The developer has created a non-custodial Monero web wallet that utilizes the official monero-wallet-rpc binary for cryptographic operations. The project, built with Node.js, TypeScript, React, and Vite, avoids custom cryptography to ensure security, relying instead on the official Monero toolkit for key management and signing.
Technical challenges addressed include implementing Digest authentication by pinning a single keep-alive connection to prevent RPC errors, and handling 64-bit integers to avoid precision loss during JSON serialization. The wallet uses a two-phase transaction process to display accurate fees before relaying, and it ensures proper wallet synchronization by setting the correct restore height.
Security measures include generating unique RPC credentials at each launch, restricting access to the loopback interface, and preventing the storage of wallet passwords in local files or logs. The backend also rejects non-loopback requests to mitigate risks from malicious browser tabs or DNS rebinding.
The project is currently unaudited and lacks support for hardware wallets like Ledger or Trezor. The developer emphasizes that the software is a hobby project and warns that official Monero binaries may trigger false-positive detections in antivirus software due to their internal structure.
