Folks,
As you may know, for around 24 hours we have been working on adding support of issuing transactions directly from the mobile app.
We’ve got bad.. and good news as well!😁
Let us start with the bad. We’ve had boys’ return results of their TLA+ simulations portraiting of what was to be and partially already has been implemented since the very morning.
All in all, it turned out to be a little bigger subject than expected, with potential issues involving other areas of the system as well, were we to to leave things as they are or were to be.
Let’s now jump straight to the gist of things: In order to uphold strong security guarantees against malicious full-nodes we will need to move the entire Grid Script Compiler to be available directly from the mobile app. In other words – large portions of the GRIDNET VM engine will need to be made available from the mobile app itself. Sounds complicated? It is😆.
That wasn’t quite expected.
Still, the simulations showed that a malicious full-node could request a signature for arbitrary operations were things to be implemented like we initially envisioned. Now, of course, we need to be after security first. It needs to be first there’s no way around it.
To sum up, we need the mobile app to be able to:
- Compile GridScript on its own – we can’t trust full-nodes to be compiling GridScript instructions for us as the resulting byte-code could be faked. We wouldn’t know wasn’t the mobile app be able to..
- Decompile the code generated at a full-node and be able to present results of decompilation to the user would he want to verify what’s being committed.
Now, if we allow for 1) – the mobile app would be able to compile a #GridScript transaction on its own sign it and problem solved. Then, in case of simple transactions that the mobile app formulated, there wouldn’t be any need to user to verify source code and stuff as one may be 100% sure that code was generated and compiled by the mobile app itself.
The second point would be of particular importance when the to-be-committed transaction resulted from user actions made within the Web-UI, or for whatever other reason was the code compiled at a full-node. In short: we need to be able to see within the code if it was generated at full node and compile at mobile app if we can.
There could be a hacky solution making the mobile app able to compose bytes of a simple transaction but that would be too short-sighted and since cryptographic signatures and variable length fields would need to be used anyway, even this wouldn’t be so simple. Thus we’re planning on porting the entire compiler.
The good thing? While it’s going to take little longer than expected, we’ve already planned the approach towards this matter and we could see some functional results at the beginning of next week🤗
Wizards.🧙♀️🧙
