real mainnet right because they they might recognize like oh they always choose you know this minor as the or you know this validator is the one that's running in the evm when they simulate um it is something we're gonna have to to fight against we might be able to get to perfect simulation I don't know Michael do you think it's possible that we could ever get to like because because if you can use private relay you can prevent those right if you can privately get your transactions you can avoid front running the only thing you need to worry about is um is simulation detection on the validator are tough

yeah because we currently we can find out what the next validator is and we could simulate the next elevator so it looks very legit in that sense but validator privacy is something that's on the roadmap where you will not be able to predict the next validator which point we now need to pick a validator and I mean I guess we could choose a random validator from a list or something and that would help protect us yeah yeah like I said I think it's a cat and mouse game it's maybe we can win that game one day um it's a hard it's hard though it's so easy to accidentally leak that you're in a simulation but right now it's basically a right now it's like a cat and nobody game right

it's like they can just create create these tokens that will totally scam the users and it's trivial for us to detect that they're going to get scammed but you know what we just don't have the ux to show them so good luck with like you know holding on to your money it's like at least we're participating in the game at this point uh one good example for that one when Scott was making those transactions with a huge amount of sleep it's and then executing them the simulation and the simulation we are showing that you actually get that amount of tokens but actually what would happen is that someone would front run and would sandwich sandwich like that and at the moment we are not showing anything that that you're making this kind of transaction the huge slippage which you probably shouldn't be making and we are

planning adding that kind of custom U.S that would show that you are adding a huge amount of sleep it's so that you might not might not be getting this amount ins in the first place this is something exactly is working on it right so right here in the transaction outcome for the swap we see like hey you're gonna lose 10 000 eighth and you're going to gain this but we only think that that amount of tokens is worth 1000 eighth right and so there there could be again some sort of like a blocking um UI element here that says hey you know what you are receiving and what you are losing is is wildly different and you should understand that and also if you send that transaction someone might sandwich to you so we are going to add that kind of that you would

show that you are adding this amount of Snippets so you probably kind of should adjust it down as well right right yeah if I come over here to like if it's you know some accident that's like 40. yeah yeah yeah you know detect detecting the slippage so again those are those are more protections here but we you know but we do have the infrastructure for this right we do have the um we call them the protectors what do we call them yeah protectors yeah yeah we should be right so we have to put that and also showing that kind of the universe kind of showing that sleep directly yeah yeah and they're very simple right

so yeah if anybody wants to contribute some days if they have good ideas like they're very easy um yeah so here's another one like if you are giving an approval to a contract that is not etherscan verified right you're probably doing something bad like well yeah we'll let you proceed but you probably should be a I need to click a button that says I know I'm about to get scammed here and then they can get scammed are any other questions that was great thank you thanks yeah um Victor did you want to talk about your Eep or

oh yeah uh all of a sudden thanks um just I I I mentioned to uh uh Sam for uh kind of sharing some of my if works and so I just want to go up quickly uh show of showcase here and one of the things that I think might be interesting for the wallet oh sorry I was confused is the streaming ending yeah you're fine yeah yeah yeah yeah yeah we're a little overtime some people might drop off oh okay yeah didn't mean to drop people off so if if anyone is interested uh I

have been advocating for this uh the ipu 5453 endorsements which you can also see a reference implementation the idea is that there is eip2612 permit for yassi 20 and there's a bunch of others that take ecdsa signatures in a call and so that you can give people on one ton one-time permits this takes a different approach eip5453 do endorsements which is basically saying just like you if you issue a check to someone you can endorse it in the back so that you can when they give it to someone else to cash it in it can still go in so if you implement

if you if you implement uh the EIP 5750 the uh using an extended uh price data um then any function of eips can actually adopt this Behavior by saying uh if they follow this particular structure and ascending into the signature and in fact they can actually have multiple signatures then a one-time permit can be done for that trans transfer uh and then in a show and tell um let me show you what it looked like in in a reference implementation and you can give it a try and also

feedbacks are very uh appreciated this is the uh can I show my screen am I showing you my screen yeah okay yeah so let's say you have an ERC 2721 um and then uh you want to allow people to Mint and only the AI the the only uh when there are uh authorized or endorsed by Whoever has the endorsing endorsing power for example people here and owner what they can do is they can just add this modifier which I have the code to say hey compute this hash and then um and then behind the scene once it's verified that it's on it's endorsed with

this endorsement signatures it can proceed to do mint this approach allows you to basically add any add this accountability to any functions that happen to have an extra data which is eip5757 is about um so go check it out I'm also promoting the CIP ERC ref contracts uh efforts that I'm talking about or anyone who are interested in contributing to erc's or authors of ERC to share your reference implementation uh because the lovely uh open sapling I really like them uh doesn't take the Leading Edge eips so I have to share them in this particular banner and then if you want

to give it a try you can do uh you can just npm sync uh install this and then start using it in your own contract um for example you can just implement it you can just import this AR aerc 5453 and begin using it now in the context of wallets uh worry about what it provides is also the ability to do multi signatures without signature aggregation I think that's about to it I don't want to drag people too long but I'm happy to stay and and answer questions or feedbacks are welcomed yeah and a few times appreciate it can you post that that URL oh yeah oh

and you promised me you will give me a GitHub Stars right okay uh uh where should I put it uh let me see yeah either in general or in the chat I guess right Sam yeah that's about right yeah I think cheering you the reference implementation speaks louder than just showing you the eips but I posted both and by the way there's something that I need to work on the uh the IP uh reference implementation to make it I need to make a decision about how it actually aligned with the ipo1275127 uh eip715012 in terms of whether it is

could still use the structure or promote a new uh hash which is function like I think seven one two doesn't particularly address the um the sense of hey this is a function call uh and so I either need to invent a struct or say this is the new hash format that will be able to adopt to so that's a pending issue so for the people who are experts of that um don't blame me for not yet solving that problem I just call it out uh yeah uh confess foreign this off

oh Sam can I also mention that there's an ethereum magician meetup on the uh on the east on on the that is Stanford which is moved a day back after the uh after the wallet con so if you happen to be on the wallycon uh you can join the ethereum magician Meetup after the on the March 2nd yeah thanks for the heads up thank you back to you awesome that's I think everything we had today um thanks everybody for coming out and we'll see you all in in about a month see you thank you will we be on Discord next time as well or moving soon yeah I should probably

move it I'll figure that out