Skip to content

Security model

Trust the smallest possible boundary.

The interface is not the wallet core. Keys, policy, transaction truth, persistence, and broadcast stay behind a typed native boundary.

Test-network implementationMainnet disabledExternal review pending

Trust map

Public interface. Native authority.

Svelte displays public wallet data and collects intent. A typed Tauri boundary carries that intent into Rust, where BDK, Miniscript, SQLite, Bitcoin Core RPC, and HWI sit behind narrow adapters.

  1. PublicSvelteKit interfacePresentation and intent
  2. TypedWalletPort + Tauri IPCExplicit operations and stable errors
  3. TrustedRust wallet coreKeys, descriptors, PSBTs, persistence
  4. ExternalCore + hardware signersAdversarial data, verified identities

Controls

Mechanisms, not reassurance.

01

Secrets stay native.

The webview never receives a generated mnemonic, seed, private descriptor, extended private key, or decrypted signing material. Rust creates software-wallet entropy with the operating system CSPRNG and presents recovery words through a native sheet.

02

Storage needs two keys.

The mnemonic is held in an authenticated encrypted envelope. Opening it requires both the key derived from the wallet credential and a device-bound wrapping key; copying the wallet directory is not enough.

03

The PSBT is the record.

Review data comes from the persisted unsigned transaction. Rust checks inputs, fees, recipient, change, wallet ownership, and proposal identity again before signing, merging, finalizing, or broadcasting.

04

Hardware identity is checked.

USB operations reopen the exact signer by its validated fingerprint. Imported signatures must add valid policy signatures to the same transaction; changed or unrelated PSBTs fail closed.

05

Your node defines the network edge.

Wallet balances and transaction history come from the Bitcoin Core node selected for that wallet. Remote Core requires HTTPS, or an onion service through an explicit loopback Tor proxy. There is no silent public fallback.

Current limits

What is not proven yet.

  • Physical hardware and camera certification is incomplete.
  • Android and Windows secure-storage certification remains open.
  • Remote TLS and Tor deployments still require real-environment evidence.
  • The desktop package is not yet reproducibility-certified, signed, or notarized.
  • Mainnet remains compile-time disabled pending independent review and the complete release checklist.
Find the canonical security model →