Plugging in additional wallets to the dApp

[liamzebedee]

Hardware wallets: Ledger, Trezor

Mobile wallets: WalletConnect

Are there common APIs? Do they line up with Metamask's, or will we need some custom wrappers?

Overview

Ledger and Trezor both use BIP32 Hierarchical Wallet Paths for BTC and ETH wallets. That means we do the enumerating of the BTC/ETH addresses for user selection. After that, we're only concerned with signing transactions. For Ethereum, that generally means we can use Web3.js, and insert a middleware called a Web3 subprovider that only answers to calls for signing transactions. For Bitcoin, we will need to ask for transactions to be signed, and there is a question of whether we can afford some UX advantages due to the need for P2SWKH tx's over normal ones.

Aside: Metamask. Last time I used Metamask with my Ledger, the experience was poor. Multiple repeating dialogs, general slowness. Nearly all DApps (Maker, Uniswap, etc) integrate "natively" with the hardware wallet API's, rather than letting Metamask handle it.

Ethereum

• Web3.js has the concept of Web3 subproviders, which respond to ETH RPC calls (eth_sign).
  • Simple to integrate
  • Works with existing code (although we still have to move from Truffle-Web3 to Web3.js)
• Ledger implements a web3-subprovider, which is a middleware over their own API.
  • Example
• Trezor has only unofficial implementations of a subprovider.
  • Subproviders aren't complex to build.
  • Makerdao's trezor subprovider would be a good one.
  • 0x trezor subprovider has also been around a while.
• WalletLink
  • Also based on Web3 subproviders.
• There's also a couple other libraries worth knowing about:
  • web3-react: integrates with Metamask, wallets, WalletConnect

Bitcoin

• ledgerjs hw-app-btc
  • Official Ledger API
  • Supports P2SH transactions and signing arbitrary payloads (eg. segwit tx's).
  • Only the P2SH API shows transaction amounts I believe, which may be a threat to UX.
• trezor connect
  • Official Trezor API
  • Supports non-SW and SW tx types, and signing arbitrary messages.

What do their failure scenarios look like? (e.g., if the device gets unplugged/plugged back in)

We can generally detect failures using events of connect/disconnect for each wallet.

• Ledger
  • We can detect disconnect of the USB and Bluetooth transports using transport.on('disconnect')
  • Reauthentication: authenticating the device is not a separate call.
• Trezor
  • We can detect connect/disconnect events from the Trezor (doc).
  • It's worth noting Trezor uses a separate iframe popup, which is a bit more fragile than just an API since the user can close it at will.
  • Reauthentication: device authentication is remembered by the iframe popup.
• WalletConnect
  • WalletConnect uses a bridge server to relay events from the mobile wallet
  • We can connect/disconnect events using the WalletConnect object.
  • Reauthentication: we must redisplay the QR code for pairing every time.

Progress

• [x] Ledger (#205)
• [x] Trezor (#206)
• [ ] WalletLink (#339)
• [ ] WalletConnect (#338)

[Shadowfiend]

web3-react

Well I'm instantly down for that.