jwinterm
8120d93fb8
6 confirmed findings (review wqrd2gka3), 3 root-cause fixes: - HIGH: execute_erasure had no status recheck and the sweeper's SKIP LOCKED row lock was released before execution (separate connection), so (a) a request CANCELLED after the sweep's SELECT was still executed, and (b) a fleet could double-execute one erasure (duplicate hash-chained audit row, double count). Fixed by making execution atomically CLAIM the row as its first statement — `UPDATE ... SET status='completed' WHERE id=$1 AND status='confirmed' RETURNING user_id` — and skipping (returns false) when 0 rows match. Only the first executor of a still-confirmed request proceeds; a cancelled/already-done row is a no-op; on any later failure the whole tx (claim included) rolls back. - account-existence oracle: the absent-user request path returned a FRESH random erasure_id + advancing scheduled_for each call, while a real account returned a STABLE get-or-create id — a re-call distinguisher. The request response is now constant-shape: a STABLE id (real, or a deterministic integrity-secret-keyed synthetic for the absent path), a fixed "pending" status, and NO scheduled_for (it's meaningful only at confirm, where grace starts, and is returned there). - config: ERASURE_GRACE_PERIOD_HOURS is bounded (<= 10 years) in validate(), so the u64->i64 cast can't wrap negative (defeating grace) and Duration::hours can't panic. Dismissed after verification: ERASURE_ENABLED without FEATURE_NOSTR_IDENTITY (validate already requires PUBLIC_API_URL; the nostr_identity coupling is a nicety). Tests extended: cancelled-request-not-executed (HIGH regression), double-execute no-op. 140 lib + 140 integration green, no drift, scans clean.
smirk-backend-core
Open, self-hostable backend for the Smirk non-custodial, multi-chain wallet. It provides the chain-access and identity surface a Smirk wallet needs — authentication, per-chain wallet access (Bitcoin, Litecoin, Monero, Wownero, Grin), the Grin slatepack relay, and Nostr-based identity — so anyone can run their own backend and a Smirk wallet can connect to it.
Status: early, under active development. Interfaces and the database schema may change before the first tagged release. Not yet recommended for production self-hosting.
What it is
- Non-custodial. The server never holds spend keys or seeds. It brokers access to blockchain data and relays wallet-to-wallet messages.
- Open core, feature-flagged. Every feature ships in this codebase and is
toggled per deployment; the wallet reads
GET /api/v1/capabilitiesand adapts to what a given backend offers. - Identity via "Sign in with Smirk". Authentication uses a seed-derived Nostr key (NIP-98); the server stores only public keys.
- Privacy first. No PII is required to use it; operator and user privacy are explicit design goals.
Architecture
Rust + Axum, PostgreSQL via sqlx. The public HTTP contract is generated from the handlers with utoipa (OpenAPI), which in turn drives the wallet's generated TypeScript client — one source of truth, checked for drift in CI.
Quickstart
cp .env.example .env # then fill in DATABASE_URL, JWT_SECRET, node URLs
cargo run # starts the API server
A full self-hosting guide (node requirements, reverse proxy, Tor admin onion,
backups) will live in docs/ as it stabilises.
Security
Please report vulnerabilities privately — see SECURITY.md. Do not open public issues for security reports.
License
To be finalized (MIT vs AGPL-3.0-or-later). Until a LICENSE file is added,
all rights are reserved.