Improving the felling of security through a series of new features and options.

New features

• #52
• #75

We could config alephium.api.api-key to make the endpoint access limited. @tdroxler is guy to go if you need more details.

The mainnet launch is DONE and we've successfully delivered all needed features.
Now is the time for some UX polish ✨

We're focusing on removing little inconsistencies, clearing confusions and giving a bit more control through advanced features.

New features

• #57
• #19
• #23
• #87
• #50
• #35

Bugs

• #53
• #54
• #48

Do we need to be concerned about the full node running this logger? It seems to be a hot topic these days.

There have been many breaking changes between v5 and v6. Here's a guide explaining the upgrade procedure: https://reactrouter.com/docs/en/v6/upgrading/v5

We could display information about part of the balance that is locked.
Need some work on the backend @tdroxler
To be refined.

We need to support displaying tokens (name, amount) in our main wallet, and allow for sending them around.

Features

• https://github.com/alephium/alephium-js/issues/10

TBD

Either wrap all set of inputs in a <form/> tag, or listen for the keyboard event.

The QR code needs a white border in order for QR readers to pick it up correctly when using the dark theme.

If the user wants to make a large tx using many UTXOs, the tx cannot be built due the limits on tx inputs and gas. We'd suggest users to merge the existing UTXO with sweep-address endpiont.

When clicking the web extension toolbar icon it shows the wallet as a popup. Problem is that this popup is modal, so you can’t do anything else on the computer while the wallet is open; doing so will close the popup. It would be nice if there was a button to open the wallet as a browser tab.

Using alephium-wallet 0.10.2 in Firefox.

@polarker forwarded on Slack this request from a user who performs many transactions and the current (3min) lock time is to short for him resulting in frequent wallet locks.

Auto config for running the stack locally.

When used in public, some users may like to hide amounts for privacy reason.

A discreet mode toggle situated in the top toolbar could automatically obfuscate all amounts (which could be replaced by stars "*") for instance.

src/pages/Wallet/WalletHomePage.tsx

• Correctly fetches and displays latest balance and number of transactions on initial load
• Correctly fetches and displays latest transactions on initial load
• Snackbar is displayed when there is an error fetching initial data
• Correctly updates balance and number of transactions when refresh button is pressed
• Correctly fetches and displays latest transactions when refresh button is pressed
• Snackbar is displayed when there is an error refreshing data
• If there are pending transactions, ensure that it keeps fetching data every 2 seconds until no more pending transactions exist
• The settings modal opens when clicking the settings button
• The spinner is displayed while refreshing data
• Clicking the "Show address" action button opens the correct modal
• Clicking the "Send token" action button opens the correct modal
• Clicking the "Lock account" action button locks the wallet
• Correct footer message is displayed based on the number of transactions
• "Load more" button fetches and displays the next page of transactions

Creating transaction

• Displays a pending transaction in the list of transactions when a new one is created
• Displays an error message if the address validation failed
• Disables the submit button if there is no address
• Disables the submit button if there is no amount
• Disables the submit button if there is an error
• Converts the amount into a qALPH string

Switching network settings

• Transaction list gets updated when switching networks
• Balance gets updated when switching networks
• Number of transactions is updated when switching networks

Address page

• Button to copy the address correctly copies the address and displays a success message
• Clicking "Show in explorer" opens the correct link in the browser

Time to refine the extension after the release of the desktop ones.

We need to allow using our browser extension to interact with dApps.
We should follow Web 3.0 standards, and take Metamask as our main source of inspiration.

• Metamask repo https://github.com/MetaMask/metamask-extension
• Web 3.0 libraries: https://github.com/ChainSafe/web3.js

Subtasks

Design and planning

• Investigate what are Metamasks' main dApp methods
• Design the main user flows

I had alephium wallet running in the background and didn't realize it. launched alephium wallet again and it gave me the option to import/start new wallet.. might be confusing to some. (I almost re-imported my keys before realizing I had it running backgrounded in a different window).

It's basically launching a second instance instead of focusing on the already launched instance.

See discussion in #78 (comment)

Previous pending TX are still displayed if the user switch from one network to another.
Either find a better way to fetch pending queries (best option, check with @tdroxler) or store pending TXs per network config.

It would be great if a checksum file could be provided alongside the binaries of releases to check the integrity of the files.

Ideally if the binaries could be signed as well, it would be awesome!

The help menu is empty 😞 (see screenshot below)
It would be nice to have:

1. The wallet version
2. A "Report a bug" link which points to a new issue on this repo (i.e. https://github.com/alephium/alephium-wallet/issues/new) to let users easily provide feedback
3. Optionally a help/support link which points either to some documentation or to the discord chat

Also the "File" and especially the "Window" menus feel a bit useless and could be hidden.

Note: This is inspired by the MyCrypto desktop wallet help menu

@polarker could you please provide some more info? Don't worry though, I'll have a look and figure it out on Swagger next week.

https://github.com/alephium/alephium-js/blob/master/lib/wallet.ts

Users need to be able to derive multiple addresses, for multiple groups.
This will be especially useful when interacting with dApps.

Here are the 3 scenarios we foresee for address derivation:

• Derive address in random group (by default)
• Derive address in defined group
• Derive one address per group (mining purposes)
  Derive address for defined path

Design

• Create mockups (goal is to keep friction low, by hiding advanced features)

Other tasks

• #139
• #137
• #138
• #147

This would make the process easier, while still forcing users to check the words properly.

Steps to reproduce:

1. Start local services (node, miner, explorer-backend)
2. Run the wallet app and set the network settings to "Localhost"
3. Quit the app and all local services
4. Restart the app

Error:

api-alephium.js:106 GET http://localhost:12973/infos/self-clique net::ERR_CONNECTION_REFUSED
HttpClient.customFetch @ api-alephium.js:106

api-alephium.js:106  Uncaught (in promise) TypeError: Failed to fetch
    at CliqueClient.HttpClient.customFetch

The explorer has a pretty dark theme. It would be nice if the wallet had a similar theme.

Gas could be an advanced setting configurable in the "send transaction" modal.

This need to be designed, and validated with the backend team.

In order to secure a bit more the mnemonic, we can already do it in the backend https://github.com/alephium/alephium/blob/975b343312a0513d3023399d4761f7ba0fb11fb5/wallet/src/main/scala/org/alephium/wallet/api/model/WalletCreation.scala#L26 basically this passphrase change the seed for a given mnemonic. So if someone steal the 24 words, he would still need to know that passphrase.

Current version forces user to install Rosetta.
Let's build mac binaries with both x86 and arm64 version packaged.

A friend of mine reported this issue to me. As seen in the screenshot, all other apps headers are in dark mode, but our wallet still has a bright header.

We could check the timestamp when there's no inputs and mark something else or maybe check height == 0.

The main goal of this task is to open up the wallet to dApps interaction, the first of which being our voting demo app (PoC), followed by the future swap service.

The main "basic" feature needed is a signer: a way to validate and sign smart contract transactions.

In order to do that, we first wanted to "duplicate" the desktop wallet into a new browser extension, but other solutions exist and need to be discussed. Ideally, we would like to make our Desktop Wallet the go-to solution in order to keep our ecosystem accessible.

Let's use this issue to talk about the different approaches we can follow and their respective pros and cons.

cc/ @nop33 @lf94

Implement a section in the settings modal, where all the accounts are visible in a list, and where it's possible to delete one by one without requiring the password.

In the Electron app, when clicking a transaction, or when clicking “Show address → Show in explorer”, the explorer is opened in a separate Electron window. It would be nice to have an option to open it in the user’s web browser instead.

Should we inverse creating the account (name, password) and importing the mnemonic?
If yes, we would need to refactor the way we create the wallet and store the encrypted data.

Trying to build the extension with npm run-script extension-pack fails for me with: sh: line 1: zip: command not found.

$ npm run-script extension-pack

> [email protected] extension-pack
> rm alephium-wallet.zip; npm run-script extension-build && cd build && zip -r ../alephium-wallet.zip *


> [email protected] extension-build
> rm -rf build; INLINE_RUNTIME_CHUNK=false npm run-script build;  cp public/background.js public/manifest.json build


> [email protected] build
> cross-env REACT_APP_VERSION=$npm_package_version INLINE_RUNTIME_CHUNK=false react-scripts build

Creating an optimized production build...
Compiled successfully.

File sizes after gzip:

  781.44 KB  build/static/js/2.dc6bb90c.chunk.js
  173.42 KB  build/static/js/main.84b8e747.chunk.js
  2.6 KB     build/static/css/2.05131dc2.chunk.css
  782 B      build/static/js/runtime-main.8cf0c569.js
  440 B      build/static/css/main.72438ba0.chunk.css

The project was built assuming it is hosted at ./.
You can control this with the homepage field in your package.json.

The build folder is ready to be deployed.

Find out more about deployment here:

  https://cra.link/deployment

sh: line 1: zip: command not found

Looking at the npm run script:

rm alephium-wallet.zip; npm run-script extension-build && cd build && zip -r ../alephium-wallet.zip *

I think this is due to zip missing on my system.

I'd suggest switching from zip which can be missing on many systems, esp. Linux which uses tar/bsdtar by default to web-ext which is designed to build extensions.

Hopefully it is as straightforward as changing the above script to:

npm run-script extension-build && web-ext build --source-dir=build --artifacts-dir=. --filename=alephium-wallet.zip --overwrite-dest

and adding web-ext to devDependencies 😉

Let me know if you want a PR for it.

Confusion arise when importing 24 secret words after password loss.

When the user is locked out of their account due to missing password, recovering from the 24 secret words is rejected if the account name entered already exists.

Error message is username already taken which is slightly confusing since we call it Account Name in GUI