How launch wallets are protected

The keys

• Each launch wallet is created on our servers. Its key is encrypted with AES-256-GCM the moment it’s made, and the unencrypted copy is thrown away.
• Each encrypted key is locked to its own launch and address, so it can’t be swapped onto another launch.
• Keys are never sent to your browser or included in anything our servers send out. Only the wallet’s public address is ever shown.
• A key is only unlocked for the moment it’s needed for something you approved, then wiped from memory. Production deployments should do this signing inside a dedicated key-management service.

Your approval

• Launching a token and returning leftover funds each need a fresh signature from your main wallet, even when you’re already signed in.
• What you sign names the site, the action, the launch, the launch wallet and a one-time code that expires after five minutes. Our server checks it against its own records, so a changed or reused approval fails.
• Leftover funds can only go back to the main wallet that owns your Signature. Nobody can send them anywhere else.
• Actions that move funds run one at a time for each launch, so they can’t be triggered twice at once.

Signing in

Signing in saves a secure cookie in your browser that only our server can read. It lets you save drafts and set up launch wallets. On its own, it can’t launch a token or move any funds.

Reporting a problem

If you find a security issue, contact the security team before sharing it publicly. This placeholder build doesn’t have a live contact yet.