jwinterm
7ddb586cbe
Reworked clean from the chain-audit playbook into one generic client over CryptoNoteNetwork (Monero + Wownero share the LWS API). The LWS may be remote/community-run, so every response is treated as hostile. Security (closes the audit CRITICAL/HIGH/MEDIUM findings): - The two `&str` byte-slice panics are GONE: responses are parsed via a generic post_json -> read_capped -> serde_json::from_slice path. No byte-indexing of an untrusted body anywhere; the JSON-error-column slice is deleted. - Streaming size cap (8 MiB) enforced as bytes arrive (content-length is attacker-asserted) + shared reqwest client with request/connect timeouts. No unbounded read, no slowloris. - Admin key held in a redacting `Secret` (Debug -> "***"); secret-bearing request structs drop `Debug`; #[instrument] skips view_key. - Non-success -> generic NodeError tagged with a static endpoint label + status code only; the upstream body is never interpolated into a log or error. Transport (connect) errors are logged privately, redacted publicly. - Amounts are u64 end-to-end via the fail-closed string_or_* deserializers (garbage/overflow -> Err, never panic/silent-zero); mempool sum and confirmation math use saturating ops; future-block confirmation -> 0. - Ring/decoy count clamped (MAX_DECOY_COUNT) + request/parsed fan-out capped (MAX_PARSED_VEC). 0-conf architecture: default is REST-poll (compute pending on-demand from get_address_txs, which includes mempool on current monero-lws). HTTP webhooks are NOT brought over (redundant + fragile per docs/lws-update.md); ZMQ-push stays an optional, feature-flagged unit for single/own backends wanting instant confirms. Kept the account-lifecycle calls (modify_account_status/rescan/account_scan_height) — those are the deep-sleep machinery REST-poll uses to wake/sleep accounts for scale. Dropped the /login pending flow + all dead/tip surface. Adds a shared redacting `Secret` (core::secret, grin reuses) and the reqwest `stream` feature for bounded reads. types.rs kept (the string_or_* fail-closed helpers) with secret request structs de-Debug'd and error-not-panic tests. 15 L2 tests. Adversarially reviewed (7/7 audit findings closed; future-block confirmation hardened).
smirk-backend-core
Open, self-hostable backend for the Smirk non-custodial, multi-chain wallet. It provides the chain-access and identity surface a Smirk wallet needs — authentication, per-chain wallet access (Bitcoin, Litecoin, Monero, Wownero, Grin), the Grin slatepack relay, and Nostr-based identity — so anyone can run their own backend and a Smirk wallet can connect to it.
Status: early, under active development. Interfaces and the database schema may change before the first tagged release. Not yet recommended for production self-hosting.
What it is
- Non-custodial. The server never holds spend keys or seeds. It brokers access to blockchain data and relays wallet-to-wallet messages.
- Open core, feature-flagged. Every feature ships in this codebase and is
toggled per deployment; the wallet reads
GET /api/v1/capabilitiesand adapts to what a given backend offers. - Identity via "Sign in with Smirk". Authentication uses a seed-derived Nostr key (NIP-98); the server stores only public keys.
- Privacy first. No PII is required to use it; operator and user privacy are explicit design goals.
Architecture
Rust + Axum, PostgreSQL via sqlx. The public HTTP contract is generated from the handlers with utoipa (OpenAPI), which in turn drives the wallet's generated TypeScript client — one source of truth, checked for drift in CI.
Quickstart
cp .env.example .env # then fill in DATABASE_URL, JWT_SECRET, node URLs
cargo run # starts the API server
A full self-hosting guide (node requirements, reverse proxy, Tor admin onion,
backups) will live in docs/ as it stabilises.
Security
Please report vulnerabilities privately — see SECURITY.md. Do not open public issues for security reports.
License
To be finalized (MIT vs AGPL-3.0-or-later). Until a LICENSE file is added,
all rights are reserved.