emeraldpay/emerald-vault

Secure account management for Ethereum blockchains

emerald-vault's Issues

Rust-web3?

Hey, just found this project. It looks pretty similar in goals to https://github.com/tomusdrw/rust-web3.
Maybe we could join efforts on that?

Support any URL for RPC

Currently you have to set host and port, which may not work for public RPC endpoints (for example Gastracker). We need to support plain URL

For example https://api.gastracker.io/web3 (also notice that it's under https)

Doesn't work w/o node installed

Should automatically download and install latest parity/geth node for current OS into a private directory (under emerald), then run it.

List of nodes to download can be provided as a config file, like:

version: 1 #config format version
nodes:
  - type: geth
    version: 3.3.0
    binaries:
      - os: win
        url: https://site/geth-classic-win-3.3.0.zip # bittorrent and ipfs later
        signature:
          - type: sha256
            value: "28ecb202183e49f2092e675b699f5805c7d968c6c23c480f10f0d4cb20167c34"
      - os: darwin
        url: https://site/geth-classic-darwin-3.3.0.zip
        signature:
          - type: sha256
            value: "a8f833d03b5c0c1a198ebabf65645031746c2917e8dc3782f6211001fc0f1720"

for now just check hash of zip file, later we'll need to add validation against pgp signature

signTransaction doesn't work

For standard call:

{"jsonrpc":"2.0",
 "method":"emerald_signTransaction",
 "params":[
	{"from":"0xb485aa7a24264bd5172792e997cdaf7cbc55f58f",
	 "to":"0x2c22ac70c91879211192e1109be56ded4562c756",
	 "gas":"0x5208",
	 "gasPrice":"0x04a817c800",
	 "value":"0x016345785d8a0000",
	 "passphrase":"12345678"
	}
 ],
 "id":11}

I got:

{
	"jsonrpc": "2.0",
	"error": {
		"code": -32602,
		"message": "Invalid params: data did not match any variant of untagged enum Either."
	},
	"id": 11
}

If I add nonce (which I don't have currently):

{"jsonrpc":"2.0",
 "method":"emerald_signTransaction",
 "params":[
	{"from":"0xb485aa7a24264bd5172792e997cdaf7cbc55f58f",
	 "to":"0x2c22ac70c91879211192e1109be56ded4562c756",
	 "gas":"0x5208",
	 "gasPrice":"0x04a817c800",
	 "value":"0x016345785d8a0000",
	 "nonce": "0x100",
	 "passphrase":"12345678"
	}
 ],
 "id":11}

the response is (nothing in logs):

{
	"jsonrpc": "2.0",
	"error": {
		"code": -32603,
		"message": "Internal error"
	},
	"id": 11
}

Wallet should be able to load pending transactions

The wallet should be able to make a call to get transactions that have not been mined yet.

One way to do this is eth_pendingTransactions, which returns transactions from the local node. It is not part of the official RPC spec but I believe geth supports it (not sure about parity).

The other way is eth_getBlock('pending') but that only includes pending transactions that the local node is mining. If there are a lot of transactions in the queue, then this will not return everything.

Related: emeraldpay/emerald-wallet#116

Requires existing node

Connector should be able to launch a node (parity/geth) in a separate process. Path to the node executable should be passed in parameters or read from config.

Connector should pass options:

• rpc port and other configuration
• chain (testnet/mainnet/etc)

Lack of initial CLI implementation

Should support RPC endpoint continuous and the special script mode for qualified users with the extended functionality.

It is also necessary to provide a standard way of distribution through cargo - cargo install emerald.

Drop rustc-serialize dependency

It has been deprecated: announcement.

Is there any functionality you would require from Serde or another library before this would be possible?

problem: executing emerald-rs throws a "cannot bind to socket error"

Step to reproduce

1. cd ~/.cargo/bin
2. ./parity --chain dev --no-discovery --no-ui --no-ipc --no-dapps --rpccorsdomain "*" --jsonrpc-apis "web3,eth,net,personal,parity,parity_set,traces,rpc,parity_accounts"
3. ./emerald-cli

Expected behaviour

emerald-rs should execute without error

Actual behaivour

$  ~/.cargo/bin/emerald-cli 
thread '<unnamed>' panicked at 'Cannot bind to socket.: Error { repr: Os { code: 98, message: "Address already in use" } }', src/libcore/result.rs:837
stack backtrace:
   1:     0x55a00b04d0ba - std::sys::imp::backtrace::tracing::imp::write::ha21b0bc6fe1c6db2
   2:     0x55a00b04fddf - std::panicking::default_hook::{{closure}}::h9e3ab7c535ab99bb
   3:     0x55a00b04fab5 - std::panicking::default_hook::h8fcd4ede58ab2538
   4:     0x55a00b050277 - std::panicking::rust_panic_with_hook::he3e7d4fe905c61c0
   5:     0x55a00b050104 - std::panicking::begin_panic::ha3d6117597a7c9fd
   6:     0x55a00b050029 - std::panicking::begin_panic_fmt::hf9da00dc881251f3
   7:     0x55a00b04ffb7 - rust_begin_unwind
   8:     0x55a00b092d9d - core::panicking::panic_fmt::hfe9893b7b5c72fdb
   9:     0x55a00af803e0 - core::result::unwrap_failed::h145a54c9ba50c9aa
  10:     0x55a00af8cb34 - <jsonrpc_minihttp_server::ServerBuilder<M, S>>::start_http::{{closure}}::h1c64e6e592b63fe0
  11:     0x55a00af7b0e7 - std::panicking::try::do_call::h1e277e96adf245d0
  12:     0x55a00b0585f7 - __rust_maybe_catch_panic
  13:     0x55a00af85e84 - <F as alloc::boxed::FnBox<A>>::call_box::hb65e6a6ad669c014
  14:     0x55a00b052733 - std::sys::imp::thread::Thread::new::thread_start::h086b65e96d556e75
  15:     0x7f5427e181f3 - start_thread
  16:     0x7f542794512e - __GI___clone
  17:                0x0 - <unknown>
thread 'main' panicked at 'Unable to start RPC server: IoError(Error { repr: Custom(Custom { kind: Interrupted, error: StringError("") }) })', src/libcore/result.rs:837
stack backtrace:
   1:     0x55a00b04d0ba - std::sys::imp::backtrace::tracing::imp::write::ha21b0bc6fe1c6db2
   2:     0x55a00b04fddf - std::panicking::default_hook::{{closure}}::h9e3ab7c535ab99bb
   3:     0x55a00b04fab5 - std::panicking::default_hook::h8fcd4ede58ab2538
   4:     0x55a00b050277 - std::panicking::rust_panic_with_hook::he3e7d4fe905c61c0
   5:     0x55a00b050104 - std::panicking::begin_panic::ha3d6117597a7c9fd
   6:     0x55a00b050029 - std::panicking::begin_panic_fmt::hf9da00dc881251f3
   7:     0x55a00b04ffb7 - rust_begin_unwind
   8:     0x55a00b092d9d - core::panicking::panic_fmt::hfe9893b7b5c72fdb
   9:     0x55a00af80c6b - core::result::unwrap_failed::hdd37cf857fe541ac
  10:     0x55a00af99dbc - emerald_cli::start::h06ea2b352bb69f08
  11:     0x55a00af97976 - emerald_cli::main::h7bb1557bede898fe
  12:     0x55a00b0585f7 - __rust_maybe_catch_panic
  13:     0x55a00b052a2d - std::rt::lang_start::hc9ebe7230cf52cfd
  14:     0x7f542787d2df - __libc_start_main
  15:     0x55a00af6ad49 - _start
                        at ../sysdeps/x86_64/start.S:120
  16:                0x0 - <unknown>

User can't install custom contract

Introduce a new endpoint to add/remove/read list of installed contracts.

For each contract provide:

• name
• address
• type (custom,erc20,etc)
• abi

Can be easily kept in a special directory ("contracts") as plain json (where abi is a value of a filed)

methods:

• emerald_addContract
• emerald_dropContract
• emerald_listContracts

Lack of crate documentation

Shoud be published on https://doc.rust-lang.org/emerald-rs/.

Client should be able to load account transactions

Client wallet needs to load transactions by account. There are a few ways to do it:

• eth_filter: filter transactions by block. this is slow, and does not catch internal transactions
• trace_filter: also slow, but it gets internal transactions. Also, this is currently only implemented in parity
• Store transactions locally

Which option?

User unable to generate a new wallet

User can generate a new keystore file with given passphrase in format UTC-<timestamp>Z-<uuid>. By default Address should be hidden, but user can show it with option X-WithAddress.

installing parity as per docs

• step to replicate

1. git clone https://github.com/ethcore/parity
2. cd parity
3. cargo install parity

• expected behaviour

1. parity installs

• actual behaviour

1. $ cargo install parity
   Updating registry https://github.com/rust-lang/crates.io-index
   error: could not find parity in registry https://github.com/rust-lang/crates.io-index

emerald-cli: verbose (-v) is not verbose

⟠ ./emerald-cli --client-port 8545 -v
\INFO:emerald_cli: Starting Emerald Connector - v0.0.1
INFO:emerald_cli: security level set to 'normal'
INFO:emerald::rpc: Connector started on http://127.0.0.1:1920
INFO:reqwest::client: Request: Post http://127.0.0.1:8545/
INFO:reqwest::response: Response: '200 OK' for http://127.0.0.1:8545/

also tried -vv and --verbose

`rust-scrypt` doesn't build on windows platform

   Compiling rust-scrypt v0.1.0
error: failed to run custom build command for `rust-scrypt v0.1.0`
process didn't exit successfully: `D:\Projects\emerald-rs\target\debug\build\rust-scrypt-45941c6cb1aa0cea\build-script-build` (exit code: 101)
--- stdout
TARGET = Some("x86_64-pc-windows-msvc")
OPT_LEVEL = Some("0")
TARGET = Some("x86_64-pc-windows-msvc")
HOST = Some("x86_64-pc-windows-msvc")
TARGET = Some("x86_64-pc-windows-msvc")
TARGET = Some("x86_64-pc-windows-msvc")
HOST = Some("x86_64-pc-windows-msvc")
CC_x86_64-pc-windows-msvc = None
CC_x86_64_pc_windows_msvc = None
HOST_CC = None
CC = None
TARGET = Some("x86_64-pc-windows-msvc")
HOST = Some("x86_64-pc-windows-msvc")
CFLAGS_x86_64-pc-windows-msvc = None
CFLAGS_x86_64_pc_windows_msvc = None
HOST_CFLAGS = None
CFLAGS = None
PROFILE = Some("debug")
running: "C:\\Program Files (x86)\\Microsoft Visual Studio 14.0\\VC\\bin\\amd64\\cl.exe" "/nologo" "/MD" "/Z7" "/I" "ext/scrypt" "-std=c99" "/FoD:\\Projects\\emerald-rs\\target\\debug\\build\\rust-scrypt-6c28571120bb6ed0\\out\\ext/scrypt\\crypto_scrypt.o" "/c" "ext/scrypt/crypto_scrypt.c"
cargo:warning=cl : Command line warning D9002 : ignoring unknown option '-std=c99'
crypto_scrypt.c
ext/scrypt/crypto_scrypt.c(33): fatal error C1083: Cannot open include file: 'sys/mman.h': No such file or directory
exit code: 2

Lack of support for hardware keys (trezor/ledger)

Lack of JSON RPC API documentation

Add as markdown document in docs folder.

Standardize trace_call output between geth and parity

Currently the different result formats are handled by the front end. I am not sure if the connector should standardize the results, or if geth classic should change its output. geth classic has much simpler output.

Difficult to try the alpha version of emerald wallet

While emerald-wallet is not distributed in the form of an Electron desktop application we should pack all components into Docker image and create a Vagrantfile with docker provisionning on top of it.

Insufficient logs coverage

-v (info), -vv (debug), -vvv (trace), related to #110.

Insert `nonce` value inside `send_Transacrion` rpc call

Connector should insert nonce value for user when processing send_Transaction

Account list corrupted

Return value format for eth_accounts has changed.
Need to add name field.

Related to https://github.com/ethereumproject/emerald-wallet/issues/93

Connector handles only one request at a time

For example, when connector tries to extract private key other requests stay in query.

Code coverage checking isn't configurated

sendTransaction: invalid input length

TRACE:jsonrpc_core::io: Request: {"jsonrpc":"2.0","method":"eth_sendTransaction","params":[{"from":"0x7e1f623b262ff422427afc49cb4685534da91a08","password":"foo","to":"0x8f6be4eea14d192c7dc575ddf8e8ccc6b4434989","gas":"0x5208","gasPrice":"0x04a817c800","value":"0x9bd30122940485260eeee00000"}],"id":13}.
INFO:reqwest::client: Request: Post http://127.0.0.1:8545/
INFO:reqwest::response: Response: '200 OK' for http://127.0.0.1:8545/
DEBUG:jsonrpc_core::io: Response: Some("{\"jsonrpc\":\"2.0\",\"error\":{\"code\":-32602,\"message\":\"Invalid data format: Invalid input length\"},\"id\":13}").

Compile on Ubuntu 16.10 needs additional dependencies

To compile project on Ubuntu 16.10 you must install libssl-dev package. This is not obvious solution so that you can update README or wiki

Lack of hide/unhide functionality for accounts

Right now, emerald can only list all accounts in the keystore folder.

emerald_newAccount doesn't work

$ curl 'http://localhost:1920/' -H 'content-type: application/json' --data-binary '{"jsonrpc":"2.0","method":"emerald_newAccount","params":[{"name":"test","description":"test","passphrase":"12345678"}],"id":64}'

> {"jsonrpc":"2.0","error":{"code":-32602,"message":"Invalid params: data did not match any variant of untagged enum NewAccountParams."},"id":64}

Need to allow additional X-Passphrase header

Currently, Request header field x-passphrase is not allowed by Access-Control-Allow-Headers

See emeraldpay/emerald-wallet#42

No support for keystore files (UTC / JSON) encrypted with a passphrase

The default base directory locations are platform specific:

Mac OS X: ~/Library/Emerald
Linux: ~/.emerald
Windows: %APPDATA%\.emerald

To configure the location of the main directory, the --base-path parameter can be specified (CLI).

Subtasks:

• Serialize UTC / JSON Web3 format
• Extract private key and address by passphrase
• Expand CLI options to customize base and keystore directories

Excessive complexity around jsonrpc async callbacks

You don't need to use Arc when you callbacks lifetime is constrained by method lifetime, much simple to use crossbeam's thread scopes.

emerald_listAccounts not found

$ curl 'http://localhost:1920/' -H 'content-type: application/json' --data-binary '{"jsonrpc":"2.0","method":"emerald_listAccounts","params":[],"id":1}'

> {"jsonrpc":"2.0","error":{"code":-32601,"message":"Method not found"},"id":1}

getBlockByNumber: method not found

TRACE:jsonrpc_core::io: Request: {"jsonrpc":"2.0","method":"eth_accounts","params":[],"id":1}.
DEBUG:jsonrpc_core::io: Response: Some("{\"jsonrpc\":\"2.0\",\"result\":[{\"address\":\"0x3b28674155651b23b205ba93da7c4299bc6a7ce6\",\"name\":\"TestAccount1\"},{\"address\":\"0x8f6be4eea14d192c7dc575ddf8e8ccc6b4434989\",\"name\":\"TestAccount2\"},{\"address\":\"0x7e1f623b262ff422427afc49cb4685534da91a08\",\"name\":\"Redteam\"}],\"id\":1}").
TRACE:jsonrpc_core::io: Request: {"jsonrpc":"2.0","method":"eth_getBlockByNumber","params":["pending",true],"id":7}.
DEBUG:jsonrpc_core::io: Response: Some("{\"jsonrpc\":\"2.0\",\"error\":{\"code\":-32601,\"message\":\"Method not found\"},\"id\":7}").
TRACE:jsonrpc_core::io: Request: {"jsonrpc":"2.0","method":"eth_getBalance","params":["0x3b28674155651b23b205ba93da7c4299bc6a7ce6","latest"],"id":9}.
INFO:reqwest::client: Request: Post http://127.0.0.1:8545/
INFO:reqwest::response: Response: '200 OK' for http://127.0.0.1:8545/
DEBUG:jsonrpc_core::io: Response: Some("{\"jsonrpc\":\"2.0\",\"result\":\"0x8ac7230489e80000\",\"id\":9}").
TRACE:jsonrpc_core::io: Request: {"jsonrpc":"2.0","method":"eth_getBalance","params":["0x8f6be4eea14d192c7dc575ddf8e8ccc6b4434989","latest"],"id":10}.
INFO:reqwest::client: Request: Post http://127.0.0.1:8545/
INFO:reqwest::response: Response: '200 OK' for http://127.0.0.1:8545/

Need to be able to run trace call

For the wallet to estimate gas needed for contract interactions, the connector needs an interface for trace_call

eg:
{"method": "trace_call", "params": [objCall, ["stateDiff", "trace", "vmTrace"]]}

Binary artifacts aren't published on bintray

Should be automated with the help of build integration process.

User unable to store addressbook

Address Book is accounts user uses for transactions or tracking, without providing private key.

Address Book has:

• address
• name

There should be methods to operate an address book:

• add
• remove
• update

Impossible to import `pbkdf2` based keystore files

Doesn't sign transaction

Sign transaction if password is passed with transaction json. if password is invalid, respond with 403 Forbidden

Another option would be passing password as http header ("X-Emerald-Password"?)

Returns only a list of accounts from chain client

We should return our own accounts instead!

Rust-crypto seems to be abandoned

https://github.com/DaGenix/rust-crypto seems to be abandoned, and have issues. We should consider alternatives:

• https://github.com/briansmith/ring
• https://github.com/libOctavo/octavo
• https://github.com/RustCrypto

Also https://github.com/kud1ing/awesome-rust#cryptography

Obsolete implementation of JSON-RPC Protocol

Should be align with the actual JSON RPC API version.

Beta release

• JSON-RPC API protocol (#105)
• JSON-RPC API implementation (#112)
• Hide/unhide accounts (#130)
• Replace rust-crypto (#87)
• Initial CLI impl. (#110)
• Publish binary artifacts on bintray (#137)
• Bump version to 0.9 (after all else)

User unable to switch to another chain

Connector should accept emerald wallet call to restart node with new command line options
See Also: emeraldpay/emerald-wallet#16

Impossible to change only port number (CLI)

Instead of a single parameter --address, use two--host and --port. Similarly for --client-address.

Takes a long time to generate a new account

appr. 30 sec - "kdfparams":{"dklen":32,"salt":"e776164f76eb823565518df0774088e4617eec11cfd6c2fa89c35ff1843c26b2","n":19201,"r":8,"p":1}

Probably we should introduce three level of security: normal (by default), high, ultra.

'should_sign_transaction' panicked at 'attempt to shift right with overflow'

Only for i686 on Windows.

failures:
---- core::transaction::tests::should_sign_transaction stdout ----
	thread 'core::transaction::tests::should_sign_transaction' panicked at 'attempt to shift right with overflow', src\util\rlp.rs:187

Account keystore file is created in wrong directory

On windows it was created on %USERDIR%\Application Data in root!

User unable to save account names

When creating an account or importing a wallet, the user has the option to enter an account name, since they may not be able to remember 0x35deeeeaambwmb or whatever.

Can the connector support this?

currently, interface looks like rpc("personal_newAccount", [password])

Scrypt impl. is very very slow

Appr. 100 times slower as Go!