Ecosystem Wallet Security

When a user signs into an application using their email or social logins for the first time, a wallet is generated within a secure enclave on the server after verifying the user's legitimacy. The enclave provides a trusted execution environment, ensuring the wallet creation process is isolated and protected from external interference.

• The wallet and its corresponding private key are generated entirely within the enclave, never leaving its secure confines.
• User authentication data is verified within the enclave, ensuring that only legitimate, authenticated users can initiate wallet creation.

• The enclave's cryptographic properties ensure that even the server operators cannot access the contents or operations within the enclave.
• The enclave provides a verifiable hash of the image of the code that is being run on the device, allowing anyone to verify the contents of the code.
• The wallet's private key never exists in an unencrypted form outside of the enclave.
• All sensitive operations, such as transaction signing, occur within the enclave, ensuring the wallet's security.

• When users interact with their wallet via the the enclave, all communications are encrypted and only the legitimate user can access their wallet.
• All traffic is encrypted with TLS and HSTS. Services are run in private VPCs on AWS and accessible only from a single entry point via our Cloudflare DNS.
• Applications can link multiple authentication methods to the same enclave. Any of these methods can be used to authenticate into the users wallet.

• Ecosystem wallets are controlled by the ecosystem owner.
  • We moved away from the shamir secret sharing model and replaced it with Encalves. This ensures no-one can extract the private key from the client, including other developers in the ecosystem.
  • With enclave and partner policies, ecosystem owners are able to place restrictions on what individual partners are able to do. Since the private key is never re-constructed on the client, the ecosystem partner must submit the request to the enclave which would be able to verify the request and block requests that are out of scope or denied by the ecosystem owner.

• Users can export their private key at any time.

• Thirdweb wallets support three categories of authentication: socials, custom authentication, and email / phone authentication. If a user ever loses access to their authentication method:

  • For socials and email / phone authentication, users can utilize the recovery flow of their providers to regain access to their account.
  • In the case of custom authentication, the developer managing their authentication flow will be able to re-instate the users account upon successful verification.
  • Application providers do not have direct access to user accounts or private keys, as these remain secured within the enclave. The enclave's design ensures that only verified user requests can trigger wallet operations.

• Users are able to link their authentication methods which will provide them multiple ways to access their account if they ever lose access to any one of their authentication method.