search

Chainboard-Academy / agoric-lecture-content

This repository contains the lecture content for Chainboard Academy Agoric Bootcamp
6 stars 6 forks source link

ag-solo problem is more backups than powerful objects (lectureNine) #4

Open dckc opened 1 year ago

dckc commented 1 year ago

The core issue that prompted development of the on-chain smart wallet was really backups:

The market norm is: if you have your 24 words, you can walk up to any computer and start doing business. But with ag-solo, you need the state of all your vats. If your machine crashes and you don't have a backup of your client-side wallet vat, poof! There went your assets. (well, not completely... recovering the vat state isn't as hard as cracking private keys, but it would involve a huge forensics effort.) So we moved the state of the wallet from the client machine on to the blockchain.

Aside: the initial prototype of the smart wallet was a nifty demonstration of the overall distributed object framework: We just changed where the wallet vat was deployed from the client side to on-chain, without changing the code inside the vat at all. I'm pretty sure @michaelfig did it, but I can't find it. Michael? Help?

So this point in the lecture doesn't seem like right thing to emphasize:

https://github.com/Chainboard-Academy/agoric-lecture-content/blob/2b33810aaa891a3d6d9352abc626ff01e9f44c36/lectureNine/lectureNine.md?plain=1#L68

It comes up at about 19:50 in the recording.

The overall security properties of ag-solo are pretty good. The home object only has capabilities that, in due course, we do want users to have.

There are some security issues that postponing ag-solo access allows us to postpone for the short/medium term:

But by mainnet 3, we do want E(home.zoe).install(...) and E(home.zoe).startInstance(...) (or something equivalent) to be permissionless.

cc @jeetraut @hielo777

michaelfig commented 1 year ago

Aside: the initial prototype of the smart wallet was a nifty demonstration of the overall distributed object framework: We just changed where the wallet vat was deployed from the client side to on-chain, without changing the code inside the vat at all.

A historical vat-walletManager.js is a good starting point for seeing how this was done. It's a bit indirect, but basically it created separate vats using a bundled version of what is now agoric-sdk/packages/wallet/api.