[LOCKED] Support Ledger Wallet

Bounties
22

Roger that. We’ll keep you posted.

1 Like
23

Congratulations @markhollis :champagne:, as per Tuesday March 17 governance meeting decision, the bounty is now assigned to you. I’m changing the status of the request to LOCKED.
We will check every 2 weeks the progress. If there is no sign of life after a month this bounty will be set to available again.
Good luck and feel free to ask any questions that you have on Keybase!

18 Likes
24

It was agreed on keybase to reassign this task to @NicolasFlamel .

6 Likes
25

Now that this bounty has been assigned to me, I propose the following changes to it based on my experiences developing the Grin Ledger app and Ledger Live Desktop/Mobile with Grin support.

1. Remove the requirement of needing Ledger to officially release the app and integrate the Ledger Live changes.
It’s now been more than a year since I submitted the app to Ledger for review, and since then the app’s submission status hasn’t changed at all and I haven’t been contacted by Ledger. Ledger has stated in their Discord channel that they currently lack the man power needed to review and release external apps for cryptocurrencies that don’t have a high enough market cap, so there’s a chance that the Grin Ledger app will never be officially released by them. Unfortunately, this bottleneck is outside of my control.

2. Remove the requirement for a grin-wallet CLI integration.
This isn’t explicitly mentioned in the bounty’s deliverables, so, as far as I can tell, this was a self-imposed requirement by @markhollis. Ledger’s release requirements for an app explicitly state that an app’s integration in a GUI wallet is mandatory for a public release, so having a CLI integration doesn’t help with getting an app released publicly. The GUI wallet that I integrated support for the Grin Ledger app into is the Grin version of the MWC web wallet.

3. Increasing the bounty’s reward from 50k USD to 100k USD.
Given the sheer amount of time, knowledge, and skills required to complete this bounty, I find the original reward of 50k USD to be insufficient. Here’s all the tasks and subtasks required to complete this bounty given Ledger’s requirements and the route that I took.

As far as I know, in the approximately two years that this bounty was assigned to @markhollis, he didn’t manage to finish any of those subtasks which is a testament to how challenging this bounty truly is. Also, inflation has been pretty bad since this bounty was first posted.

Tagging the Grin OC members to review the proposed changes in a timely manner: @quentinlesceller @oryhp @tromp @Yeastplume

1 Like
26

Reasonable request. Can’t really hold you to something that’s impossible to achieve.

Sure.

I’m a huge fan of your work here and I think you were treated a bit unfortunately on the wrapper bounty, but I don’t see how you can come and ask for that retroactively. The bounty is the bounty. Not that it’s up to me. If I stretch I could sort of see an argument for adding interest on the period between your release of the app and the bounty being paid out to you, due to the delay, but that would be in the 5-10% range.

3 Likes
27

Don’t worry, after last events with Ledger trust to this hardware wallet dropped to minimum, its more secure to develop our own hardware wallet from open components, we have some bounty for this, you are welcome to apply if you are interesting: Funding Proposal 2: Bounty for a Hardware Wallet implementation - bounty?

5 Likes
28

Out of curiosity, did you receive any funding for developing Ledger support for the MWC wallet?

2 Likes
29

No, I didn’t receive any funding for that. In total, I’ve receive about $650 USD worth of donations from Grin and MWC community members for my Ledger related work.

30

I completely agree with you. I may have already developed a Trezor Model One firmware with Grin support as a result of this :wink:

15 Likes
31

I would highly support this development.
As time showed, ledger is a centralized company, with weird decisions made recently.

We need a grin signer device built from common hardware boards, like seedsigner or krux hardware signers for bitcoin.

3 Likes
32

As per @oryhp on Keybase, bumping this thread to remind the Grin OC to review my proposed changes for this bounty.

Tagging the Grin OC members to review these changes in a timely manner: @quentinlesceller @oryhp @tromp @Yeastplume

Also to keep everyone up to date regarding the app’s submission process with Ledger, Ledger no longer covers the cost of auditing third-party hardware wallet apps and they removed the app from the integration board. Here’s a snippet of the conversation I had with Ledger regarding this.
ledger security audit changes

33

I am a huge fan of your work with grin.

I support concessions on 1 and 2 and I oppose 3. The bounty is the bounty.

To expand on that, the time to ask for a greater bounty would be before doing the work. However, even in that hypothetical, I would have opposed raising it.

4 Likes
34

I have no say on this bounty but I will share my opinion. If the work increased significantly beyond what could be expected, or now includes payment for an audit, it would make sense to increase the bounty to compensate for these costs or drop that requiremt. However, the combination of dropping major tasks while asking for a doubling of the bounty does not make sense to me at all.
Requirement 2), Integration in wallet software is a large part of the work and would pose a bottleneck if offloaded on @Yeastplume who is already doing the work of Atlas. Therefore I would strongly argue against dropping this requirement. Dropping requiremt 1) or at least paying for those audit cost would make sence to me. So 3) should be negotiable IMO if there are valid arguments to claim the task or cost exceeds what could be expected and should include the audit fees unless this requirement is dropped.

2 Likes
35

Would be a waste not to finish Ledger App, a lot of work went into it I imagine, we all are very grateful to you :pray: @NicolasFlamel .
But why the ask to double the bounty. Bounties are take it or leave it right?

2 Likes
36

I see this in the following way:

  1. We have a separate website, e.g. grinwallet[.]com
    On the website we have the web wallet, a button to download the app, instructions and link to github if someone want to compile it.
  2. We want both tor and slatepacks to work. As I understand slatepacks are not implemented?
  3. We don’t need any integrations to Ledger GUI apps. I see no sense to duplicate the functionality since we have the web wallet and we won’t be able to get into the official ledger app anyway.

With the above points, what’s left to be implemented? Only slatepacks and rebrand the website?

I don’t think we need to continue prioritizing ledger support anymore, since we are not going to be added there officially any time soon. So let’s implement the minimum usable functionally, simple and clear UI for users.

@NicolasFlamel does it make sense to you? Could you clarify what’s already usable at the moment? As I understand we can install Trezor and Ledger (unofficial) apps and send/receive transactions over tor on the mwcwallet[.]com?

So, we can estimate how much efforts were spent on the project by @NicolasFlamel, ask him to create a re-branded wallet website, manual slatepacks functionality and make a donation instead of full funding to appreciate for the work.

1 Like
37

Our sincere apologies for the late response.

The Grin Council has decides to partially agree with 1, fully agree with 2, and to disagree with 3.

75% of the original bounty can be paid out immediately, and the remaining 25% can be paid out once the Ledger app has been reviewed and approved by Ledger.

Please contact any OC member to arrange payment.

EDIT: Nicolas has been paid on Mar 24.

7 Likes
38

I’ll contact the Grin OC to arrange the payment.

As the quote I received from Ledger’s approved security audit partner, Quarkslab, is greater than 25% of the final reward for this bounty, I won’t personally be pursuing getting this app approved by Ledger.

I implore the Grin OC to close this bounty now. It’s been open for far too long.

2 Likes
39

It is a terrible look how long this payout has languished, and that there won’t be a reference wallet integration nor upstreaming of the code to the HD wallet manufacturers. Grin is in desperate need of increased usability and getting it officially supported within the Ledger and Trezor managers is probably the best way to improve usability at this time.

12 Likes
40

As this bounty is actually already had been done (all the same, without third party audit, it won’t be approved and integrated in Ledger Live), are there any plans and schedule to integrate Ledger wallet app in to the Core GUI wallet?

41

IMO not until the Ledger wallet gets audited and approved by Ledger…

1 Like