Hello Secret Community!
StarShell, a new wallet that has been developed specifically for Secret, is now available for Brave and Chrome, with a Firefox version to follow very soon!
In this post, we’re going to take a closer look at some of the features currently available in StarShell, and how users might leverage them to transact quicker, trace the flow of information, enhance their privacy, and improve their overall experience on the network. The StarShell team has stated that this is only the beginning, and that users should expect many new features to be added over time!
Introduction
StarShellFirst and foremost, StarShell is a privacy-oriented wallet designed to improve the user experience on Secret Network. It has been engineered from the ground up to maximize the security of user funds and the privacy of user data. Let’s start with the novel privacy and security features StarShell introduces, most of which do not exist in any other Cosmos wallet.
Privacy
Provided to all chains
- No telemetry whatsoever (i.e., no usage data collected)
- Covert discovery prevents sites from extension sniffing
- Fine-grained permission controls by app
- Private memos allows sending coins with encrypted messages
- Ability to change node providers or add custom ones
Additional privacy on Secret Network
- Automatic message padding on all transactions
- Explicit approval required when exporting viewing keys to apps
- Native UI to rotate viewing keys and revoke query permits
- Gas padding hides gas spent during simulation
Security
- All wallet data stored locally and encrypted at rest
- All private key material securely deallocated immediately after use (mitigates cold-boot attacks)
- All sensitive data (mnemonics, keys, passwords, viewing keys, query permits) encrypted in memory, with minimal “hot” lifetimes
- All soft-wallet crypto operations done in constant-time and constant-memory using libsecp256k1 in WASM (greatly reducing exposure to side-channel attacks)
- Security alert channel allows core team to issue global policy updates in order to immediately block sites/functionality or issue warnings on all wallets in response to vulnerability event
- Custom “deep seal” algorithm significantly reduces exposure to supply chains attacks
- Anti-spoofing aura art prevents imposter malware from tricking users
- TLS enforced for all network communications
- Fully source-available with an upcoming security audit
For those interested, you can find even more technical details about some of the above privacy and security features in StarShell’s Technology Profile PDF.
Features
Before we get into the features, let’s take a quick look at the UI. The home screen has that familiar wallet layout, showing total balance, quick actions, account address, a list of tokens/assets, and a bottom nav bar. The StarShell logo in the top left has a network indicator LED and opens a side menu with more info about network status. In the opposite corner, the hamburger menu in the bottom right opens a different side menu for extended nav and other actions.
dApps
StarShell is compatible with existing web dApps that support Keplr, although the Keplr API prevents StarShell from employing certain privacy measures on apps. The StarShell team is currently working on a set of open protocols to improve this limitation, giving dApps access to more features, while also giving users more control over their private data. In this release however, those controls are limited by Keplr’s API.
Part of that open protocol initiative includes the WHIP-002 and WHIP-003 drafts, which allow for custom profiles, meaning the wallet can render apps and contracts in a beautiful, human-readable format, rather than just a strings of code. For example, prisnr.games is a testnet dApp game that provides images and metadata about its own contracts. The results are shown below. We’re hopeful that more dApps will adopt this practice as it increases transparency and enhances the user experience.
As a final mention, all actions performed by apps are tracked, meaning that you can trace the origin of every transaction, contract, query permit, and so on.
History
Non-custodial wallets are personal databases. Over time, they accumulate tons of data about your interactions on and off the blockchain. Making all of this data accessible in a quick and easy manner has always been a top priority in StarShell’s design.
In its most basic form, the history tab shows a descending chronological list of incidents, but it is more than just transactions. Anything the wallet considers noteworthy gets logged, such as user edits to resources, app connections, permission changes, offline signatures, and so on.
As for transactions, they are shown in extensive detail, especially when smart contracts are involved. In addition to being able to view the contents of each execution, StarShell recognizes calls to Secret SNIP-20 tokens and renders its data intelligently.
However, scrolling through a list of events to find specific items from your history is not very efficient. That’s where contextual history comes in handy, listed below the details section of every individual resource. For example, from the Agents tab, you can open an individual’s contact info to see the history of incidents involving them.
Search
Going beyond simple point-and-click is the powerful search bar which pulls data from contacts, chains, tokens, accounts, apps, contracts, providers, signed documents, wallet actions, tags, and more… basically everything in your wallet can be accessed with a few keystrokes, literally. You can initiate a search by hitting the “/” forward slash key, typing your query, and then using arrow keys and space bar to iterate and open the results. You can also point-and-click your way around search if you prefer 😛
Notifications
StarShell extends rich transaction summaries to notification messages as well. A persistent background service subscribes to Tendermint websockets, listening for all chain events that affect your account including staking and governance. Clicking on a notification opens a window with a detailed view of the incident.
Transacting
As previously mentioned, you can attach private memos when sending coins directly, a feature that is compatible with all Cosmos blockchains. StarShell also simulates the transaction before sending it, allowing you to see if a transaction will fail before spending gas. The simulation can also be used to optimize gas spent on the transaction.
Secret Tokens
This part speaks for itself: native SNIP-20 support. Add tokens, rotate viewing keys, create query permits, etc.
Sometimes we forget or don’t even realize that apps (and maybe whoever is behind them) have access to view our token balance and transfer history. Thankfully, StarShell tracks all of this information and allows users to cut off access to viewing keys and query permits when they are no longer needed.
What’s Next?
This is just the beginning for StarShell! If you’d like to stay informed about the development of the project, you can follow them on Twitter and join their Discord. On Discord, you can get involved by becoming a beta tester, just look for the channel named “beta-testing”.
If this blog inspired you to get more involved with Secret Network, you can join our community of privacy pioneers! If you’re a dev interested in building your own Secret Apps, check out our developer resources and learn how you can get funding to support your projects:
If you’re passionate about ensuring Web3 users have the data privacy protections they need and deserve, you can also become a Secret Agent! Our mission is to ensure the decentralized web we’re building genuinely empowers – and is accessible to all. From awareness and education to international growth and university relations, there are many ways to help contribute to the expansion of the Secret ecosystem and the global availability of privacy technologies in Web3.
Onwards and upwards!
