ChimpDAODocs
Home

DOCS / TRUST / SECURITY & KNOWN LIMITATIONS

Security & known limitations

Live on testnet

LAST UPDATED ·

Security model

  • Keys only in chips: the chip generates its key and never reveals it.
  • PIN on cards that have one.
  • Every signature is bound to one exact call: contract, function, arguments (asset, amount, destination), network, nonce and expiration.
  • Before the card signs, the app checks that the call it is asked to sign is exactly the one shown on the review screen.
  • The app stores no secret: no private key, no fee key.
  • The app never says "Nothing was sent" unless it is certain.
  • Optional Face ID lock to open the app (built, iPhone tests in progress).

Who can do what

WHATWHO CAN ACT
A card's own wallet
WHO CAN ACTWhoever holds the card, and knows its PIN if it has one.
A Main account
WHO CAN ACTAny one of its cards, until that card is removed.
Card registration, registries and the factory
WHO CAN ACTChimpDAO's admin.
Card wallets' shared code version
WHO CAN ACTChimpDAO's admin, for every wallet that follows it. A card can opt out with its own signature.
The router
WHO CAN ACTNobody: no admin, no upgrade path, holds no funds.
Network fees
WHO CAN ACTChimpDAO pays them. The fee service cannot authorise a payment.
Recovery
WHO CAN ACTNobody. A lost card's wallet cannot be recovered, and neither can an account whose cards are all lost.

Known limitations

  • Testnet only. The wallet contracts are not deployed on mainnet yet.
  • Cards without a PIN work like cash: whoever finds one can spend what is on its own wallet.
  • A lost card's own wallet stays tied to that card.
  • A lost card stays a valid signer of its Main account until another card removes it. There is no lock or freeze yet (planned).
  • An account cannot remove its last card: add another card first.
  • After three wrong PINs a card locks. Unlocking it with its unlock code is not in the app yet (planned).
  • Activity history older than about 7 days is only available if the app saw it in time (public RPC limit).
  • Compatibility of external wallets and exchanges with contract addresses is still being verified.
  • Text memos are not supported.
  • Cards without a PIN are not yet tested on a physical card.

Report a vulnerability

SECURITY

Report a suspected vulnerability privately, never in a public issue. Name the commit or the contract address it concerns. Private report on GitHub ↗

Edit this page in the repositoryCHIMPDAO DOCS · TESTNET