This Week in Custody

This Week in Custody is a newsletter covering technical and narrative developments in digital asset custody written for wallet engineers, digital asset operators, and security engineers.

Quick Links

Networks & News

• Abra’s is now an approved RIA. This excellent podcast episode explains Abra’s separately managed account (SMA) model.

• Kraken launches a self-custodial mobile wallet. They published an overview of mobile wallet security challenges.

• Wasabi Wallet blocks US users.

• Samourai Wallet founders charged.

• LocalMonero shutting down.

• Coinbase adds support for Lightning Network.

• Lots of acquisitions:

  • Phantom buys Bitski.

  • Jupiter (Solana) buys Ultimate Wallet.

  • Safe buys Multis.

• Uniswap supports Robinhood Connect. Also, the number of Uniswap wallets double.

• FalconX launches Prime Connect - a DMA & custody solution.

• Ledger partners with MoonPay.

• Stripe enters crypto stablecoin business again.

• Worldcoin wallet has 10M users.

• Tholos launches an MPC wallet targeting the middle market.

Guides

• Overview of NEAR’s Chain Signatures (chain abstraction).

• Coinbase Venture covers the EigenLayer AVS ecosystem.

• Blog post on the business of tradfi wallets.

• Coinbase shares a Solidity style guide.

• Zellic publishes a primer and introductory posts on MPC wallets.

• Bastion writes about the costs of money transmitter licenses & compliance. They calculate that compliance adds an additional $0.10 per transaction as an on-going expense.

• Bitcoin multi-sig hardware performance report from Casa.

Tools & Software

• Sponsored transactions using advertisements on Sui.

• Runes launched on Bitcoin. Magic Eden adds support.

• MetaMask launches smart transactions to help reduce predatory MEV.

Security

• Build provenance for Homebrew.

• Chivo Wallet (El Salvador’s wallet) leaks PII. Also, source code is leaked.

• Timeline of the xz attack.

Thanks for reading!

This Week in Custody

This Week in Custody is a newsletter covering technical and narrative developments in digital asset custody written for wallet engineers, digital asset operators, and security engineers.

Quick Links

Networks & News

• NEAR launches the Chain Signatures protocol that allows an on-chain NEAR account to authorize transactions on other blockchains. The protocol uses Eigenlayer to bootstrap a threshold signing network to use MPC protocols to jointly compute signatures for other chains.

• The Dencun hard fork is successful on Ethereum. Several L2s have started to take advantage of the protocol changes to take advantage of substantially lower gas prices. Also see how various on-chain actions cost across L2s and mainnet. Since blobs are cheaper than calldata, users have started to launch inscriptions using blobs called blobscriptions.

• Vitalik writes about what comes after blobs on Ethereum.

• Kraken is launching a new custody service for institutional investors called Kraken Custody.

• Coinbase is using Base to store client and corporate USDC balances.

• AUM in tokenized government securities is now greater than $1B.

• BlackRock’s on-chain BUIDL fund launches.

• Solana continues to have its moment with several days of higher volume than Ethereum DEXs. Phantom reaches 4M MAU.

• OKX is suspending USDT trading pairs in Europe.

• Utila raises 11.5M.

• El Salvador’s government has its own cold storage wallet within its border.

• Revolut partners with MetaMask for Revolut Ramp.

• Robinhood Wallet adds Aribtrum for swaps. Their crypto wallet is now available on Android.

• Casa launches an inheritance product globally for BTC, ETH, and stablecoins.

• It’s really hard to keep up with every new Bitcoin L2, but thankfully there is new dashboard to help track development.

Guides

• Fireblocks research on transaction approval policies.

• Paradigm shared an excellent breakdown on Ethereum’s state growth.

• EIP-4844 explained by Finematics.

• Blobscan is an explorer for EIP-4844 blobs.

• Bitcoin Magazine post comparing Multisig, Shamir’s Secret Sharing, and MPC.

• Nice guide on how to build on-chain non-custodial asset management tools using Safe.

Tools & Software

• Coinbase launches Smart Wallet. Worth a try! It’s a smart contract wallet that uses PassKeys for authn.

• Coinbase open sources Microscope to help label blockchain addresses.

• Trail of Bits releases a tool called AttackNet that uses chaos testing to find bugs in blockchain nodes.

• Worldcoin open sources some of the Orb software.

Security

• In the last issue, we covered a malicious Exodus wallet appearing on the Canonical Snap store. The issue is not fully resolved as Canonical Snap continues to have a problem with malicious wallet programs.

• Remilia’s hot wallet and multi-signature treasury were drained.

Thanks for reading!

This Week in Custody

Back after a hiatus!

This Week in Custody is a newsletter covering technical and narrative developments in digital asset custody written for wallet engineers, digital asset operators, and security engineers.

---

After a long hiatus at publishing this newsletter, I’m going to re-engage with publishing more frequently. I coincidentally stopped publishing at the precipice of the FTX implosion. Be that as it may, there is so much to talk about each week following the tailwinds of the Bitcoin ETF.

So much has happened since so I’ll refrain from summarizing, but two trends caught my attention: embedded wallets and wallet-as-a-service.

Several brand name apps have successfully launched their own wallets over the past year including Uniswap and OpenSea. Friend.Tech’s launch in August gave a glimpse of a packaged consumer application using embedded wallets.

To support this growing trend, several wallet-as-a-service (WaaS) providers started to enter the marketplace. Notably, Coinbase is big market participant using MPC technology. Other providers have chosen to build WaaS using secure enclaves.

The institutional wallet product market is growing too with the introduction of Blockdaemon Wallet and Anchorage Porto.

Highly recommend reading the latest Coinbase Ventures’ State of Wallets report (Part 1, Part 2).

Quick Links

Networks & News

• Overview of Offline Payments for Lightning Network from Breeze.

• Magic Eden launches a multi-chain wallet supporting Solana, Bitcoin, and Ethereum.

• OKX’s wallet is doubling down on inscriptions and bitcoin. Meanwhile, Binance launched an inscriptions marketplace.

• MetaMask integrates with Robinhood Connect.

• Fordefi fundraise announcement.

• Alchemy launches Embedded Accounts.

• Uniswap launches a web extension.

• Worldcoin acquires Ottr wallet.

• MetaMask integrates Blockaid for security alerts. MetaMask has 30M MAUs in January 2024.

• OpenSea’s embedded wallet has over 100K users.

• Progressive web apps (PWAs) have become a popular technology for crypto apps to reach users. A few weeks ago, Apple confirmed it was breaking PWA functionality due to new EU regulation. Recently, Apple reversed its decision.

Guides

• Capsule has a blog post on integrating their MPC product with MetaMask Accounts Snaps. If you haven’t heard of MetaMask Snaps yet, it’s worth digging into.

• Coinbase on error handling in MPC.

• Onboarding to Bitcoin Core

• Fireblocks presents common exploits against MPC wallets at Black Hat.

• Former CTO of PayPal describes experience of Shamir Secret Sharing gone wrong.

• Custodia Bank’s whitepaper.

• Podcast on Fireblocks’ journey.

• CoinDesk covers the FTX sim swap hack that occurred during the collapse.

• Aptos plans to launch a phone.

• Blog post on risks of liquid restaking tokens (LRTs).

Tools & Software

• Couple of excellent Trail of Bits blogs:

  • a recap CCC in Germany

  • fuzzing the Cosmos SDK

  • breaking TSS

  • overview of AWS cloud cryptography

  • notes on AWS Nitro

• Solana launches Token Extensions.

• Lit v0 launches key management network.

• Block’s BitKey shares source code.

• ThirdWeb previews in-app purchases for web3 games using Apple pay.

• Trust Wallet launches SWIFT: an account abstraction wallet.

Security

• Wallet drainers are bypassing EIP-712 security alerts in certain wallets.

• NIST advisory on Trust Wallet.

• Fake Exodus wallet published on the Snap Store. ~9 BTC stolen.

• Practical Key-Extraction Attacks in Leading MPC wallets

• Older news, but worth a link: Fireblocks reveals Bitforge vulnerabilities in 15 MPC wallet providers.

Thanks for reading!

This Week in Custody #46

This Week in Custody is a newsletter covering technical and narrative developments in digital asset custody written for wallet engineers, digital asset operators, and security engineers.

---

Last Week’s Most Clicked

• a16z crypto’s primer on wallet security.

• Pine Street Labs fundraise and product announcements.

• Flashbots has a new MEV-boost Dashboard.

News

• Fidelity expected to support trading for Ethereum.

• BitGo launches its Developer Portal.

• BitGo launches a settlement network between exchanges.

• Aptos launches mainnet.

• MetaMask integrates with Sardine to enable a fiat on-ramp for US users.

• Elliptic says Chinese spies used Wasabi Wallet (coinjoin wallet) to pay Bitcoin bribes to a FBI agent.

Networks

• Cosmos launches “Game of Chains” program to build an incentivized testnet for interchain security.

• A Bitcoin transaction signed using FROST.

Guides

• Interesting talks from TabConf:

  • Moving Bitcoin Core off GitHub

  • P2P encryption for Bitcoin

  • Misconceptions about virtual bytes

• Block updates us on its Bitcoin hardware wallet design.

• SoK: Preventing Transaction Reordering Manipulations in Decentralized Finance

• Enter the Hydra: Towards Principled Bug Bounties and Exploit-Resistant Smart Contracts

• How-to: Make it Easy to Patch Crypto Networks reviews the deployments and release strategies for projects.

• Understanding “out-of-gas” denial with Gas Guage.

• Flood & Loot: A Systemic Attack On The Lightning Network

• A guide to Solana’s core concepts.

• What's the deal with zkapps?

Tools & Software

• CashApp launches deposits for its Lightning Network feature.

• BlockSec’s Phalcon tool gets a new update allowing users to simulate transactions at a specified block.

Cryptography

• KZG in Practice: Polynomial Commitment Schemes and Their Usage in Scaling Ethereum

Security

• Upcoming OpenSSL patch fixes a critical vulnerability.

• Analyzing the GitHub marketplace

• KataOS is a new operating system designed for securing embedded devices. It’s written mostly in Rust.

Thanks for reading! Have a great week.

This Week in Custody #45

This Week in Custody is a newsletter covering technical and narrative developments in digital asset custody written for wallet engineers, digital asset operators, and security engineers.

---

Last Week’s Most Clicked

• Telegram launches a P2P exchange with its @wallet bot.

• Flashbots has a new MEV-boost Dashboard.

• Tweet thread on threat models against MPC & TSS.

News

• Pine Street Labs fundraise and product announcements.

• BNY Mellon starts its crypto custody service.

• Copper raises a $196M Series C.

• Zerion raises a Series B for its wallet.

• River announces its River Lightning Service.

• Google Cloud partners with Coinbase.

Networks

• A bug in LND nodes on the Lightning Network caused block syncing to fail past a certain block. A transaction spending a 998-of-999 tapscript multisig output caused wire parsing to fail in btcd which is a dependency in lnd. An issue was raised and fixes to both btcd and lnd were merged. A hotfix was released with the v0.15.2-beta tag.

  “The issue here is that the old checks for the maximum witness size, circa segwit v0 where placed in the wire package as well as the tx engine. This check should only be in the engine, since it's properly gated by other related scrip validation flags.

  The fix itself is simple: limit witnesses only based on the maximum block size in bytes, or ~4MB.”

• A dashboard covering 18 months of IBC.

• Avalanche’s Banff update adds support for creating Proof of Stake subnets. There are also considerable changes to some transactions types.

• A large-scale exploit occurred on Binance Smart Chain’s bridge.

  • An IBC Security Advisory is communicated to Cosmos chains. A patch is circulating privately to chains while a public patch will be made available today with the release of the Cosmos-SDK v0.45.9 and v0.46.3.

    “A chain is safe from the critical vulnerability as soon as ⅓ of its voting power has applied the patch. Chains should still seek to patch to ⅔ as quickly as possible once the official patch is released.”

• Tweet thread on Account Abstraction. And blog post on the subject.

• This past week had a lot of high-profile exploits. Highly recommend subscribing to rekt.news for analysis:

  • TempleDAO

  • Mango Markets

  • Sovryn

• Bitcoin may get a new transaction version.

• Private Payments is now BIP-351.

• Bitcoin Inquisition is a Bitcoin client for testing soft-forks on signet.

• Gauntlet launches Aera.

• Coinbase is supporting EIP-4844 on Ethereum.

Guides

• Insights from a large Lightning Network node.

• Technical tour of NFTs.

• Validity Rollups on Bitcoin

• Lightning Network liquidity 101.

• Delphi Digital Labs publishes a paper titled SLAMM: A Unified Model for Cross-Chain Liquidity.

• History of the Cosmos network by Interchain.

• a16z crypto has a great primer on wallet security.

• TryBitcoin is an interactive tutorial for beginners who want to learn more about the technical side of Bitcoin.

• Porting the Solana eBPF JIT compiler to ARM64

Tools & Software

• Aztec releases Noir, a domain specific language for ZK-provable programs.

• The anticipated StratumV2 reference implementation is released! Twitter thread.

• Ethereum Transaction Viewer is a simple UI for tracing smart contract calls on Ethereum.

• delegate.cash is an on-chain registry that lets users specify delegates for cold wallet vaults.

• Blend: a p2p borrowing and lending protocol on LN.

Cryptography

• Thread on STARK math resources.

• On the Classic Protocol for MPC Schnorr Signatures

• To Fix or Not to Fix: A Critical Study of Crypto-misuses in the Wild

Security

• Improving the Secure Boot landscape: sbctl & go-uefi (video).

• There is no “software supply chain”

• BPF for HID drivers

  “Beyond tweaking data, BPF programs can do things like filtering out spurious button clicks. It will also be possible for BPF programs to communicate directly with devices.”

  I’m really interested to see how BPF can be applied to make retail hardware wallet usage less error-prone and secure.

• Guix for development.

• Hacking anything with GNU Guix.

Releases

• Avalanche v1.9.0

• Near v1.29.0

• Solana v1.13.3

• lnd v0.15.2-beta

• Cosmos SDK v0.45.9

Thanks for reading. Have a great weekend!