Wallaby System Security

This page covers details about how the Wallaby system itself ensures security.

Wallet Private Key Security

The Wallaby system uses confidential computing as a key component of its core infrastructure. This means that data is encrypted while at rest, in transit, and in use which enables us to provide full service & secure wallet operations.

Data Generation and Processing within the Secure Enclave

In order to keep wallets secure, we focused on a strategy that keep wallet private keys protected at all times. At the core of our security is the secure enclave where wallet generation, wallet recovery, and transaction signing occur. This is a confidential computing environment where data is protected when generated and while processing.

Data Storage within the Secure Enclave

Wallaby itself does not store wallet private keys, even in an encrypted format. We generate them on demand when provided with the seed phrase. The seed phrase is also not stored on our servers. Instead the system is designed to store the seed phrase in an encrypted format on the client's device. This design is more resilient to large scale attacks since it eliminates a honeypot/single point of attack.

{image of the infra}

Secure Access to Wallaby

Wallaby API Keys

Purpose: In order to restrict Wallaby system access to authorized applications.

More info: To register an application, you will need to generate an API key associated with your business and application. These API keys can be generated and configured within our enterprise portal. With access to our portal, will be able to generate new keys, retire unused keys, and configure which domains are given access with each key.

Device Auth Key

Purpose: In order to restrict Wallaby system access to authorized devices.

More info: Wallaby utilizes the SRP (secure remote password) for system authentication. This means that the device specific key is the main identifier for the wallet holder. It is used to create a new account or sign in to an existing account. Unlike the Wallaby Access Token below, you can use this key after an expired session to regain access to the Wallaby account associated with this device. Read more about how to keep this key secure in Securing Device Auth Key.

This key also has a secondary purpose since is also used to encrypt sensitive data before transport. Read more about this in Securing the Seed Phrase.

Wallaby Access Token

Purpose: In order to limit the window of access from a particular device should an active session with the application get stolen.

More info: To ensure continued access to Wallaby, you will need to provide a Wallaby access token from Wallaby as the authorization in the header. This access token is generated after signing in with Wallaby and expires after 30 minutes. It can be refreshed before expiration as needed.

User Access Token

Purpose: In order to restrict Wallaby system access to a particular user of your system and limit the window of access for that user should an active session get stolen

More info: To ensure continued access to Wallaby, you will need to provide a user access token from Wallaby as a custom header value called x-client-jwt. This access token is generated by your application and signed after logging in with your system.

Infrastructure Security

WAF

Backups

Cloudflare

Access Policy

Audits

Prior to launch, the entire wallaby infrastructure system underwent rigorous scrutiny through multiple audits conducted by leading industry firms. This commitment to independent evaluation ensures our system's security, reliability, and compliance with industry standards, giving you peace of mind when doing integration with it.

Wallaby Transport Keys

Purpose: In order to ensure sensitive information was prepared by an authorized device.

More info: After creating an account or logging in, you will gain access to the public key and are expected to use it to encrypt the seed phrase before transporting to Wallaby. Wallaby will then decrypt it in order to generate your wallet private keys in order to complete a tx with your wallet.