Cold wallet signing over QR (Keystone / Quantus cold wallet app)#123
Open
n13 wants to merge 1 commit into
Open
Cold wallet signing over QR (Keystone / Quantus cold wallet app)#123n13 wants to merge 1 commit into
n13 wants to merge 1 commit into
Conversation
Adds watch-only cold wallets (`wallet import-cold`) and QR-based signing for `send`: the CLI displays the raw V4 signing payload as a ur:quantus-sign-request QR, scans the device's animated signature UR with the laptop camera (or file/stdin for headless use), verifies the response against the stored address, and submits. Speaks the exact wire protocol of the mobile app / cold wallet app / Keystone firmware (quantus_ur tag 1.4.0). Includes a hidden `developer cold-sign-sim` command that plays the cold-wallet side with a local hot wallet for dev-node e2e testing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| assert!(json["encrypted_data"].as_array().unwrap().is_empty()); | ||
|
|
||
| // Decryption paths refuse with ColdWalletNoKeys (no password prompt) | ||
| let result = wallet_manager.load_wallet("frosty", ""); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds air-gapped signing to the CLI: import a Keystone 3 or Quantus cold wallet app account as a watch-only wallet, then
quantus send --from <cold-wallet>signs by exchanging QR codes — show the transaction as aur:quantus-sign-requestQR, sign on the device, scan its animated signature UR back with the laptop camera.wallet import-coldscans the device's address QR (or takes--address).Key design decisions
quantus_urcrate (git tag 1.4.0) the mobile app, cold wallet app, and Keystone firmware pin, so the CLI is a drop-in third participant — no device-side changes needed.ExtrinsicParamsEncodertraits. subxt's ownsigner_payload()blake2-hashes payloads >256 bytes, which would make them unparseable (and undisplayable) on the device.TxContextand reused verbatim for both the QR and the submitted extrinsic, with a runtime cross-check that the two constructions agree. The oldhardware_mark_1branch silently refetched the nonce between display and submit, invalidating signatures — that bug is structurally excluded here.wallet_typefield: old files read as hot, old CLI versions still parse cold files, andlist/findpaths needed no changes. All key-requiring paths refuse cold wallets before any password prompt.nokhwa+rqrr);--cold-response-in <file|->keeps headless/no-camera builds fully functional, and the signing machinery is generic over any call payload so multisig/reversible can adopt it later.Testing
developer cold-sign-simcommand (plays the cold-wallet side with a local hot wallet, exchanging UR parts over files): transfer signed, submitted, and included in a block; fee preview matched the actual fee to the unit; wrong-signer response aborted as expected../clippy.shclean, full test suite passing,cargo build --no-default-featuresgreen.Not yet tested: physical camera scanning against a real Keystone/cold-wallet-app (needs Heisenberg/Planck — real devices enforce a genesis allowlist that excludes dev nodes).
🤖 Generated with Claude Code