-
Notifications
You must be signed in to change notification settings - Fork 30
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
ebaf6cc
commit 87fb9f6
Showing
40 changed files
with
1,078 additions
and
54 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
91 changes: 91 additions & 0 deletions
91
...saurus-plugin-content-docs/current/general/blockchain-security/backup-wallet.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| --- | ||
| displayed_sidebar: generalSidebar | ||
| sidebar_position: 2 | ||
| --- | ||
|
|
||
| # Security Advice for Wallet Backup | ||
|
|
||
| ## 1. Mnemonic Phrases/Private Keys Backup | ||
|
|
||
| ### Plaintext Mnemonic Phrases | ||
|
|
||
| Mnemonic phrases typically consist of 12 or 24 English words, following the BIP39 standard to ensure interoperability, for example: "witch collapse practice feed shame open despair creek road again ice least". | ||
|
|
||
| #### Security Recommendations: | ||
|
|
||
| - Consider using special "obfuscation modes", such as rearranging words alphabetically or reversing every other word | ||
| - Be cautious when replacing words; you can use synonyms or custom rules, but make sure you can remember them | ||
| - Example: Replace the 3rd, 7th, and 11th words with their antonyms | ||
|
|
||
| ### Mnemonic Phrases with Passphrase | ||
|
|
||
| Passphrase, sometimes referred to as the “25th word,” enhances security by adding an extra layer of protection to the seed generation process, making brute-force attacks significantly more challenging. It’s crucial to back up both the mnemonic phrase and the passphrase securely. | ||
|
|
||
| #### Security Recommendations: | ||
|
|
||
| - Choose a strong password, avoiding birthdays, common words, etc. | ||
| - Consider using a password manager to generate and store the password | ||
| - Example: Use [1Password](https://1password.com/) to generate a strong password like `"X2$9Pz#mK@Lq"` | ||
|
|
||
| ## 2. Advanced Backup Strategies | ||
|
|
||
| ### Cloud Storage Backup | ||
|
|
||
| Advantages include easy access and multiple redundancies, but there are risks of potential hacking attacks and service provider data breaches. | ||
|
|
||
| #### Security Enhancement Measures: | ||
|
|
||
| - Use client-side encrypted cloud services like [Tresorit](https://tresorit.com/) or [Cryptomator](https://cryptomator.org/) | ||
| - Implement two-factor authentication (2FA) | ||
| - Use strong, unique passwords | ||
| - Apply additional encryption using [GPG](https://www.gnupg.org/) or [VeraCrypt](https://www.veracrypt.fr/) before uploading | ||
| - GPG encryption command example: | ||
| ``` | ||
| gpg --encrypt --recipient your@email.com wallet_backup.txt | ||
| ``` | ||
|
|
||
| ### Advanced Paper Backups | ||
|
|
||
| Use waterproof, fireproof paper and consider steganography techniques to further enhance the security and privacy protection of paper backups. | ||
|
|
||
| #### Security Enhancement Measures: | ||
|
|
||
| - Use password-protected QR codes to store mnemonic phrases | ||
| - Encode mnemonic phrases as stories or drawings | ||
| - Create durable backups using professional metal etching tools | ||
| - Example: Use metal storage devices like [Cryptosteel](https://cryptosteel.com/) or [Billfodl](https://shop.ledger.com/products/the-billfodl) | ||
|
|
||
| ### Cold Storage Devices | ||
|
|
||
| - Use dedicated hardware wallets like [Ledger](https://www.ledger.com/) or [Trezor](https://trezor.io/) | ||
| - Use offline computers for cold storage | ||
|
|
||
| #### Security Enhancement Measures: | ||
|
|
||
| - Regularly update firmware | ||
| - Use complex PIN codes | ||
| - Enable advanced security features, such as Ledger's anti-phishing word verification | ||
| - Consider using multiple hardware wallets stored in different locations | ||
|
|
||
| ## 3. Backup Security Principles and Practices | ||
|
|
||
| ### Regular Security Audits | ||
|
|
||
| Regularly check the integrity and accessibility of all backups, and update security measures to address new threats | ||
|
|
||
| #### Audit Checklist: | ||
|
|
||
| - Verify the readability of all backups | ||
| - Test recovery processes | ||
| - Check for hardware wallet firmware updates | ||
| - Review access controls and password strength | ||
|
|
||
| ### Social Engineering Attack Prevention | ||
|
|
||
| Develop a comprehensive understanding of phishing and scam tactics to enhance your security awareness and protect your digital assets. | ||
|
|
||
| #### Preventive Measures: | ||
|
|
||
| - Never share complete mnemonic phrases or private keys online | ||
| - Use official websites and apps, verify download sources | ||
| - Be wary of unsolicited "help" on social media and instant messaging |
1 change: 1 addition & 0 deletions
1
...saurus-plugin-content-docs/current/general/blockchain-security/create-wallet.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,6 @@ | ||
| --- | ||
| displayed_sidebar: generalSidebar | ||
| sidebar_position: 1 | ||
| --- | ||
|
|
||
| # Security Advice for Creating a Wallet | ||
|
|
||
151 changes: 151 additions & 0 deletions
151
...tent-docs/current/general/build/smart-contracts/gas-optimization/erc20permit.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,151 @@ | ||
| --- | ||
| displayed_sidebar: generalSidebar | ||
| --- | ||
|
|
||
| # ERC20Permit | ||
|
|
||
| In standard ERC20, users typically need to execute two separate transactions: | ||
|
|
||
| 1. **Approval (approve)**: The user authorizes a certain amount of tokens to a recipient. | ||
| 2. **Transfer (transferFrom)**: The recipient transfers tokens from the user's account. | ||
|
|
||
| This approach not only increases gas costs but also diminishes user experience. By using ERC20Permit, we can merge these two steps into a single transaction, thereby saving gas and simplifying the process. | ||
|
|
||
| ### Gas Optimization Comparison | ||
|
|
||
| **Standard ERC20 Process** | ||
|
|
||
| 1. User calls `approve(spender, amount)`: approximately 50,000 gas | ||
| 2. Recipient calls `transferFrom(owner, recipient, amount)`: approximately 65,000 gas | ||
|
|
||
| **Optimized Process Using ERC20Permit** | ||
|
|
||
| 1. User generates a signature (off-chain operation, no gas cost) | ||
| 2. Recipient calls `transferWithPermit` (including permit and transferFrom): approximately 80,000 gas | ||
|
|
||
| **Savings**: approximately 35,000 gas, equivalent to a 30% gas reduction. | ||
|
|
||
| ### Example Code | ||
|
|
||
| #### Standard ERC20 Implementation | ||
|
|
||
| ```solidity | ||
| // SPDX-License-Identifier: MIT | ||
| pragma solidity ^0.8.20; | ||
| import "@openzeppelin/contracts/token/ERC20/ERC20.sol"; | ||
| // Standard ERC20 implementation | ||
| contract StandardToken is ERC20 { | ||
| constructor() ERC20("StandardToken", "STD") { | ||
| _mint(msg.sender, 1000000 * 10**decimals()); | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| #### Optimized Implementation Using ERC20Permit | ||
|
|
||
| ```solidity | ||
| // SPDX-License-Identifier: MIT | ||
| pragma solidity ^0.8.20; | ||
| import "@openzeppelin/contracts/token/ERC20/extensions/ERC20Permit.sol"; | ||
| import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol"; | ||
| contract OptimizedToken is ERC20Permit { | ||
| constructor() ERC20("OptimizedToken", "OPT") ERC20Permit("OptimizedToken") { | ||
| _mint(msg.sender, 1000000 * 10**decimals()); | ||
| } | ||
| function transferWithPermit( | ||
| address owner, | ||
| address spender, | ||
| uint256 value, | ||
| uint256 deadline, | ||
| uint8 v, | ||
| bytes32 r, | ||
| bytes32 s | ||
| ) external { | ||
| // Call permit to authorize the spender | ||
| permit(owner, spender, value, deadline, v, r, s); | ||
| // Transfer tokens from owner to msg.sender | ||
| transferFrom(owner, msg.sender, value); | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| #### Frontend Implementation | ||
|
|
||
| Example of implementing ERC20 Permit signature using Ethers.js v6: | ||
|
|
||
| ```javascript | ||
| import { ethers } from "ethers"; | ||
|
|
||
| async function signERC20Permit(contract, owner, spender, value, deadline, nonce) { | ||
| const provider = new ethers.BrowserProvider(window.ethereum); | ||
| const signer = await provider.getSigner(); | ||
|
|
||
| const domain = { | ||
| name: await contract.name(), | ||
| version: '1', | ||
| chainId: (await provider.getNetwork()).chainId, | ||
| verifyingContract: await contract.getAddress() | ||
| }; | ||
|
|
||
| const types = { | ||
| Permit: [ | ||
| { name: 'owner', type: 'address' }, | ||
| { name: 'spender', type: 'address' }, | ||
| { name: 'value', type: 'uint256' }, | ||
| { name: 'nonce', type: 'uint256' }, | ||
| { name: 'deadline', type: 'uint256' } | ||
| ] | ||
| }; | ||
|
|
||
| const message = { | ||
| owner, | ||
| spender, | ||
| value, | ||
| nonce, | ||
| deadline | ||
| }; | ||
|
|
||
| const signature = await signer.signTypedData(domain, types, message); | ||
| const { v, r, s } = ethers.Signature.from(signature); | ||
|
|
||
| return { v, r, s }; | ||
| } | ||
|
|
||
| // Usage example | ||
| const abi = [ | ||
| "function transferWithPermit(address owner, address spender, uint256 value, uint256 deadline, uint8 v, bytes32 r, bytes32 s)" | ||
| ]; | ||
|
|
||
| const provider = new ethers.BrowserProvider(window.ethereum); | ||
| const signer = await provider.getSigner(); | ||
| const contract = new ethers.Contract(tokenAddress, abi, signer); | ||
|
|
||
| const owner = await signer.getAddress(); | ||
| const spender = '0x...'; // Address to be authorized | ||
| const value = ethers.parseUnits('100', 18); // Amount to authorize | ||
| const deadline = Math.floor(Date.now() / 1000) + 60 * 60; // Expires in 1 hour | ||
| const nonce = await contract.nonces(owner); | ||
|
|
||
| const { v, r, s } = await signERC20Permit(contract, owner, spender, value, deadline, nonce); | ||
|
|
||
| // Call the transferWithPermit function of the contract | ||
| await contract.transferWithPermit(owner, spender, value, deadline, v, r, s); | ||
| ``` | ||
|
|
||
| ### Advantages of ERC20Permit | ||
|
|
||
| - **Reduced Transaction Count**: Merges approval and transfer into a single transaction, saving gas. | ||
| - **Improved User Experience**: Token holders do not need to pay gas fees for approvals. | ||
| - **Batch Processing**: Recipients can batch multiple permit and transferFrom operations in one transaction, further reducing gas consumption. | ||
|
|
||
| By adopting ERC20Permit, you can create a smoother and more cost-effective token interaction experience for users while reducing the overall load on the blockchain network. | ||
|
|
||
| **Gas Optimization Recommendations** | ||
|
|
||
| 🌟 In scenarios where frequent approvals and transfers are needed, consider using ERC20Permit. This can significantly reduce the number of transactions and overall gas consumption for users. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.