jwinterm
e838565ed7
BTC/LTC Electrum/Fulcrum client, reworked clean from the chain-audit playbook (not ported). Every byte from a server is treated as hostile. Security: - TLS verified against the webpki root store WITH hostname checking; the accept-any-certificate verifier is gone (closes the MITM hole). The connector is built once and reused. - Addresses decoded via the `bech32` crate (full checksum + bech32m + witness version) and base58check (checksum); the hand-rolled bech32 underflow panic is removed. Coin/network enforced (reject ltc-on-btc, testnet-on-mainnet) — no byte-indexing of untrusted input. - Amounts pass a fallible checked f64->sat converter (rejects non-finite/negative/>2^53) with checked_add summation; no silent saturation to 0 / u64::MAX. estimatefee requires finite, clamps. - Bounded response read + per-exchange timeout (no OOM, no slowloris). - JSON-RPC response id correlated with the request. - Untrusted upstream text is control-stripped + length-capped before it reaches a (privately-logged) NodeError. Single `call` primitive centralizes failover + id + envelope mapping; public methods (balance/utxos/history/tip/verbose-tx/broadcast/fee) are thin wrappers. Tip-attribution helpers dropped; total_sent_from now declines (None) without resolved prevouts instead of mislabeling a receive-with-change as a send. 20 L2 tests: address->script KATs (P2WPKH/P2WSH/taproot/legacy), network rejection, panic-safety on short/garbage input, checked-sat bounds, envelope id correlation, bounded/oversized read, duplex round-trip.
smirk-backend-core
Open, self-hostable backend for the Smirk non-custodial, multi-chain wallet. It provides the chain-access and identity surface a Smirk wallet needs — authentication, per-chain wallet access (Bitcoin, Litecoin, Monero, Wownero, Grin), the Grin slatepack relay, and Nostr-based identity — so anyone can run their own backend and a Smirk wallet can connect to it.
Status: early, under active development. Interfaces and the database schema may change before the first tagged release. Not yet recommended for production self-hosting.
What it is
- Non-custodial. The server never holds spend keys or seeds. It brokers access to blockchain data and relays wallet-to-wallet messages.
- Open core, feature-flagged. Every feature ships in this codebase and is
toggled per deployment; the wallet reads
GET /api/v1/capabilitiesand adapts to what a given backend offers. - Identity via "Sign in with Smirk". Authentication uses a seed-derived Nostr key (NIP-98); the server stores only public keys.
- Privacy first. No PII is required to use it; operator and user privacy are explicit design goals.
Architecture
Rust + Axum, PostgreSQL via sqlx. The public HTTP contract is generated from the handlers with utoipa (OpenAPI), which in turn drives the wallet's generated TypeScript client — one source of truth, checked for drift in CI.
Quickstart
cp .env.example .env # then fill in DATABASE_URL, JWT_SECRET, node URLs
cargo run # starts the API server
A full self-hosting guide (node requirements, reverse proxy, Tor admin onion,
backups) will live in docs/ as it stabilises.
Security
Please report vulnerabilities privately — see SECURITY.md. Do not open public issues for security reports.
License
To be finalized (MIT vs AGPL-3.0-or-later). Until a LICENSE file is added,
all rights are reserved.