add proposal to build Monero Browser Wallet + selfhostable Payment Links + multisig companion app

2025-04-10 09:27:33 +00:00 · 2025-02-26 12:52:59 +00:00 · 2025-02-26 12:52:59 +00:00 · c138f08c78
commit c138f08c78
parent a1b62192b0
1 changed files with 142 additions and 0 deletions
--- a/spirobel_monero_browser_wallet.md
+++ b/spirobel_monero_browser_wallet.md
@ -0,0 +1,142 @@
+---
+layout: fr
+title: Monero Browser Wallet
+date: Sep 10, 2024
+author: Spirobel
+amount: 335
+milestones:
+  - name: prepayment for first month
+    funds: 20 XMR
+    done:
+    status: finished
+  - name: Monero Payment Links + multi wallet syncing
+    funds: 90 XMR
+    done:
+    status: unfinished
+  - name: Monero Browser Wallet
+    funds: 125 XMR
+    done:
+    status: unfinished
+  - name: Multisig companion app + escrow library
+    funds: 100 XMR
+    done:
+    status: unfinished
+payouts:
+  - date:
+    amount:
+  - date:
+    amount:
+  - date:
+    amount:
+  - date:
+    amount:
+---
+
+# Monero Browser Wallet
+
+## Who
+
+**Spirobel**
+
+References:
+
+#### found and reported a "pay what you want" vulnerability in AcceptXMR
+
+https://x.com/spirobel/status/1672479215512588288
+
+https://github.com/busyboredom/acceptxmr/issues/64
+
+#### open sourced a Patreon like tool for Monero
+
+https://x.com/spirobel/status/1595949928634667008
+
+https://github.com/spirobel/monero-discourse-subscriptions
+
+#### open sourced a merchant focused wallet-rpc
+
+https://x.com/spirobel/status/1596299822516285440
+
+https://github.com/spirobel/monerochan-merchant-rpc
+
+#### implemented a Monero Browser wallet extension PoC
+
+https://www.youtube.com/watch?app=desktop&v=4DLcsQ45zoE
+
+https://github.com/spirobel/monerochan-city-wallet
+
+#### wallet-rpc library
+
+https://ccs.getmonero.org/proposals/spirobel_robust_modular_wallet_rpc.html
+
+https://www.npmjs.com/package/@spirobel/monero-wallet-api
+
+https://github.com/monerochan-ecosystem/monero-wallet-api
+
+Contact: twitter.com/spirobel
+
+## What
+
+**Result:** Monero browser wallet, selfhostable stripe payment links alternative, multisig companion app,
+accessible cross platform Monero library
+
+The deliverable for this proposal will be:
+
+1. A selfhostable Stripe Payment Links alternative built on
+   the [monero-wallet-api library](https://github.com/monerochan-ecosystem/monero-wallet-api).
+   It is necessary to have a checkout flow with real world use to establish the Wallet-Webapp
+   interaction UX. The [preliminary UI work](https://x.com/spirobel/status/1871161899410440670)
+   on this product has been well received.
+2. The Monero browser wallet.
+   The next step is the implementation of the send functionality in the library and the wallet itself.
+   The second milestone contains all the UI for syncing, sending, error states and the Wallet-Webapp interaction.
+3. A Multisig companion app that allows to split spend keys over multiple devices. This means a phone can serve as a second factor to a laptop and both devices need to be compromised to access funds. The work will make use of the [recently audited](https://ccs.getmonero.org/proposals/monero-serai-wallet-audit.html) multisig code. As a side effect it will become more accessible to build escrow and multisignature enabled apps with the underlying typescript library.
+
+### Implementation
+
+list of initial tasks:
+
+- add multi wallet syncing to the library
+- integration of checkout flow in the Payment Links app
+- enable multi wallet background syncing in Monero Payment Links
+- build Monero Payment Links transaction section and transactions tab
+- calculate & display aggregate amount per wallet
+
+- add private key management to the extension
+- build indexeddb backend for output storage
+- implement spend function
+- add transaction history screen to the browser extension
+- implement interactive checkout that will remove need to copy addresses
+
+- add FROST dkg methods to the monero wallet api typescript library
+- implement initial connection and setup in extension and multisig companion app
+- handle transaction signing & display in the companion app
+- implement transaction submission
+- recovery from fresh scan
+
+  this task list is not exhaustive and subject to change
+
+## Milestones
+
+value commitment:
+
+The 3 deliverables outlined in the **What** section are the promised outcome of this proposal.
+In addition, new functionality becomes available in the underlying library.
+The Monero Payment Links product is 110, the Browser Wallet extension 125, the Multisig Companion app + lib 100, in total 335 xmr
+
+## Why
+
+Currently Monero shoppers have to copy and paste addresses from the tor browser into their wallets.
+This can be made more convenient and secure by a browser wallet.
+
+The Monero Browser Wallet PoC that I wrote is fundamentally different from typical browser wallets.
+Instead of injecting Javascript into the page and excusively communicating via message events, it uses a REST api.
+The initial trigger in the PoC still happens through a message, but the plan is to get rid of that.
+As a result the checkout will work in a Javascript disabled environment while providing the same seamless user experience.
+
+The browser is still seen as a potentially large attack surface.
+Even with all the security features and sandboxing techniques that
+modern browsers employ, there is still the risk of 0day exploits.
+This risk can be mitigated by spreading the secret key among multiple devices and necessitating access to all of them to sign a transaction.
+The goal of the last milestone is to make this easy through the use of a multisig companion app.
+
+tldr: the browser wallet makes monero web shopping more convenient and secure