Wallet competition winner
Back in May we announced a competition for a GUI wallet since the only wallet we had at launch was the one that came with neptune-core, the reference node implementation. A graphical wallet was by far the most popular request we received from the community.
We can now announce that the winner of this competition, and winner of 6.000 Neptune coins, is the VxBlocks team!
How does it work?
The graphical wallet connects to a server that is just an instance of neptune-core with four new RPC endpoints. When the wallet requests a block from the server, the block is returned without the block proofs in order to save bandwidth and storage space on the client’s computer. The wallet itself then scans each block for incoming and outgoing transactions without leaking any balance changes to the server. For now, only transactions with on-chain announcements are supported.
Crucially, the wallet application does not leak much information to the server: It goes without saying that the server never sees secret key material. When a transaction is initiated, the wallet server only a so-called proof-collection backed transaction which does not leak more information than a fuzzy timestamp of the inputs being spent. Inputs amounts, output amounts, and recipient addresses are completely hidden. For performance reasons, the wallet does not maintain its own so-called membership proofs but requests these from the server. This is done in a privacy-preserving manner such that the request for membership proofs does not leak more information than the fuzzy timestamps mentioned above, information that also shows up in the block when the transaction is mined.
In short, the wallet is probably as privacy-preserving and as lightweight as you can build a wallet without the future feature of succintness that is on the roadmap for neptune-core. And the code is very easy to read.
The source code of the wallet can be found here. Note that the team still has to publish the binaries for the updated wallet. The source code of the server lives on a branch of the neptune-core GitHub repository.
For anyone willing and capable of running their own server and compiling Rust code themselves, they can start using this software now. For anyone else you might have to wait a day or two before the team releases binaries, and public servers are announced.
Suggested future improvements
Although this is a great wallet as is, it could benefit from more functionality:
- The ability to restore a wallet from only the wallet seed (currently only encrypted files are supported).
- The ability to pay the server directly for upgrading the proof from a proof collection to a single proof (which makes it much more likely that a miner picks up the transaction for block inclusion). The endpoint for this request already exists in neptune-core.
- The ability to challenge the server when a transaction or a block is received. To ensure that a) the server is not reporting false payments, and b) that the server is not hiding incoming payments. This could be done by either confirming some blocks against a 3rd party block explorer, or by receiving and verifying more cryptographic information such as block proofs or proof-of-work data.
- Support for off-chain transaction notifications.
- Lock JavaScript dependencies: The backend is written in Rust but the UI is written in JavaScript. For security against supply chain attacks, the JavaScript dependencies should be
locked.