Syrius Extension Wallet v0.3.3

Project Name: Syrius Extension Wallet: refactoring, reskinning, and new features

Description: The Syrius browser extension is Zenon’s non-custodial browser wallet. This project took the published 0.1.10 build and produced 0.3.3:

  • It fixes live wallet defects that affected funds. Sends were signed with the wrong address, amounts lost a base unit, and a mistyped recovery word silently imported a different wallet.
  • It rebuilds the codebase and UI. The popup bundle went from 7.95 MiB to 146 KiB.
  • It adds what dApps on Zenon need: a window.zenon provider on every site, per-origin permissions, message signing byte-compatible with desktop Syrius, and arbitrary account-block signing.

Why it matters for Zenon: a browser wallet is how most people first touch a chain, and every Zenon web dApp depends on one. Ferry and the Zenon Faucet already run HTLC flows through this extension that desktop Syrius can’t do.

URL: https://github.com/sol-znn/syrius-extension (a fork of MichZNN/Syrius-Extension)

Team:

  • sol: Phase 1 design, implementation, testing, documentation
  • @MichZNN: the Manifest V3 port and published 0.1.x build this work is based on, which kept the extension installable, plus ongoing support and review.

Phases

Phase 1: Refactor, reskin, and new features (delivered)

High-level overview of main tasks:

  • Correctness fixes, all live defects in 0.1.10:
    • Sends signed with the wrong address (six call sites)
    • Amounts losing a base unit: 4.35 ZNN sent 434,999,999 base units, and staking 1.5 ZNN staked 1.0
    • No BIP-39 checksum on import
    • Unawaited key-store saves
    • Address 0 reset to defaults on every load
    • A password prompt reappearing when MV3 discarded the credential cache
    • A dead message channel hanging the wallet on a blank splash screen
    • Unparsed recipient addresses and a hardcoded 999 max send
    • Wrong-decimals delegate rewards
  • Refactor:
    • Popup bundle 7.95 MiB → 146 KiB, entry point 14.9 → 6.1 MiB, build 33 s → about 21 s
    • Zero Argon2id decryptions per navigation (previously one, at 64 MiB)
    • The service worker rewritten as a router with sender validation, holding no key material
    • One signing path instead of six, one list instead of four, one error formatter instead of ten, one toast helper instead of twenty
    • Sessions kept in chrome.storage.session with a real auto-lock, and the plaintext-password oracle removed
  • Reskin: a token-driven design system replaces 1,801 lines of !important utilities. The popup is a fixed 360×600 shell whose header no longer slides away mid-transaction, and the intro animation and 3D ball are gone.
  • New features:
    • A Tokens screen listing every ZTS
    • Readable history (Fused / Staked / Delegated / Swap created, unlocked, reclaimed), with HTLC selectors re-derived from go-zenon’s ABIs in npm test
    • The window.zenon provider with EIP-1193 errors, events, per-origin permissions, and a Connected Sites screen
    • signMessage / znn_sign
    • Change password, remove wallet, address labels, auto-receive, auto-lock, explorer choice, and node list with chain-id detection
  • Release engineering:
    • GitHub Actions publishes the Chrome/Brave ZIP and SHA-256 for every version, refusing tag and manifest mismatches
    • A dev harness runs the extension in a separate Chrome with a self-unlocking devnet wallet
    • An end-to-end dApp test is included

Completion of Phase 1 will be measured by:

  • :white_check_mark: 0.3.3 released with the ZIP and checksum published by CI
  • :white_check_mark: The amount fixes confirmed against a devnet node, and npm test re-deriving all embedded-call selectors from go-zenon
  • :white_check_mark: utils/dapp-test.js driving a real page against the provider end to end, including message signing
  • :white_check_mark: Ferry and the Zenon Faucet running HTLC flows through the extension on devnet

Phase 2: Community-requested features and bug fixes (open for suggestions)

High-level overview of candidate tasks, all out of scope for Phase 1:

  • P2P / HTLC swaps in the wallet, with arbitrary hash types and expiries (desktop Syrius is SHA3-only with a 24-hour cap)
  • Accelerator-Z: browse, vote, create
  • Sentinel support
  • WalletConnect
  • Hardware wallets (Ledger)
  • Chrome Web Store and Firefox listings
  • Bugs reported against 0.3.x

Completion of Phase 2 will be measured by:

  • Deliverables agreed per item in this thread before any funding is requested

Funding

Total Requested Funding = 4,000 ZNN and 40,000 QSR (Phase 1). Phase 2 depends on feature complexity and is filed separately.
Project Duration = 1 week: Phase 1 delivered

How did you calculate your budget?

  • Scope. A full correctness, refactor and reskin pass over the wallet plus three new capabilities: the dApp provider, message signing, and the release pipeline.
  • Comparable proposals. AZ for SYRIUS v0.2.0 asked 4,000 ZNN + 35,000 QSR, and Syrius Wallet Website for iOS/Android asked 5,000 ZNN + 40,000 QSR.
  • Split.
    • sol 3,000 ZNN / 30,000 QSR
    • @MichZNN 1,000 ZNN / 10,000 QSR

Project and Payment Milestones:

Phase 1
Funding Request: 100% (4,000 ZNN and 40,000 QSR)
Duration: delivered

Phase 2
Funding Request: filed as new projects, one per agreed scope. A project’s total can’t be raised after creation, so Phase 2 can’t be added to this one.
Duration: per item


Other Information

Risks, Assumptions, Known Issues, Dependencies:

  • Dependency on znn-ts-sdk (npm 0.1.3), which has no HTLC support. HTLC decoding is therefore checked against go-zenon directly.
  • Signing is deliberately conservative. Every signature is prompted, and a message of exactly 32 bytes is refused so a site can’t pass off a block hash as a message. The trade-off is that message signing uses UTF-8 rather than desktop Syrius’s narrowed UTF-16, which is identical for ASCII.
  • The extension isn’t updated on the Chrome Web Store yet. It installs from the release ZIP in developer mode.

Have you previously submitted a proposal (either in Accelerator-Z or Incubator)?

On-chain filing:

Project name Funds
Syrius Extension Wallet v0.3.3 4,000 ZNN / 40,000 QSR, one phase

Documentation (in the repository):

  • CHANGELOG.md: every change against 0.1.10
  • REFACTOR.md: the reasoning behind each change, and what was measured
  • SETUP.md
2 Likes

A solid browser wallet is foundational infrastructure for Zenon. If we want people to actually use web applications built around NoM, this is not really optional.

More importantly, this release isn’t just a reskin. Fixing fund-affecting address/amount issues, validating recovery phrases properly, consolidating the signing paths, adding real session locking and introducing a permissioned window.zenon provider are meaningful improvements.

I also like the conservative signing model. Every signature requiring explicit approval is the right default for a browser wallet.

For the next phase, I would put two things very high on the list:

hardware-wallet support and official Chrome/Firefox distribution.

WalletConnect, Accelerator-Z integration and additional features would all be useful, but reducing key exposure and removing developer-mode installation friction probably gives the largest immediate improvement in security and adoption.

For arbitrary account-block signing, I would also keep improving the human-readable transaction preview. Known embedded-contract calls should show exactly what the user is authorizing, while an unknown/undecodable call should look obviously different from a normal transfer.

Phase 1 is already delivered and addresses real correctness and infrastructure problems. I think it deserves support.

release: v0.3.3

  • Fix receive history showing the account’s own address/block instead of
    the sender’s and the origin send block (thanks @Stark)
  • Add wss://node.zenonhub.io:35998 to the default node list and make
    wss://my.hc1node.com:35998 the fallback node
  • Show a human-readable summary on the raw account-block approval screen,
    with the raw data collapsed behind a toggle (thanks @edgepillar)
  • Sanitize wallet names before saving/unlocking, fixing “Given keyFile
    does not exist” for names containing spaces (thanks @Stark)
  • Redesign success toasts (green fill bar, close button), fix every toast
    closing instantly for users with reduced motion enabled, and dedupe the
    “Address changed” toast
  • Delay the list “Loading…” label so it only appears for genuinely slow
    fetches, and fix a layout bug that jumped the Fuse Plasma/Stake ZNN
    buttons partway up the screen once their lists loaded
  • Default the unlock screen to the last-used wallet, and dismiss stale
    toasts (and the expected “wallet is locked” error) when locking
  • Add a live ZNN/QSR USD price feed (mainnet only) to the dashboard, with
    whole-number balances past 1,000 and left-aligned, larger/lighter USD
    figures
  • Fix inconsistent line-wrapping of pillar stats on the Delegate screen
  • Add a recipient field to the Plasma screen so plasma can be fused for
    any address
1 Like