From c138f08c78eb6600f6dda3f10ad912bcd6d5f31e Mon Sep 17 00:00:00 2001 From: spirobel <spirobel@protonmail.com> Date: Wed, 26 Feb 2025 12:52:59 +0000 Subject: [PATCH] add proposal to build Monero Browser Wallet + selfhostable Payment Links + multisig companion app --- spirobel_monero_browser_wallet.md | 142 ++++++++++++++++++++++++++++++ 1 file changed, 142 insertions(+) create mode 100644 spirobel_monero_browser_wallet.md diff --git a/spirobel_monero_browser_wallet.md b/spirobel_monero_browser_wallet.md new file mode 100644 index 00000000..b1826853 --- /dev/null +++ b/spirobel_monero_browser_wallet.md @@ -0,0 +1,142 @@ +--- +layout: fr +title: Monero Browser Wallet +date: Sep 10, 2024 +author: Spirobel +amount: 335 +milestones: + - name: prepayment for first month + funds: 20 XMR + done: + status: finished + - name: Monero Payment Links + multi wallet syncing + funds: 90 XMR + done: + status: unfinished + - name: Monero Browser Wallet + funds: 125 XMR + done: + status: unfinished + - name: Multisig companion app + escrow library + funds: 100 XMR + done: + status: unfinished +payouts: + - date: + amount: + - date: + amount: + - date: + amount: + - date: + amount: +--- + +# Monero Browser Wallet + +## Who + +**Spirobel** + +References: + +#### found and reported a "pay what you want" vulnerability in AcceptXMR + +https://x.com/spirobel/status/1672479215512588288 + +https://github.com/busyboredom/acceptxmr/issues/64 + +#### open sourced a Patreon like tool for Monero + +https://x.com/spirobel/status/1595949928634667008 + +https://github.com/spirobel/monero-discourse-subscriptions + +#### open sourced a merchant focused wallet-rpc + +https://x.com/spirobel/status/1596299822516285440 + +https://github.com/spirobel/monerochan-merchant-rpc + +#### implemented a Monero Browser wallet extension PoC + +https://www.youtube.com/watch?app=desktop&v=4DLcsQ45zoE + +https://github.com/spirobel/monerochan-city-wallet + +#### wallet-rpc library + +https://ccs.getmonero.org/proposals/spirobel_robust_modular_wallet_rpc.html + +https://www.npmjs.com/package/@spirobel/monero-wallet-api + +https://github.com/monerochan-ecosystem/monero-wallet-api + +Contact: twitter.com/spirobel + +## What + +**Result:** Monero browser wallet, selfhostable stripe payment links alternative, multisig companion app, +accessible cross platform Monero library + +The deliverable for this proposal will be: + +1. A selfhostable Stripe Payment Links alternative built on + the [monero-wallet-api library](https://github.com/monerochan-ecosystem/monero-wallet-api). + It is necessary to have a checkout flow with real world use to establish the Wallet-Webapp + interaction UX. The [preliminary UI work](https://x.com/spirobel/status/1871161899410440670) + on this product has been well received. +2. The Monero browser wallet. + The next step is the implementation of the send functionality in the library and the wallet itself. + The second milestone contains all the UI for syncing, sending, error states and the Wallet-Webapp interaction. +3. A Multisig companion app that allows to split spend keys over multiple devices. This means a phone can serve as a second factor to a laptop and both devices need to be compromised to access funds. The work will make use of the [recently audited](https://ccs.getmonero.org/proposals/monero-serai-wallet-audit.html) multisig code. As a side effect it will become more accessible to build escrow and multisignature enabled apps with the underlying typescript library. + +### Implementation + +list of initial tasks: + +- add multi wallet syncing to the library +- integration of checkout flow in the Payment Links app +- enable multi wallet background syncing in Monero Payment Links +- build Monero Payment Links transaction section and transactions tab +- calculate & display aggregate amount per wallet + +- add private key management to the extension +- build indexeddb backend for output storage +- implement spend function +- add transaction history screen to the browser extension +- implement interactive checkout that will remove need to copy addresses + +- add FROST dkg methods to the monero wallet api typescript library +- implement initial connection and setup in extension and multisig companion app +- handle transaction signing & display in the companion app +- implement transaction submission +- recovery from fresh scan + + this task list is not exhaustive and subject to change + +## Milestones + +value commitment: + +The 3 deliverables outlined in the **What** section are the promised outcome of this proposal. +In addition, new functionality becomes available in the underlying library. +The Monero Payment Links product is 110, the Browser Wallet extension 125, the Multisig Companion app + lib 100, in total 335 xmr + +## Why + +Currently Monero shoppers have to copy and paste addresses from the tor browser into their wallets. +This can be made more convenient and secure by a browser wallet. + +The Monero Browser Wallet PoC that I wrote is fundamentally different from typical browser wallets. +Instead of injecting Javascript into the page and excusively communicating via message events, it uses a REST api. +The initial trigger in the PoC still happens through a message, but the plan is to get rid of that. +As a result the checkout will work in a Javascript disabled environment while providing the same seamless user experience. + +The browser is still seen as a potentially large attack surface. +Even with all the security features and sandboxing techniques that +modern browsers employ, there is still the risk of 0day exploits. +This risk can be mitigated by spreading the secret key among multiple devices and necessitating access to all of them to sign a transaction. +The goal of the last milestone is to make this easy through the use of a multisig companion app. + +tldr: the browser wallet makes monero web shopping more convenient and secure -- GitLab