Code Monkey home page Code Monkey logo

burner-wallet's Introduction

๐Ÿ”ฅ The Burner Wallet is a quick web wallet used to move small amounts of crypto quickly. On page load an Ethereum keypair is automatically generated and used to sign transactions with an incredibly simple interface. Sending funds is as easy as a QR code scan.

๐Ÿ’ต Burners are analogous to cash: quick and easy but less secure. You wouldn't stuff thousands of dollars in your pocket on the way out the door at night, don't trust a seed phrase in localstorage with more than you are willing to lose.

๐Ÿ  Don't forget to sweep funds to colder storage when you get home at night and burn your ephemeral keys!

๐Ÿ’ธ Press the [Request] button to instantly create a popup point-of-sale system and have a QR code to display in the window of your shop. Patrons can send you funds with a simple scan in seconds.

๐Ÿฆ Press the [Exchange] button to move ETH or DAI that you sent to your burner into xDai.

๐Ÿ”— Press the [Link] button to send value in a link over chat or QR scan in person. We use a decentralized meta transaction relay system so the receiving party doesn't need to have a wallet or gas to claim.

๐Ÿ—๏ธ If you would like more permanence, press the [Advanced] button and use a short pass phrase to seed a keypair.

๐Ÿ’ฌ Did you know there is also native, burner-to-burner encrypted chat?

๐ŸŒฎ The Burner Wallet was used at ETHDenver by participants to purchase 4405 meals, we off-ramped $38,432.56 in DAI to the food trucks, and the total cost of transactions on xDai was $0.20!

๐ŸŽญ We held a number of smaller events we called a Cypherpunk Speakeasy to demonstrate the tech and learn how to improve our user experience.

๐Ÿป If you are interested in hosting a Burner Wallet event, check out Host to host a Burner Wallet event.

๐ŸŽซ Using paper wallets, ether.cards, or solidcoins, users can be instantly onboarded into a wallet and have tokens or localcoins to purchase goods or services.

๐Ÿค‘ We are finding that the Burner is becoming more of an instant onboarding platform for apps. I built Emojicoin.Exchange in an afternoon and launched it to a room of students. They could immediately start interacting with a smart contract without any app download or seed phrase. We also played this game live with Crypto Twitter and again at ETHNewYork.

๐Ÿค” At Ethereal we did the usual food truck tokens, but participants could also bet on prediction markets while they waited in line for food.

๐Ÿ”ง If you are interested in building a Dapp or game on the Burner Wallet, a great place to start is exploring Burner Module Development.

๐Ÿ” A great example of a new and exciting module is the Gnosis Safe in the Burner Wallet.

๐Ÿง‘โ€๐Ÿคโ€๐Ÿง‘ The Burner Wallet Collective is forming around fundamental development on this repo toward a shared mission of building a cleaner more extensible burner wallet. Join our telegram and tackle some issues to earn a bounty reward!

โœ… All projects should have a 'burner' version of their product. Take simple fundamentals from your app and put them in an easy to access web version before the barriers to entry. Use this to educate your users about your product and incentivized them to take the next step and download your app.

๐Ÿ—บ The Burner Wallet all started while exploring the intersection of smooth UX and Frontier Markets. The theory is that mass adoption will start where decentralization in necessary (emerging economies).

โœŠ You can support our efforts by contributing to the Burner Wallet Gitcoin Grant or sending mainnet funds to burnerwallet.eth

๐Ÿ™ Thanks! - Austin Griffith ( @austingriffith / [email protected] )

๐Ÿ› ๏ธ If you are interested in contributing development to the Burner Wallet, read on...

Contributing

assuming you have nodejs and git already installed...

you'll need ganache installed and running

npm install -g ganache-cli
ganache-cli

clone the burner wallet repo

git clone https://github.com/austintgriffith/burner-wallet.git
cd burner-wallet

initialize burner:

npx clevis init

(You'll need to hit enter a few times to specify some config directories.)

install burner:

npm i

link clevis

alias clevis='./node_modules/clevis/bin.js'

compile, deploy, test, and inject all contracts in the frontend:

clevis test full

start the app:

npm run start-local

OR start the app on the xDai chain:

npm start

Meta Transaction Relay (optional, not needed for regular dev)

in a new terminal start the decentralized metatx relayer from Tabookey:

./startLocalRelay.sh

then deploy and test

clevis test withrelay

Older Content and Videos:

burnerwalletvideosplash

WTF is Clevis? (It's like truffle and drizzle I think.)

Clevis is used to compile, deploy, and test the smart contracts. It is mainly for orchestration, but it also injects all the contracts into the Dapparatus (frontend).

clevis docs:

Testing locally

Take a look at tests/clevis.js, the metamask() function in particular, to give your MetaMask accounts some ETH when you run the full test.

Original Video

burnerwalletscreencast

Here are two phones exchanging value in a matter of seconds using burners:

burnerwalletdemo

One mobile phone can send DAI to another in 5 seconds with a simple QR code scan without any wallet download, this works on web browsers. Users can even send value through messaging services like WhatsApp with a simple link!

The Burner Wallet runs on the xDai sidechain from POA. Since it is in DAI, a dApp can simply refer to amounts in USD. Plus, block times take 5 seconds and gas costs are virtually abstracted because they are so cheap and paid in DAI. Finally, the bridge between xDai and DAI/ETH is as simple as sending tokens to a specific address.

A burner wallet is automatically generated upon visiting https://xdai.io and your private key is stored in a cookie so it will be there when you come back. However, you should sweep any value you hold to a cold wallet regularly and burn your ephemeral private key. A burner wallet is analogous to cash; you won't carry too much because it can be lost but it's astonishingly easy to exchange.

This can also be very handy in everyday use even for the crypto-initiated. If you are share a Lyft or a pizza with a friend and want to split the cost, just shoot their QR code with your camera and it will open up a new burner wallet to exchange value with them. Just don't forget to sweep to cold storage and burn your key when you get home!

Here is a follow up video to show how to go from fiat to DAI to xDai and back: onrampscreencast


Docker Dev Version

You will want to fork this repo and then clone it down. Since I own the repo I'll just clone it:

cd ~;git clone https://github.com/austintgriffith/burner-wallet.git

Then, fire up a Docker container with your environment all prepared for you:

docker run -ti --rm --name clevis -p 3000:3000 -p 8545:8545 -p 18462:18462 -v ~/burner-wallet:/dapp austingriffith/clevis:latest

Note: You will be prompted for directories to store things, just use the defaults (hit enter): image

This will take a while. Eventually it will stand up React, Ganache, and Clevis. (Note: make sure you don't have anything running on port 3000 or 8545 already)

If you visit http://localhost:3000 you will see an initial error that React is missing the injected contracts. To compile, deploy, and inject those contract, run:

๐Ÿ—œ๏ธ Clevis:/dapp ๐Ÿ—œ๏ธ clevis test full

Don't forget to point your MetaMask at the local RPC endpoint (http://localhost:8545): image

You can view and edit the code with your IDE of choice within the terminal (not from inside Docker container):

atom ~/burner-wallet

To bring up the relayer, you will want to set your http endpoint:

๐Ÿ—œ๏ธ Clevis:/dapp ๐Ÿ—œ๏ธ echo 'http://0.0.0.0:8545' > relayhttpprovider.env
๐Ÿ—œ๏ธ Clevis:/dapp ๐Ÿ—œ๏ธ node xdairelay.js

To follow your React logs you run:

tail -f react.log

To follow your ganache/geth logs:

tail -f geth.log

If you would like to give your intial account some eth to start out:

๐Ÿ—œ๏ธ Clevis:/dapp ๐Ÿ—œ๏ธ clevis send 5 0 ***YOUR_ETH_ADDRESS***

Or better yet, edit the tests/clevis.js to send you xDai every time you run the test suite: image

Then run:

clevis test full

Your frontend should automatically reload and your account should have xDai: image


Troubleshooting

If you receive this error:

../../nan/nan.h:104:40: note: expanded from macro 'NAN_DEPRECATED'
# define NAN_DEPRECATED __attribute__((deprecated))
                                       ^
8 warnings and 7 errors generated.
make: *** [Release/obj.target/scrypt/src/node-boilerplate/scrypt_params_async.o] Error 1
gyp ERR! build error 

Try upgrading/downgrading your version of Node to 10.16.0

Older Contributing Content

Are you a developer or designer that would like to help build the next iteration of the ๐Ÿ”ฅ๐Ÿ‘›Burner Wallet๐Ÿ‘›๐Ÿ”ฅ? Here is a short intro video to explain how to get started:

onrampscreencast

To learn more about Clevis and Dapparatus check out some of the following articles:

https://github.com/austintgriffith/clevis https://github.com/austintgriffith/dapparatus https://medium.com/@austin_48503/buidlguidl-0x0-clevis-dapparatus-533936a8236a https://medium.com/@austin_48503/buidlguidl-0x1-guidlcoin-3be30c6ac76f https://medium.com/@austin_48503/%EF%B8%8Fclevis-blockchain-orchestration-682d2396aeef

burner-wallet's People

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

burner-wallet's Issues

Site load time improvements

Site is getting a 0 on Google's PageSpeed test.

screen shot 2019-01-03 at 11 05 07 pm

Links to reports:

There are two very low hanging fruit ways to get the PageSpeed score significantly improved.

  1. Set CloudFront file compression on (will likely save 20+ seconds from load time)
  2. Set cache control headers

Great blog post outlining how to do this: https://christianoliff.com/blog/optimizing-cloudfront-performance.

I'd be happy to do this, but it requires CloudFront access.

Missing Exchange SC code. React building error.

./src/components/Bridge.js Module not found: Can't resolve '../contracts/Exchange.abi.js' in '/dapp/src/components'

For testing, I just commented the line 45 on Bridge.js to let it build abi:require("../contracts/Exchange.abi.js"),

ENS support for the Burner Wallet

Current version doesn't support ENS.

As a community venue here @ The Block Cafe our audience are often more comfortable using theblockcafe.eth than scanning a random QR code.

Thanks for all your work!

Use BlockScout

Normally you link to etherscan but that won't work for xdai.

Confirm Burn

Create a confirmation dialog when burning the key so you can be sure they really want trash the key forever.

Provide Educational Material

We should have step by step guides (maybe even videos) that show how to:

  1. fiat -> DAI
  2. DAI -> xDai
  3. send xDai via scan
  4. send xDai via message
  5. send xDai via address
  6. sweep funds to cold storage
  7. xDai -> DAI
  8. DAI -> fiat
  9. copy private key to meta mask
  10. burn private key

Instant exchange functionality

an instant exchange, from any token sent to the address to xDAI would defiantly go far away, imagine a world where for a small things like "sharing the pizza or uber" you don't need to worry about tokens, exchange rate, addresses, just send to this address anything you have (or you wish) and it would exchange it to xDAI if the token you sent was recognized by the connected DEX, otherwise the wallet will reject/auto-refund/send back your fund back to your address.

Create an alternative signed hash.

The actual hash requires a destination field. It is not obligatory anymore because there are more parameters that make unique each fund.

The idea is to have a new feature for enhancing the send with link capability. There is no need to know the destination beforehand. If a user is claiming a fund with a link, the app could show a text field to write the destination address. In a future enhancement this could even be an ENS.

Weird MetaMask error

When I log out of Metamask and go to either https://xdai.io/ (or localhost:3000 when working locally), the app crashes. Output from developer console is below. Not sure if it's maybe something to do with the WEB3_PROVIDER setting?

!!!!DAPPARATUS~~~~~ {DEBUG: false, POLLINTERVAL: 777, showBalance: true, metatxAccountGenerator: false, onlyShowBlockie: true,ย โ€ฆ}
dapparatus.js:253 Generating account...
react-dom.production.min.js:3843 Error: Invalid JSON RPC response: undefined
at Object.InvalidResponse (inpage.js:1)
at a.send (inpage.js:1)
at n.accounts (inpage.js:1)
at Dapparatus.eval (dapparatus.js:254)
at fi (react-dom.production.min.js:2713)
at di (react-dom.production.min.js:2699)
at Ra (react-dom.production.min.js:5312)
at Pa (react-dom.production.min.js:5017)
at Ma (react-dom.production.min.js:4983)
at Aa (react-dom.production.min.js:4927)
at Yo (react-dom.production.min.js:4847)
at Object.enqueueSetState (react-dom.production.min.js:2844)
at Dapparatus.w.setState (react.production.min.js:72)
at eval (dapparatus.js:248)
at inpage.js:1
at inpage.js:1
go @ react-dom.production.min.js:3843
Eo.t.callback @ react-dom.production.min.js:4118
fi @ react-dom.production.min.js:2713
di @ react-dom.production.min.js:2699
Ra @ react-dom.production.min.js:5328
Pa @ react-dom.production.min.js:5017
Ma @ react-dom.production.min.js:4983
Aa @ react-dom.production.min.js:4927
Yo @ react-dom.production.min.js:4847
enqueueSetState @ react-dom.production.min.js:2844
w.setState @ react.production.min.js:72
(anonymous) @ dapparatus.js:248
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
i @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
u @ inpage.js:1
a @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
u @ inpage.js:1
a @ inpage.js:1
(anonymous) @ inpage.js:1
t @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
u @ inpage.js:1
(anonymous) @ inpage.js:1
ze @ inpage.js:1
(anonymous) @ inpage.js:1
value @ inpage.js:1
(anonymous) @ inpage.js:1
n @ inpage.js:1
i @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
n @ inpage.js:1
i @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
u @ inpage.js:1
a @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
setTimeout (async)
(anonymous) @ inpage.js:1
write @ inpage.js:1
g @ inpage.js:1
(anonymous) @ inpage.js:1
v.write @ inpage.js:1
y @ inpage.js:1
(anonymous) @ inpage.js:1
s.emit @ inpage.js:1
w @ inpage.js:1
_ @ inpage.js:1
b.push @ inpage.js:1
_write @ inpage.js:1
g @ inpage.js:1
(anonymous) @ inpage.js:1
v.write @ inpage.js:1
y @ inpage.js:1
(anonymous) @ inpage.js:1
s.emit @ inpage.js:1
w @ inpage.js:1
_ @ inpage.js:1
b.push @ inpage.js:1
i._onMessage @ inpage.js:1
postMessage (async)
Z._write @ contentscript.js:1
a @ contentscript.js:1
(anonymous) @ contentscript.js:1
p.write @ contentscript.js:1
y @ contentscript.js:1
(anonymous) @ contentscript.js:1
m.emit @ contentscript.js:1
L @ contentscript.js:1
I @ contentscript.js:1
h.push @ contentscript.js:1
m.push @ contentscript.js:1
(anonymous) @ contentscript.js:1
Z.afterTransform @ contentscript.js:1
transform @ contentscript.js:1
m._read @ contentscript.js:1
m._write @ contentscript.js:1
a @ contentscript.js:1
(anonymous) @ contentscript.js:1
p.write @ contentscript.js:1
y @ contentscript.js:1
(anonymous) @ contentscript.js:1
m.emit @ contentscript.js:1
L @ contentscript.js:1
I @ contentscript.js:1
h.push @ contentscript.js:1
Z.onMessage @ contentscript.js:1
EventImpl.dispatchToListener @ VM989 extensions::event_bindings:403
publicClassPrototype.(anonymous function) @ VM995 extensions::utils:138
EventImpl.dispatch
@ VM989 extensions::event_bindings:387
EventImpl.dispatch @ VM989 extensions::event_bindings:409
publicClassPrototype.(anonymous function) @ VM995 extensions::utils:138
dispatchOnMessage @ VM996 extensions::messaging:392
react-dom.production.min.js:5000 Uncaught Error: Invalid JSON RPC response: undefined
at Object.InvalidResponse (inpage.js:1)
at a.send (inpage.js:1)
at n.accounts (inpage.js:1)
at Dapparatus.eval (dapparatus.js:254)
at fi (react-dom.production.min.js:2713)
at di (react-dom.production.min.js:2699)
at Ra (react-dom.production.min.js:5312)
at Pa (react-dom.production.min.js:5017)
at Ma (react-dom.production.min.js:4983)
at Aa (react-dom.production.min.js:4927)
at Yo (react-dom.production.min.js:4847)
at Object.enqueueSetState (react-dom.production.min.js:2844)
at Dapparatus.w.setState (react.production.min.js:72)
at eval (dapparatus.js:248)
at inpage.js:1
at inpage.js:1
InvalidResponse @ inpage.js:1
a.send @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ dapparatus.js:254
fi @ react-dom.production.min.js:2713
di @ react-dom.production.min.js:2699
Ra @ react-dom.production.min.js:5312
Pa @ react-dom.production.min.js:5017
Ma @ react-dom.production.min.js:4983
Aa @ react-dom.production.min.js:4927
Yo @ react-dom.production.min.js:4847
enqueueSetState @ react-dom.production.min.js:2844
w.setState @ react.production.min.js:72
(anonymous) @ dapparatus.js:248
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
i @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
u @ inpage.js:1
a @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
u @ inpage.js:1
a @ inpage.js:1
(anonymous) @ inpage.js:1
t @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
u @ inpage.js:1
(anonymous) @ inpage.js:1
ze @ inpage.js:1
(anonymous) @ inpage.js:1
value @ inpage.js:1
(anonymous) @ inpage.js:1
n @ inpage.js:1
i @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
n @ inpage.js:1
i @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
u @ inpage.js:1
a @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
(anonymous) @ inpage.js:1
setTimeout (async)
(anonymous) @ inpage.js:1
write @ inpage.js:1
g @ inpage.js:1
(anonymous) @ inpage.js:1
v.write @ inpage.js:1
y @ inpage.js:1
(anonymous) @ inpage.js:1
s.emit @ inpage.js:1
w @ inpage.js:1
_ @ inpage.js:1
b.push @ inpage.js:1
_write @ inpage.js:1
g @ inpage.js:1
(anonymous) @ inpage.js:1
v.write @ inpage.js:1
y @ inpage.js:1
(anonymous) @ inpage.js:1
s.emit @ inpage.js:1
w @ inpage.js:1
_ @ inpage.js:1
b.push @ inpage.js:1
i._onMessage @ inpage.js:1
postMessage (async)
Z._write @ contentscript.js:1
a @ contentscript.js:1
(anonymous) @ contentscript.js:1
p.write @ contentscript.js:1
y @ contentscript.js:1
(anonymous) @ contentscript.js:1
m.emit @ contentscript.js:1
L @ contentscript.js:1
I @ contentscript.js:1
h.push @ contentscript.js:1
m.push @ contentscript.js:1
(anonymous) @ contentscript.js:1
Z.afterTransform @ contentscript.js:1
transform @ contentscript.js:1
m._read @ contentscript.js:1
m._write @ contentscript.js:1
a @ contentscript.js:1
(anonymous) @ contentscript.js:1
p.write @ contentscript.js:1
y @ contentscript.js:1
(anonymous) @ contentscript.js:1
m.emit @ contentscript.js:1
L @ contentscript.js:1
I @ contentscript.js:1
h.push @ contentscript.js:1
Z.onMessage @ contentscript.js:1
EventImpl.dispatchToListener @ VM989 extensions::event_bindings:403
publicClassPrototype.(anonymous function) @ VM995 extensions::utils:138
EventImpl.dispatch
@ VM989 extensions::event_bindings:387
EventImpl.dispatch @ VM989 extensions::event_bindings:409
publicClassPrototype.(anonymous function) @ VM995 extensions::utils:138
dispatchOnMessage @ VM996 extensions::messaging:392
inpage.js:1 Uncaught TypeError: e is not a function
at inpage.js:1
at inpage.js:1
at i (inpage.js:1)
at inpage.js:1
at inpage.js:1
at u (inpage.js:1)
at a (inpage.js:1)
at inpage.js:1
at inpage.js:1
at inpage.js:1
at inpage.js:1
at u (inpage.js:1)
at a (inpage.js:1)
at inpage.js:1
at t (inpage.js:1)
at inpage.js:1

Token SC is not compiling.

There is a missing variable in the Token SC.
Undeclared identifier: _balances[msg.sender] ...

The reason for this to happen is related to some changes in Openzeppelin SC introduced for the 2.0.0 version. In this case it is affected by a private variable instead of a previous internal variable definition.

In openzeppelin-solidity/contracts/token/ERC20/ERC20.sol in line 17 the _balances variable is defined as private.
Private variables can't be inherited or accessed from child SCs. Internal variables can be.

Changing the variable defintion from private to internal, fixes the issue.

mapping (address => uint256) private _balances;
to
mapping (address => uint256) internal _balances;

Detect Network

Make sure injected web3 is on dai.poa.network and if it isn't throw up a big warning.

Email Private key

email private key (possibly JSON format encrypted with a password) is quite more useful and safer than copy private key, we all know browsers isn't reliable and you could be browsing intentionally or accidentally with incognito mode

Front-end: click on private key >> pop-up private key half hidden >> and three options below that
Show, Copy, and Email it

Users could be much more relaxed knowing he has a backup of his private key on the email and just use xDAI.io without that extra heartbeat :P

Id may be reused, and all transactions could be replayed to empty the signer account

Once a fund is claimed, the fund[Id] entry is destroyed.

Anyone can replay the send() and claim() transactions using the same Id, especially the previous recipient. The old transactions will be valid for the reused Id.

The recipient can initiate a cycle of send() and withdraw() replaying the 2 first legitimate transactions and empty the signer account.

You should use a nonce attached to each signer to avoid replay attack, and include the nonce in the signatures in send() and claim(). See EIP1077

A nonce is also a solution for #13 and #14 since it changes the structure of the signed data and prevent replay attack.

Adding: Request Funds functionality

use case like pizza restaurant with friends I paid with my credit card, and then I could xdai.io >> request funds >> I enter the amount and possibly a message, and share the link on WhatsApp maybe? or by QR ..

ideally, that request fund shall generate a URL >> which if opened in web3 wallet would auto-populate the amount and receiver address, if not just QR code/Wallet address like:

xDAI:0x0000000000000000000?amount=5.6&message=Payment-Piza&label=devcon&extra=other-param

Simple and easily translatable descriptions of key features

One thing we might want is a small explanation that can be easily translated for a couple of key things:

  • Basic functionality
    -- Temporary, do not store tokens long term in these wallets
    -- Sending
    -- How to receive
    -- Safely storing funds (cold storage)
  • What burning does
  • What to do with a saved private key
  • The xDia bridge

Explanations should be concise and the use of technical terms should be avoided where possible.

Add apple-touch-icon

I love Burner, just added it to my iPhone home screen but I'm sad there is no ๐Ÿ”ฅ icon.

I'd gladly push a PR if you have any icon assets.

DenDai on Brave

For some reason when I visit DenDai on Brave with my shields up it hangs and chews CPU.

Leaving a note here so I'll figure this problem out eventually

QR code partially loads

May be due to an under powered phone but QR code only partially loads on both Android Chrome & Brave browsers. Phone HTC One, Android 5.0.2
screenshot_2018-11-10-06-52-58

Interesting iPad Error on Scan

Using an old iPad and safari it works fine, but if I "add to home screen" and then access it from there, I get this error when I try to open the scanner:

image

Error Bridging DAI to ETH

First of all, let's have a prompt that comes up letting them know they don't have any gas and they need to send ETH to the address.

Second, I got this error when going DAI to ETH:
screen shot 2019-01-03 at 11 01 15 am

Style and Design

The current design/UI is very ugly. It was a quick proof-of-concept. Please create and implement a gorgeous and intuitive design.

We want it to look great and work intuitively even in different languages.

This is a big task and will take a lot of thought and style.

Show a smaller balance to cover gas costs

If I have $1.25 and I try to send $1.25 it will fail because it needs a little gas.

I think a good solution to this would be to display their balance a little smaller than it actually is.

If we are rounding down 0.01 we should probably change any default fields from 0.01 to 0.10 too.

Firefox Issues

For some reason it fails right away in Firefox. It might have something to do with MetaMask being locked or on the wrong network, but we'll need to catch that. It might be in Dapparatus.

Adding unit next to address

It's not clear this address is for xDAI, it should be very clear that you need to send xDAI explicitly to this address not Ether not DAI.

QR Code Scanner

The current QR Code scanner doesn't work on a lot of different browsers.

In particular, Chrome and Firefox.

It would be awesome if we could find a scanner that worked on every browser on mobile and desktop.

Signer may send a signature valid for both send() and claim()

In send(), the signer signs bytes32 Id, but if the Id is chosen to be equal to keccak256(destination), then the data and signature are identical in send() and claim(): both refer to keccak256(destination) as data.

So the issue is how the Id is generated, and if it is controlled by a third-party, it can be set to a specifically crafted value of keccak256(address_attacker) and submitted to the signer. The signature can then be used by the attacker in claim() after 100 blocks.

Legitimate users are at risk of being robbed by a malicous third-party generating Id on their behalf.

The fix is, for example, to sign keccak(Id, "CONSTANT") instead of Id to make the signed data unpredictable.

After Scan Loading Time

There is a weird UX issue where after you scan on a slow network you don't get any feedback until the page loads.

As soon as the qr scanner detects a code, we should show an intermediate screen while the link loads. Some kind of burner loader.

Clean up React - create many components from monolithic single file

Right now the src/App.js is one big file. Please apply React best practices and divide the large file into many, easy to use components.

The goal would be to make it much easier to read and update the code.

This task could take a while and requires a good understanding of React

Reject // Auto-refund // Send-back functionality

To allow for seamless recovery of lost token sent to xdai.io (burner wallet) It would be great to have sort of "Reject" // Auto-refund functionality, in another word if you send anything to this burner address but xDAI the smart contract would transfer it back to the sender within n hrs

On front end user shall be notified, he should see sort of notification with x fund/tokens received with error (it's not xDAI) and maybe 1) click to refund immediately 2) export private key

Currently, a user sending n DAI instead of xDAI, wouldn't be able to recover it easily even with the private key, he would still need to send some small ETH to the address >> to be able to recover his funds, too much complexity..

The signature submitted in claim() can be reused multiple times

The signature in claim() refers only to the destination address.

So, once a valid signature has been published for a specific destination, It can be reused to claim all the funds for any Id where funds[Id].signer is the same signer.

I am not sure that it is or not the intention of the developper, but we can have N send() from one signer, then 1 claim() with its signature and we can generate immediately the N-1 claim() to the same destination.

I propose to sign keccak256(Id, address) to prevent this replay attack.

*Burner wallet* and naming

I personally like Burner Wallet name but I've learned the hard way to look at things through the eyes of the audience

the Q. is how "burner wallet" as a name would convey a user-friendly, seamless, trustworthy experience? do you wanna consider something else? maybe

  • Web wallet
  • Flat wallet, feeless wallet
  • IO Wallet
  • or Instant Wallet << my favorite

Include chain id in signed data

Hi, others have been mentioning that a nonce is need to prevent replay attacks. However, I think a nonce might not be enough if burner wallets exist on mainnet and testnets. Even with a nonce, a replay attack is possible when a claim (happened on testnet) is replayed on mainnet. This assumes that the other fields are identical as well, which is possible IMO.

A workaround, in case my concern is valid, is to add another net-unique constant, e.g. the chain id, to the signed data.

Curious to hear if others share that opinion

Android 4.1 Browser

img_5246

It's incredibly important that this wallet works on older browsers. QR code scanning and everything.

Specifically Android 4.1

Right now I got it working past the SSL part but it loads a blank page.

Expired Message Sends need to automatically be withdrawn

After a certain amount of time, value sent in messages over services like WeChat will expire.

When they expire the sender will need to withdraw them from the Links contract.

For ephemeral accounts, just withdraw them automatically, but for injected web3 accounts, provide a button to withdraw.

when destination.call() fails, funds get destroyed

Hi, in claim(..., address destination) the line destination.call.value(value).gas(msg.gas)() can fail in case destination is a smart contract that requires more than msg.gas to execute its fallback function or simply reverts because of other reasons. If it fails, call() returns false which will make the transaction succeed. However, the Fund is destroyed by delete funds[id]; and not successfully transferred to destination.

destination.transfer(value) is safer to use as it reverts on failure and costs max. 2300 gas.

Correct me if I'm wrong.

Burner Wallet Loading Gif

Create a bad ass loader gif for the burner wallet.

There are moments when you are waiting for the Burner to scan QR code or send a transaction.

Right now there is a filler loader but let's create something awesome.

It would be cool if it was "burner" / "cypherpunk" themed maybe even one that is qr code themed

It should be around 150px x 150px and still load quickly on old phones

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.