A wallet holds one secret: a recovery phrase, or a raw 32-byte seed for the
dev accounts. The secret is encrypted with the wallet password (the keyring's
scrypt + xsalsa20-poly1305 JSON encryption) under its own storage prefix,
quantus:wallet. From it the wallet derives, for each account index:
- an ML-DSA-65 and an ML-DSA-87 signing account, at the paths quantus-cli and
the mobile wallet use. These are ordinary keyring pairs tagged with walletId
and accountIndex, so signing, dapp injection and JSON export don't change.
They're named "<wallet> (ML-DSA-65)" and so on, so a dapp's account list can
tell them apart.
- 20 receive and 20 change wormhole addresses (m/44'/189189189'/n'/b'/k'),
derived by @quantus/crypto 0.2.0. Only addresses leave WASM. They're derived
while the password is available, so a balance can later be shown without
asking for it.
New messages: pri(wallets.subscribe, preview, create, addAccount, rename,
forget).
- The same secret can't become two wallets, because forgetting one would take
the other's pairs with it.
- A raw seed has one account and no wormhole addresses: wormhole derivation
starts from the 64-byte BIP39 seed.
- Adding an account needs the password; a wrong one is refused before any
pair is made.
@quantus/crypto is resolved to 0.2.0 everywhere, so the common forks and the
extension share one copy of the WASM instead of bundling two.
The specs use independent vectors only:
- the chain node's TEST_WORMHOLE_ADDRESS, also pinned by the mobile wallet's
SDK;
- quantus-cli's ML-DSA-65 and ML-DSA-87 accounts for its dev phrase;
- crystal_alice for the zero seed.
Part of quantus/extension#14.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
grenadeandClaude Opus 5
22eb1c25c8