krakenfx / wallet Goto Github PK

Kraken Wallet is a powerful self-custody wallet built for the decentralized web

License: MIT License

JavaScript 0.99% Ruby 0.10% Java 0.46% Kotlin 0.39% TypeScript 97.31% Objective-C 0.06% Swift 0.51% Objective-C++ 0.13% Starlark 0.04%

wallet's Introduction

Kraken Wallet

Kraken Wallet is a Crypto and Bitcoin self-custody wallet where your keys never leave your device. Engineered and crafted by the mighty and OG Kraken.com. It is built with React Native, Realm, an Electrum Server, and other FOSS projects. The backend runs over a proxy to ensure your personal data is never shared with 3rd party services or companies. It is built under strong principles of privacy, self-custody, and security to ensure maximum sovereignty for its users. It is open sourced under the MIT license.

This repo functions as a mirror of the main private development repo. Its main purpose is to provide audibility, trust minimization, and code review. Please provide feedback, vulnerabilities or bug reporting using the responsible disclosure process.

Main features

Multi-chain support (Bitcoin, Ethereum, Polygon, Arbitrum, Optimism, Base, Solana, and Dogecoin)
View and manage your Assets
View and manage your NFTs
View your DeFi Deposits
WalletConnect support
Single Seed for Multiple Wallets
Import Wallets (BIP39 standard)
Push Notifications for Android and iOS
Data encryption using password and/or biometrics
Multi-language support

Official Channels

License

Kraken Wallet's source code is released under the terms of the MIT license.

Security Audit

Trail of Bits - [link]

Security Model

Security architecture blog post

Responsible Disclosure

All bug and vulnerability disclosures must go through the properly defined channels.

Contact: [email protected]
Review the bug bounty policy first before submitting your findings.

Contributing

We welcome contributions from the community. Here are a few guidelines to help you get started:

Security-Related Bugs and Disclosures

For any security-related issues, please refer to our Responsible Disclosure policy. It's crucial that these matters are handled sensitively to protect all users.

Feature Requests

If you're interested in suggesting a new feature, please submit a detailed issue on Github. Include the purpose of the feature, its potential impact, and any ideas you have for how it might be implemented. This will help us understand and evaluate your proposal more effectively.

Pull Requests

Please note that our repository is a point-in-time mirror of our internal repository, which means we cannot directly merge pull requests. However, every pull request is valuable and will be reviewed by our team. Contributions considered suitable will be manually integrated into our internal repo and reflected in future releases.

Upcoming Improvements

We are currently working on providing build files and developer documentation that are necessary for quality PRs. We expect to roll out these resources soon and will keep the community updated on our progress.

wallet's People

Contributors

Stargazers

Watchers

wallet's Issues

Make a Chrome and Firefox Extension

Android/Iphone is not enough, break us free from coinbase! Make a chrome and firefox extension as well!

Add support for a lightning parameter in QR code BIP21

Support for LN deposits using unified QR codes should be great IMHO:

https://bitcoinqr.dev/

Improve security and dependency situation

I maintain ethereum-cryptography, which was created to combine all ethereum deps in one package. The work was funded by EF in 2021. You are already using it through some of your deps.

Kraken depends on a bunch of unnecessary cryptographic libraries. For example, for secp256k1, you use at least 4 libraries: secp256k1, tiny-secp256k1, elliptic and @noble/curves. Instead of it, one library can be used. Sometimes you are using outdated dependencies, that have not been maintained for years.

A dependency can get an update and add malware to your bundle. This can be combatted:

by manually checking every dependency upgrade diff
by utilizing lavamoat sandbox (like metamask does)

It can be assumed that you did not personally audit every line of dependency. Neither did your auditor, because that would be too long and expensive.

You are already using audited noble-hashes and noble-curves through @solana/web3.js, bip32, bip39, ethers and others. I suggest to do following steps:

ripemd160 can be replaced by noble-hashes
secp256k1 can be replaced by noble-curves
slip39 can be replaced by ed25519-keygen, which depends on noble-curves
tiny-secp256k1 can be replaced by noble-curves
web3 v1.10 can be upgraded to v4 which depends on noble-curves
ethereumjs-wallet v1 can be upgraded to v2, which depends on noble-curves and noble-hashes
ed25519-hd-key: see 3, is unnecessary
crypto-browserify should be removed (last update 6 years ago, unmaintained, lots of deps) and replaced by noble-hashes
ecpair can be replaced by noble-curves or scure-btc-signer
electrum-mnemonic can be replaced by scure-bip39 (todo: research if feature-parity is achieved)
bignumber.js is not needed, can be replaced by native BigInt
@metamask/eth-sig-util can be upgraded from v4 to v7, which depends on noble-curves

Pending sends incorrectly show the fee amount as a portion of available balance

As titled, when you send funds and they're pending confirmation, the amount spent on fees for some reason still counts towards your available balance, even though there are no UTXOs owned by the wallet at all. In the image the fee paid was ~$2.05 as shown in the available balance:

Missing files for external contributors

Hello Krakenites,

I was interested in contributing to your open-source project and decided to try to deploy it locally.
Unhappily there seems to be some missing files. Some that I already found:

on /src/App.tsx I can't import this line import { runMigrations } from './utils/migrations';
on /src/hooks/useDebugInfo.ts this statement this require won't work: const gitInfo = require('/git-info.json');

After commenting those lines I still struggle with the following error:

error: node_modules/react-native-reanimated/src/reanimated2/core.ts: .../kraken-wallet/node_modules/react-native-reanimated/src/reanimated2/core.ts: Cannot find module '@babel/plugin-proposal-optional-chaining'

I have tried with and without Expo Go, just to get the same result. So, I guess I am out of luck.
I would be happy to assist you in making it easy for contributors to get onboarded on this project.

Cheers,
Pedro

Copy issue in "More than just crypto storage" modal

Request for Developer Documentation and Basic CI Tooling

Firstly, I'd like to commend you on the recent release of your open-source wallet. This initiative is a significant step towards transparency and fosters community involvement, which is commendable.

As a developer interested in contributing to the project, I encountered challenges setting up and running the wallet locally due to the absence of developer documentation. Would it be possible for the team to provide some insights or guidelines on how to develop locally, properly?

Furthermore, implementing GitHub Actions with basic CI tooling would be beneficial. Automating the testing process can enhance code quality and streamline contributions for the community. While I understand GitHub might not be your primary platform, given the security audit I've read, integrating some tooling here could still be advantageous.

Received funds are marked as "Send" and incorrectly show the same address for sending and receiving

When testing out the Bitcoin portion of the wallet, I noticed that received funds are incorrectly marked as sends, and show the recipients address as the sending address. That also means that the amount of the transaction is displayed incorrectly. The pictured received transaction was from an external wallet to Kraken Wallet.