ChimpDAODocs
Home

DOCS / TRUST / SECURITY & KNOWN LIMITATIONS

Security & known limitations

Live on testnet

Security model

  • Keys only in chips: the chip holds its key and never reveals it.
  • PIN on cards that have one.
  • Every signature is bound to one exact call: contract, function, arguments (asset, amount, destination), network, nonce and expiration.
  • Before the card signs, the app checks that the call it is asked to sign is exactly the one shown on the review screen.
  • The app stores no secret: no private key, no fee key.
  • The app never says "Nothing was sent" unless it is certain.
  • Optional Face ID lock to open the app.

Who can do what

WHATWHO CAN ACT
A card's own wallet
WHO CAN ACTWhoever holds the card, and knows its PIN if it has one.
A Main account
WHO CAN ACTAny one of its cards, until that card is removed.
Card registration, registries and the factory
WHO CAN ACTChimpDAO's admin.
Card wallets' shared code version
WHO CAN ACTChimpDAO's admin, for every wallet that has opted in. A card opts in and out with its own signature; no wallet is in it by default.
The router
WHO CAN ACTNobody: no admin, no upgrade path, holds no funds.
Network fees
WHO CAN ACTChimpDAO pays them. The fee service cannot authorise a payment.
Recovery
WHO CAN ACTNobody. A lost card's wallet cannot be recovered, and neither can an account whose cards are all lost.

Known limitations

  • Testnet only. The wallet contracts are not deployed on mainnet yet.
  • Cards without a PIN work like cash: whoever finds one can spend what is on its own wallet.
  • A lost card's own wallet stays tied to that card.
  • A lost card stays a valid signer of its Main account until another card removes it. A card with a PIN locks itself after three wrong PINs; there is no central freeze, by design.
  • An account cannot remove its last card: add another card first.
  • Unlocking a locked card with its unlock code is not in the app yet (planned).
  • Activity history older than about 7 days is only available if the app saw it in time (public RPC limit).
  • Compatibility of external wallets and exchanges with contract addresses is still being verified.
  • Text memos are not supported.

Report a vulnerability

SECURITY

Report a suspected vulnerability privately by email, never in a public issue. Name the commit or the contract address it concerns. chimpdao@consulting-manao.com

Edit this page in the repositoryCHIMPDAO DOCS · TESTNET