search

stjet / banani

banano library for javascript/typescript
http://banani.prussia.dev/
MIT License
5 stars 1 forks source link

Why is a RPC node needed for constructing a new Wallet? #4

Open kopeboy opened 2 months ago

kopeboy commented 2 months ago

I can see from Wallet.ts:

constructor(rpc: RPCInterface, seed: string, index: number = 0, work_function?: WorkFunction) {

and

static gen_random_wallet(rpc: RPCInterface): Wallet {
    let random_bytes = new Uint8Array(32);
    crypto.getRandomValues(random_bytes);
    const random_seed = util.uint8array_to_hex(random_bytes);
    return new Wallet(rpc, random_seed);
  }

that you use an rpc, that incudes a URL, to generate a new wallet. Why? Wouldn't it be (& look/feel) safer to have network related tasks & fields separate from the seed & private keys?

stjet commented 2 months ago

Well, the private key / seed are never sent to the RPC, the library handles the signing on the device, so I don't see any safety improvements. You can just omit the parameter if you don't need to interact with a RPC, iirc it will not error in Javascript. In Typescript you can just make a dummy RPC with a random URL if you will not need to interact with a RPC.

The reason why a RPC is "required" to make a wallet is because wallets need to send, receive, change rep, etc. Those typically involve making RPC requests to for example get the current balance and frontier hash. And obviously, the signed transaction needs to be broadcast somewhere. I guess the rpc could be a required parameter for all the send, receive, account history, etc functions, but I don't really see the point. Could you elaborate on why you think it would be safer to not require a RPC to create a Wallet?

If your usecase does not involve network access (cold wallet signing...?), look in util.ts for block signing functions and whatnot, you probably don't want to use a Wallet.