AllWalletDevs #9

Transcript

here's February's all while the dev call uh we have a pretty light agenda today as usual but it's nice to see everybody coming out um I guess let's get started with um wallet demos does anybody have anything cool they'd like to show off that they've been working on since the last call all right it's very low level technical stuff that we're doing so you want to tell us about it well I I basically I was working on like encrypted backups of the the wallet so that you can kind of back it up to a file and then restore it later on um but it's not really like

a cool good demo no it's super useful though um which quality with sorry uh Luxo the um Universal profile perfect just for meeting minutes um cool so that's awesome we all need encrypted backups so can't complain about that uh we're working on something pretty cool at dark florist um I don't know if if anybody was around for the demo we gave it was last month about how dark Forest Interceptor works but we're working on a um a way to submit bundles for like white hat recovery of compromised wallets but exporting that functionality

to the user um using dark floors to kind of create simulation kind of like stacks of simulation so the users can kind of create a whole bunch of transactions inside of their wallet and then submit them all directly to flashbots to help recover assets on their own cool and that's using the same like recording tech and and stuff you showed last meeting exactly so use the recording tag although if you're the the technical implementation is fairly interesting because we can't get metamask to do it metamask is the signer and so we actually have to bring that Json representation of those transactions to a separate dab and actually put the private keys inside of this dap for these compromised accounts in order to create the the actual bundles because

you can't really use metamask to submit it right so you have to kind of break the private Keys like storage but it's only targeted at already compromised wallets and then the DAP and then the DAP itself is going to be the one that brings a bundle to flashbots without actually bringing it through metamask for signatures oh is that why Micah was asking about an input for a c like a seed on a web page I think I'm sure yeah okay but yeah this is all related to that stuff right yeah and then actually it's also using a burner wallet it's creating its own burner wallet inside of the memory of the DAP in order to fund the bundle so when you do need to send it some assets it's it's doing it on like a brand new pristine account and it can you know have the private key there in a way

that's not compromising other assets that are held by the user oh that's cool yeah yeah we have we have like a demo we have this like actually working it's a little bit rough around the edges we're going to start getting users that have like usually like nfts or other assets they want to rescue from compromises accounts and start having them walk themselves through it and watch them do it and see if we can export this to to people who who really need to rescue these assets because there's a lot of them like that's the other thing that I do in my day job is help people that got scammed just kind of bring those two things together yeah what we're trying to do we have an environment of all the wallets being as a contract and they all have permissions that are on chain so that you can build

things like social recovery and that kind of stuff from right but that's that's going to recover like the the smart contract wallet stuff right um are you on are you in any of these 4337 discussions I'm a part of a whole bunch of those because flashbots is also kind of trying to to um to be a big part of like pushing four three three seven forward I think it's going to be a big Community effort but it's gonna be really important to get that done yeah uh not me personally but yeah yeah definitely yeah that's something that I'm really excited about and hoping that we get a lot of wallet support there and I think it's going to require just like a big initiative there but once it's done it's going to feel like right we have a lot more possibilities exactly yeah yeah there's a really active telegram Channel

where there's like hundreds of people in there only it's dedicated to 4337 um if anybody's interested with some of your telegram handle I could I could try to add you to this but there's like a a community of people there they're all trying to push for 4337. where's uh where is 4337 at right now like high level uh I think just stalled I don't know I I I think there's a lot of excitement you know somebody knows yes I can I can talk a bit so the 437 standard is undergoing an audit right now hopefully it should be done before December if everything goes well that's the plan and um there's a lot going on with the b2p network for the bunders to operate so

the specs are being written for that a lot of maybe there's like four teams that are building a bundle software so that you can operate safely in the P2P Network and that's the yeah that's the progress and then there's other few teams that are building wallets like us candid wallets or building a 437 compatible wallet interesting what is your what is your wallet what's your name candid ate cool yeah thanks for the update um if anybody else has anything they

want to talk about demo stuff they've been working on we can do that and if not we can move on to um Eep 6384. cool I'll hand it over to tell hi thank you Sam so sorry to put you on the spot with this oh no that's great that's great luckily I was uh near my uh disco and so uh ap6384 it's all about human readable offline signatures or how to make a user understand what they're signing on when they're signing

eip712 is I guess most of you know all of you know that uh like there's has been a lot of rage around the Open Sea offline signatures and they're being exploited in the wild every day by the way we are building some cool dashboard based on Dune analytics to quantify the size of this problem and the we all react they found under consulted conservative assumptions that they are like 25 million dollar lost in debt I know we're in defy and you know we don't get

excited if it's not the alert of million but uh but this is really really important and offline signatures is not aip712 based signatures uh it's not um it's really a trended you know big projects are using that and going to use that more if you for example units walk a permit to Cloud swap have their own offline signatures and really it's all as like I think the main attraction for protocols is since this is uh uh if EAP 712 is fearless so it creates a kind of

an Amazon kind of fillers and experience or just in time fees for uh for uh for the users so in for openc the buyer can handle all the fees and you don't need both sides to be online and and also in permit it's kind of solves approved issues and so on and so forth but the problem is even though that eip712 offers like a nice Json so you can see all the trees so to speak but you don't the user don't get the forest it doesn't get like you know you get the big arrays and so on and all kind of

data because it actually was meant for machines for smart contracts to interpret to interpret and it's not humanly readable although even though you you tell like EAP 712 is certainly better than a personal sign that we had before but uh still like you know this is an address this is the number this is and so on and so forth and you search that and it doesn't understand that maybe is approving to some Rogue address or putting their nfts to sell in a very low price and what we are suggesting with the EIP or erc63 A4 is to it as EAP 712 already

bounds the this buffer to be signed to a contract with the verifying contract parameter and so we would would suggest to have uh in each contract that supports that that supports AP 712 handling to have a function so so the idea is when a wallet gets that erp712 it can query uh that function hand over the uh the buffer to it and this is a view only function so no fees

and no gas and and no delays and so on and get the interpretation of that internet buffer and then show it to the user this is the ID in high level and it's also I'm not going to go into the exact threat model like maybe someone who is better like it's better by the fact that the uh the smart contract explains the the buffer to the user so maybe what happens if this smart contract is logged by itself so there's a detailed analysis of that issue and it's really not the issue

because in most cases let's take open C like the the problem is the the interface and the web interface is wrong and gets the user to it's a phishing site get the user to sign on openc uh let's say openc buffer and and the verifying contract is the good openc contract must be the good openc contract or otherwise it wouldn't work so the uh so to say the smart contract is already trusted and the phone can be used as a source of tools for that so this is in a higher level and we hope to get some consensus around that from both

wallets developers and of course there's a two-way Market also from Smart contact developers such as openc uni Swap and others so happy to get your thoughts on that so like to to check my understanding here the idea is that there's a function on the contract that accepts a 712 signature that can explain what a signature does in human language [Music] for sure yeah that seems useful yeah so like there could be all kind of um

you know uh where's it like talking about the and this is like the talk that has been on a terror magician uh some of the participants had good comments about localization so like do we need the human understandable description in all in all languages maybe we can define something that is more structured and then the wallet can do something with it but this is in the details we really want to you know to get the feedback from the community and say what what would be the best and also like what would be feasible and because we can do

something very complex and that won't get adopted so it's kind of a balance between what would be cost effective uh in that in that area so just to share some initial feedback we got from other wallet projects so uh done Finlay from a metamask is looking into it it's a kind of likely but they have their own initiatives in that so they need to see uh what would work best and also there's a hardware wallet that

really supported us uh or Twitter like really said that they are going to to actually work with us on that Gunner lost the just the their name just to say the Keystone sword Keystone are on it I shared it with a sister there's someone from coinbase wallet in this talk so I shared it with some Compass guys and that and so it's really initial we just published it a week or something uh ago and we really hope that you the community you're at least half of that um of that EIP like this of course needs

to be wallet side and support and also smart contract support so really uh like to get your feedback and I shared the EIP or ESC draft link here and there's all the links are there for the discussion the in the the Italian magician website awesome thank you so much see if anybody has any feedback uh leave it on the discussions to link um if you have any like immediate concerns feel free to talk about them now or I think we're pretty much done for today cool

foreign that's the end of you know the officially scheduled business um we usually chat for a little while after so feel free to hang around or feel free to take off thanks for coming okay thank you yeah I I just wanted to maybe discuss and ask questions about [Music] um mobile wallets implementation and how they handle their but they're built on both iOS and and the Play Store I don't know if anyone want to hang out a bit more

well we happen to have different build infrastructure for both it's like the iOS stuff is a native app and then we're using um a react native Android but in theory react native should run on all platforms uh yes I sorry I didn't clarify so I wanted to ask more about the security measures that um mobile wallets take so that they can like publish on App Store so as you know uh the developer account is really basically uh is responsible for

for publishing the the app to the store and any malicious actor if they can have access to that developer account they can they can modify the way the designer is in and maybe can copy it and just send it to to themselves and they can just like correct everyone so this is a quite um yeah so DG I guess you can speak yeah I was wondering like what teams are doing to do that and we wanted to take the bus like security measures to to consider it when we're going in production

I think the modification of an app is not that easy I mean if somebody gets access to your developer account yes but that's so I mean is that really the attack Vector that's going to be most likely to happen I I think you would want to make sure that your app doesn't on wire update so that that would be more important than having somebody actually upload a new store item and have it approved

but just make sure not to allow um you know live updates of those applications so if they were based on on JavaScript make sure that your packages are pre-built and part of the executable instead of downloaded over the net yes we don't allow live updates but technique in theory users can so if we if users can have like automatic updates as well and the account is compromise they can get medicine but I know like like the General Security precursors with accounts obviously to fa um very strong passwords

um but what I mean is there like a um a formal security measures that Mobile Wallet team take and Legion you wanted to speak yeah I can only speak for the Android side of things but for the Android side of things you have a signing key to sign your um APK and I have that on an offline machine so that's airgapped this machine is air gapped so the key is not exposed and so an attacker would need this key to sign an update um this will get more problematic in the future because Google tries to push the app bundles now

and they want the signing key um you should never actually opt into that and we should also like as a wallet Community resist to that because as soon as we give the control over this key out of the hand we have a huge problem but I think that should be standard practice to assign your builds that fall out of your pipeline after checking on an agate machine got it yeah this is what we are also going to do like designing uh for especially for Android it's a it's going to be always offline it's going to always be signed and um I think that's the right approach how about for for Apple

I mean it's very similar that the Apple uh package files they're very similar to the APK package files they do have they do have um multiple signatures so it's not it's not really that much different but if you have I mean it's the same issue right like like on Apple if you have access to that developer account conceivably you can add a new signing key and then sign with that new key and then have it approved but I mean the approval

process is not like just a simple thing where you can hack in I mean you would notice that you will get notifications that a new app has been submitted I I'm I'm not sure if that's the most uh insecure attack Vector that I I think if somebody really wanted to hack the thing they would have to somehow in yeah I'm not sure I have to think about that what that what the worst case scenario is on on Android is actually not possible because the uh signature is checked on the device so you cannot just add a

signing key on your developer account and then interview so because the device is checking the chain of signatures um so and if you have like a new signature on the new APK different than the old uh signature on the old APK you have installed then you cannot just because the edit factor is actually like create a new um update that basically extracts your key right um so and that's then not possible I don't know don't know how it is on iOS um button on Android that's not really a concern there so if you keep really secure so if you if you had a new developer and they logged into your account they wouldn't be able to make a

updates to your existing APK if if that was previously signed by another um developer key yeah that's correct uh if you're not using a bundles basically if you're not hand over the key to um to Google then Google is doing after sending it even there basically you have a a signing key in between so you also need the signing key so then it's basically an upload signing key versus a deploy assignment key signing key that's interesting Apple might be cross-checking that too but I haven't noticed that I mean usually that would never happen right like once you develop

and you have a signing key you're not gonna like try to sign it with a different one so if that was attempted it might reject it too that's interesting any question is also a little bit like um where's the check basically is it checked on the device because kind of one attack Vector could also be um speaking like could Google infiltrate um or apple in this case um steal all wallets right as an exit scam or something like that and in the Android case it wouldn't be the case because they never have your signing and the device is rejected

okay and is is there a wave for anyone to to verify at the bundle against the source code that we publish on GitHub of in Android um that's more problematic um but possible it's called reproducible builds so basically what you kind of want to do um is create reproducible builds um it's now easier with Android it was a bit painful in the beginning it got easier because a problem there usually is you cannot just compare like the hash of like apka and APK being usually because there are some time stamps in there usually like an APK it's just like glorified zip container with stuff so

um but now um Google pushed it a bit because basically they just wanted to save bandwidth so they also reduce like all the timestamps and um it's about the ordering in the zip and stuff so it's gotten a bit easier um but it's still some work but it's very encouraged that you basically try to get your builds reproducible got it so I have to just look up reproducible builds foreign exactly yeah and by any chance do you know it is the same process in apple I feel like it's it's going to be impossible for him they have signatures right on the on the Apple side it has signatures I don't know if they're linked to a certain git

commit or something like that I'm not sure yeah but signatures really don't help you there um because what you basically want to do that the user basically can create the same um executable as you to verify that um you want to go because signature centralizes again right so if it's just a signature um you have to trust them basically you want to be able to not trust them you want to like look at the source code compile it and get the exact same output exactly yeah and then it's also like one thing you should also do is like pin your artifacts so that always the same um artifacts and dependencies are used that should be like done anyway but

sometimes that's also a problem to get to reproducible builds um what is also a good um method there is to also like hash all the artifacts um on Android there was a great witness now Gradle has also built-in functions for that um to track down also like supply chain attacks if somebody tries to um like get you change like basically dependencies and externality keys with that um yeah so if yeah like pinning is not enough you also have to Hash the artifact yeah exactly that uh in the end you should hash them like pinning them

um it's like one step um but in the end you should also like um have hashes of them if they change because pinning them then maybe um like um the supply chain of those or the Publishers of the artifacts could just replace a version that's often possible um and you have the build system doesn't like when you pin the build system doesn't take a hash for you or now it's also in graded inside but you have to activate it because also and before you had to manually do it like it's new functions uh okay or you could write code in Rust that's a popular thing to do these I can't even

do it it's not it's not too bad I I developed like a whole website in Rust it's it's basically like living in in react but writing it in Rust that's pretty cool what framework did you use uh you w w e uh y e w my spelling correct I'm sorry they've looked a little bit at it that's kind of cool and it's like react yeah it feels like you're writing react code but you know you have to worry about all the reference stuff in Rust but it's

pretty cool because you end up with uh web code that's written in in Watson so it's fast and once you get it right chances are you probably don't have to change it no no I was just going to say thank you for those who who responded to my questions yeah I played around with one called

Deoxys it's like a similar kind of deal um very react like from what I understand although I've never really written react code so okay yeah it's kind of neat the the caching dependencies are weird like um I don't know if it's the same in react but where like things are recomputed inside of like callback functions and then cached um which is kind of a weird paradigm yeah well that's that's kind of in in Rust you don't really have there's no garbage collection so you

can't return a routine that's persisted as long as somebody is referring to it right because you're not making a call to it yet so you have to kind of box it so it's a little tricky to have the idea of callbacks yeah yeah with you know the browser how do you spell dioxis d-i-o-x-u-s us okay I found something called XIs cool I'm gonna check that out yeah it's still

it's still like you know in in its infancy but it's it's neat what's like the gold standard right now for like packaging a web app because like I've used um what's it called um it's been a while anyways I used was impact in Rust and it uses one in the back end and it seems to screw up half the time so what is like what does everybody actually use for packaging projects these days the packaging where like if you take like uh for for the web so like if I want to like have a bunch of dependencies in like a package.json and I just want to put them in an HTML file

and have it work what is that yeah I mean we are still using webpack for some of those things White we're we're trying to switch a lot of things to White which seems to be better I've used um es build which is a lot better but it doesn't support older browsers so okay there's an swc is pretty good um roll up that's right so they they each have like they're good and bad parts so there's no easy answers what you're saying not yet I mean that's that's really that whole esm discussion that I mentioned

earlier I mean once everything is esm then it doesn't really matter because then you can do Import in the browser and it just pulls it in then you don't have to pre-package everything but right now you know using webpack is great but uh webpack for packaging and then running it in node doesn't work anymore for anything that's esm so it's kind of a bit hackneyed well because like ideally I'd like to be able to use sub resource integrity hashes and I don't think you can do that with like Imports in in JavaScript but you know

this is just for like a non-wallet related project so it's not exactly on topic for this but you know yeah but what's your what's your framework that you're you're using just plain JavaScript like just plain JavaScript yeah yeah I I like I normally just use like npm to to package targeting if you're targeting really new browsers I would I would look either I mean like are you using um like Hugo or something to put things together or uh well right now it's really just nothing I'm kind of starting oh okay I mean if you want something really fast to like put a bunch of pages together

there's many things you can either use Hugo which has es build um hooked in and that's h-u-g-o but it's like a static website building but it does all the packaging and everything everything okay okay or you could use uh like next that uses white which is really fast okay I've looked at next I think but it's like meant to be hosted on on their service right or is it um you can you can launch next or next on um um cloudflare workers but you have to have the latest

version so the latest version of next you can you can run on the edge on cloudflare workers but if you don't have any um SSR then then then you don't you don't even need the back end then you can just statically extract the whole site and host it cool thank you because then you can use something like surge just put it put it anywhere right you've given me a lot to research thank

you great well I'm going to take off thanks everybody for coming out um we'll see you next month okay see you okay thank you so much have a good evening okay take care