aelfproject / aelf-web-wallet

Web wallet for AElf

AElf Web Wallet

0.Dependencies

• Start up AElf Chain, aelf-block-scan, aelf-block-api at first

• important call the API[POST:api/nodes/info] of aelf-block-api to insert the AElf Node information.

  • Detail the APIs Postman share link
  • You can update the information throught the PUT API.

• NodeJS: You can see the JS dependencies in pakage.json, we use egg.js(Node.js & Koa).

• Correct config.

• optional Nginx (or others) // SSL for Secure, Proxy for cross-origin.

1.Change config

config/config.default.js

config/config.node.js
# set you own apiServerProvider // api from aelf-block-api
# set your own default mainTokenName & mainTokenContract

database/config.json
# set your sql config for sequelize

2.Install Webpack & compile front files

npm install -g webpack
npm install -g webpack-cli

npm run build
# npm run build:dev
# npm run build:dev:w

3.Operate mysql by sequelize

npm run create-db
# npm run create-db:dev
npm run migrate
# npm run migrate:dev
# npm run undo-all
# npm run undo-all:dev

3.Start the node server

npm install
# If meet permisson problem.
# sudo npm install --unsafe-perm=true --allow-root

# dev
npm run dev
# pro
npm start

default port: 7001

Nginx(For Your Information)

How to open gizp.

How to config https.(We do not config https server in nodejs.)

How to proxy in nginx instead of proxy in nodejs.

• nginx.conf

  • see how to open gizp

• servsers/wallet.online.conf & servsers/wallet.conf

  • set your own RPC URL.
  • set your own server_name.
  • when use online(https)set your own ssl_certificate and ssl_certificate_key.

And please use plugin.nginx.js & demo.config.default.nginx.js instead of plugin.js & demo.config.defalut.js

FAQ

permission denied, open '/home/zhengyue/github/aelf-web-wallet/.travis.yml'

no such file or directory, scandir '/opt/aelf/app/aelf-web-wallet/node_modules/node-sass/vendor'

eggjs/egg#2442 (comment)

sudo npm install --unsafe-perm=true --allow-root
# Then
bash build.sh pro # or npm start

How to deal with int64

Use Long.js

https://www.npmjs.com/package/long

Docker[TODO]

aelf-web-wallet's Issues

TODO

Components

• Fee select [done] Using Feeselect components under component

• Modal [done] Using Pursecipher components under component

Pages

• Transactions List [done] Whether the value of legal tender is displayed remains to be confirmed

• Address Book [done]

• New Contact Address Page [done]

• Add Token Page [done] Transaction list page and token search logic modification

Internationalization

• react i18n [done] To be repaired: antd-mobile internationalization

• Do a representation: How the i18n work. (Code & Logic -> PPT || Blog) [done] langConfig -> README

[wallet] Some feature issue of web-wallet

• 1. call the API[POST:api/nodes/info] of aelf-block-api to insert the AElf Node information. when the
  rpc_domain: " ", send transaction will get error message: {"message":"Validation Failed"}
  

• 2. When two chain's symbol is same, cannot display transaction information on the second chain

• 3. Failed to import wallet with private key.

• 4. Can't display the failed transaction on transaction list.

• 5. When the password is simple, it will get message "The passwords confirmed error." need add the other passwords error message.

• 6. In Create wallet, can't disabled the align
  

• 7. In Chinese system, the Amount converted money display USD

[wallet]Some UI issue of web-wallet

• 1. The font is wrong and some opacity is wrong.

• 2.The transaction record doesn't display the transaction time and the transaction money
  
  expected results:
  

• 3.When the window is small, such as in iPhone, the address in Qr code display out of range
  

• 4. The clear button in Transaction Search is ugly
  

• 5. Some information is displayed in a different language than the system language
  1）In English, the amount of transfer display in Chinese
  
  2) In Chinese, the password error message is in English
  

• 6. In some display screen, there is a white line between two Tokens
  

• 7. In Backup Mnemonic, resize the window , the background is wrong
  

The selector is highlighted repeatedly when the wallet name is the same

• The same problem arises with the location of the drawer menu [done]

Error of Cross SDK; throw Error but not return error:1

aelf-web-wallet/app/web/js/utils/crossChain.js

Lines 137 to 142 in 55ce713

	// TODO: Error of Cross SDK; throw Error but not return error:1
	async receive(params) {
	const isReadyToRecevie = await this.isChainReadyToReceive(params);
	if (isReadyToRecevie.error) {
	throw Error(isReadyToRecevie.message);

---

This issue was generated by todo based on a TODO comment in 55ce713 when #56 was merged. cc @AElfProject.

use api instead of hard code config

aelf-web-wallet/config/config.node.js

Lines 24 to 29 in 55ce713

	// TODO use api instead of hard code config
	WEB_API_INFO: encodeURIComponent(JSON.stringify({
	AELF: {
	url: 'http://3.25.10.185:8000',
	explorer: 'https://explorer-test.aelf.io',
	// url: 'http://54.199.254.157:8000',

---

This issue was generated by todo based on a TODO comment in 55ce713 when #56 was merged. cc @AElfProject.

Suggestions to ELF wallet

1、The transaction fee for every tacsaction is charged the same amount(0.1ELF)regardless the tranfer amount.
Suggestion: What about setting up a minimum commission fee for limited tansfer amount, and charging additional fee based on setted rules for the exceeding amount.
2、The commision fee for transaction is charged from the balance in wallet, which means the wallet must have TOKEN left.
Suggestion: What about charging the commision fee from the amount transferred.
3、Is it suitable to show the information of transaction failed in the receiving account as well?

[TODO] ELF tranfser need BigInt

See the issues in AElf

proxy API -> plugin???

aelf-web-wallet/config/demo.config.default.nginx.js

Lines 19 to 24 in d7edff3

	// DISCUSS & TODO: proxy API -> plugin???
	// 如果不使用Nginx来代理，请使用这段node代码
	// For dev: you can use these codes instead of the config in nginx.
	// config.proxy = [{
	// serviceName: 'AElf Node RPC', // never use
	// host: 'http://127.0.0.1:7250', // target host that matched path will be proxy to

---

This issue was generated by todo based on a TODO comment in d7edff3. It's been assigned to @hzz780 because they committed the code.

Modifying search logic

Modifying search logic

• Transactions List Modifying search logic [done]
• add Token Page Modifying search logic

use api at first

aelf-web-wallet/app/web/js/utils/crossChain.js

Lines 166 to 171 in 55ce713

	// TODO use api at first
	// http://127.0.0.1:7000/api/cross-chain/is-ready-to-receive?
	// send=http://54.199.254.157:8000
	// &receive=http://3.112.250.87:8000
	// &main_chain_id=9992731&issue_chain_id=9992731
	// &cross_transfer_tx_id=841988ce167d5c6ae6a791c0113ef95dd57840b32275e5854a056af40eb13608

---

This issue was generated by todo based on a TODO comment in 55ce713 when #56 was merged. cc @AElfProject.

[wallet] The contact function needs to be updated

Backup

Can't backup my wallet using private key only

【TODO】Token List Page Business Logic Modification and Wallet Existing bug Modification

TokenList

• TokenList Logic modification [done]
• Modify existing bugs in wallets []done
• componentWillReceiveProps -> getDerivedStateFromProps [done]

[contracts] TODO

• 1 UI problem
  

• 2. Code Problem
  
  

[Community Bug] + Wallet is Vulnerable to MiTM

Vulnerability: Wallet is Vulnerable to MiTM Attack/SSLStrip Attack (Hacking HTTPS)

Description: It was observed that the wallet is vulnerable to a MiTM (Man in The Middle) Attack. This means an attacker can intercept the connection between a web browser and a trusted wallet by forcing the wallet to load without utilizing SSL/TLS.

Vulnerable Application: Wallet https://wallet-test.aelf.io

Severity: High

Steps to Reproduce:
1- Enter the below command in a Linux command prompt: iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
2- Now use the below command to enable forwarding: echo 1 > /proc/sys/net/ipv4/ip_forward
3- Now use arpspoofing for the target victim: arpspoof -i eth0 -t victim ip gateway ip
4- You should now see that arpsoof is running. Now in a separate terminal window type the following command: sslstrip -l 8080
5- When the victim tries to access wallet-test.aelf.io it will load over HTTP.

Or

check the HSTS Presence in the response header.

Impact: An attacker can force the wallet to utilize HTTP. Once the wallet is over HTTP then an attacker can sniff the communication.

Fix: The following are recommendations to protect against SSLStrip and similar attacks:
1- Enable HSTS
2- Enable HTTPS throughout the website

Screenshot: Shows wallet is NOW accessible over HTTP

Attack Reference: Reference link to understand more about this issue:
https://www.cybrary.it/0p3n/sslstrip-in-man-in-the-middle-attack/

[Cryto TODO]salt an AES password at each encryption

https://crypto.stackexchange.com/questions/5868/should-i-salt-an-aes-password-at-each-encryption

optimize, use info from tx to verify the request.

aelf-web-wallet/app/service/crossTransactions.js

Lines 19 to 24 in 55ce713

	// TODO: optimize, use info from tx to verify the request.
	const key = ellipticEc.keyFromPublic(public_key, 'hex');
	return key.verify(address, signed_address);
	}
	class CrossTransactionsService extends Service {

---

This issue was generated by todo based on a TODO comment in 55ce713 when #56 was merged. cc @AElfProject.

use api to getTokenInfo.

aelf-web-wallet/app/web/js/utils/crossChain.js

Lines 71 to 76 in 55ce713

	// TODO: use api to getTokenInfo.
	// A good news is that we only support AELF, EPC, EDA, EDB, EDC, EDD to crossChain now.
	mainChainId: this.WEB_API_INFO.AELF.id,
	issueChainId,
	queryLimit: 1
	});

---

This issue was generated by todo based on a TODO comment in 55ce713 when #56 was merged. cc @AElfProject.

is insufficient?

aelf-web-wallet/app/web/js/utils/crossChain.js

Lines 211 to 216 in 55ce713

	// TODO: is insufficient?
	// const receiveInstance = new AElf(new AElf.providers.HttpProvider(url));
	//
	// return {
	// isNotReady: false,
	// message: 'insufficient'

---

This issue was generated by todo based on a TODO comment in 55ce713 when #56 was merged. cc @AElfProject.

Wallet for the side chain.

API

• Proxy
• get nodes info
• get the balance of different tokens.

Test & Debug