Luke Childs lukechilds

Connector Vaults: Delegated Execution and Stateless Revocation

Each chain of presigned vault transactions carries one tiny connector UTXO controlled by a controller wallet. Every transaction spends the current connector and creates the next, so it can execute only when the controller wallet signs at broadcast time. Spending the live connector elsewhere revokes the remaining chain without moving its funds or requiring presigned revocation transactions.

Properties:

Offline signatures and presigned transactions are halved. An n-step policy needs n offline-signer authorizations instead of 2n (n authorizations + n revocations). This is especially impactful when performing large signing ceremonies on low-powered devices like hardware wallets.
Revocation transactions do not need to be presigned. The controller wallet constructs th

Nimdolf: Non-interactive Mint Delegation on Liveness Failure

This proposal improves liveness guarantees for custodial ecash mints with on-chain reserves. It allows a mint operator to delegate control of mint reserves to third-party mint operators in a non-interactive way.

While the mint is in operation, it maintains unilateral control over the mint reserves. However, if the mint becomes unresponsive, the delegate mint can take over control of the funds and process withdrawals for the original mint's users.

A mint can delegate to multiple other mints. If a set of mints all act as delegates for eachother, they collectively inherit 1-of-n liveness properties. As long as one mint in the set is able to remain online, the users of all mints in the set are able to redeem their funds.

💥 Kapow: Bitcoin Finality Guarantees for the Liquid Network

Kapow (Kheckpoint-Anchored Proof-of-Work) introduces a Bitcoin-backed checkpointing mechanism for the Liquid Network. It provides Bitcoin-equivalent finality guarantees to Liquid blocks on a ~10-minute interval, backed by the full power of Bitcoin's proof-of-work. Once a Liquid block has been checkpointed on Bitcoin, it cannot be reorged by the Liquid block producers without them also performing a reorg (51% attack) on Bitcoin itself.

This would be especially beneficial if Liquid moves to a BitVM-based bridge, since Liquid's current consensus mechanism would become a weak point in the trust model and undermine the security of the BitVM bridge, invalidating its 1-of-n trust assumptions.

The Problem

Liquid's original design made a sensible tradeoff: since the peg itself depended on a federation with an honest-majority trust assumption, Liquid consensus could also depend on the same federation. Adding a separate proof-of-work or merge-mined con

Guarda Wallet: CSS-Only Seed Exfiltration

Problem type: CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) > CWE-200 (Exposure of Sensitive Information)
Proposed CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N ≈ 6.5

On the mnemonic import page (https://guarda.com/app/import-mnemonic), the application loads a third-party stylesheet from Google Fonts. Loading external CSS on a page that handles secrets introduces a supply-chain risk: a malicious or compromised upstream stylesheet could exfiltrate the seed phrase using CSS-only techniques (no JavaScript) by triggering outbound requests to an attacker’s server, resulting in total loss of funds for the user. This report describes the risk condition and does not allege any malicious action by Google Fonts.

Here's the Roboto font being loaded in the <head> of the page:

Trust-Minimized Ecash: Ecash mints funded via a self-custodial credit system

Overview

This proposal introduces a self-custodial credit system that sits in front of an existing ecash mint. The users balance is held in a trustless credit contract that can be instantly swapped for ecash tokens offchain at the time of payment. Custodial risk only exists while payments are in flight, which is usually seconds, and only for the amount currently being transacted. The balance is always self-custodial and if the mint disappears or is uncooperative the user can unilaterally exit and reclaim their credits onchain.

The protocol works on Bitcoin today and does not require a soft fork or any new opcodes. Infact it doesn't require any opcodes at all. The protocol is almost entirely off chain, every possible way to execute the trustless credit contract results in a MuSig2 taproot key path spend onchain, no Bitcoin Script required.

The problem

Generate pretty markdown release notes from GitHub compare view

Go to GitHub compare view between two release tags and dump the following in devtools:

copy(Array.from(document.querySelectorAll('#commits_bucket .Box-row')).map(e => {
    const commitTitle = e.querySelector('.Details p').textContent.replace(/…/g, '').trim();
    const authors = Array.from(e.querySelectorAll('.commit-author')).map(e => '@' + e.textContent);
    const commitUrl = e.querySelector('a[href*=\'/commit/\']').href;
 return `- ${commitTitle} - ${authors.join(' ')} ${commitUrl}`;

Installs all cross platform emulators for use with docker buildx

docker run -it --rm --privileged tonistiigi/binfmt --install all

Install Umbrel v0.3.7

sudo apt update -y
sudo apt install -y fswatch jq rsync curl
curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker $USER
sudo curl -L "https://github.com/docker/compose/releases/download/1.28.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
sudo mkdir ~/umbrel

	Hey, I'm lukechilds-2123375 and I have contributed to the Citrea Risc0 to BitVM Circuit MPC Phase2 Trusted Setup ceremony.
	The following are my contribution signatures:

	Circuit # 1 (verify_for_guest)
	Contributor # 15
	Contribution Hash: 9ec2d2bd 4881ff17 d95a113b a26f17a3
	f8043a64 fed1a53d b4c50bdc fe022c55
	bc5da69e b3d6f697 94b3fd03 ba69d77e
	d012724f 1e3be2b8 729b1a35 3dc86aff

	#!/usr/bin/env bash
	#
	# Setup or remove an SSH hidden service on Debian based systems.
	#
	# Usage:
	#
	# Setup SSH hidden service:
	# $ curl -Ls https://git.io/tor-ssh \| bash -s -- --setup-tor-ssh
	#
	# Remove SSH hidden service: