Security Model
Where keys live
The seed phrase and all derived private keys exist in exactly two states:
- Encrypted at rest in the browser's
localStorage(jb:vault) — PBKDF2-SHA256 (262,144 rounds) key derivation + AES-GCM-256, via WebCrypto. - In memory while the vault is unlocked in the open tab.
They never leave the browser: the site is static hosting, there is no backend to send them to, and every signature is produced in the page by JBVault. Plaintext is never written to disk or logged.
The seed phrase
Shown exactly once at generation, with an explicit write-it-on-paper warning. It is not stored in plaintext and cannot be re-displayed. If you lose both the phrase and the vault password, the wallets are gone.
Unlock model
The app opens on the vault gate: create the vault once, unlock it with the password on every visit after. Unlocking derives the keys into memory and checks them against the stored address list — a mismatch refuses rather than signing with the wrong wallets. Every signing path (funding execution, launch, buys, sells) goes through JBVault.account(i), which throws on a locked vault. Locking (or closing the tab) drops the in-memory keys; the encrypted blob remains.
Simulation before signature
Reads simulate; they never broadcast. Buys and sells are quoted by eth_call against the real curve with a price-impact guard, then gas-estimated, and only then signed. launchAndBuy additionally runs canLaunch(deployer) and a full eth_call of the exact calldata — if the simulation reverts, nothing is broadcast.
Blast radius
- The vault is same-origin
localStorage— the realistic threat is script injection, which is why ethers v6 is vendored and the app loads no third-party runtime scripts. - Wallet-0 funding is the only hot key with meaningful ETH during setup; the bundle wallets hold only their distribution share until launch.
- Clearing the browser's site data destroys the vault. Export the addresses if you want a record — the seed is the only recovery path.
What you should still do
- Write the seed on paper. Not a screenshot, not a password manager note — paper.
- Keep the vault password distinct from anything else.
- Lock the vault when you step away — closing the tab does it for you.