Review strategies, polls, comments, do research and make votes

Sync on recovery address and guardian matters with Timeless

More granular stats histogram; Repeated runs for stats retrieval and verifications; Fix a bug with blank staking page caused by scientific representation of javascript numbers; Save output for stats histogram; Review suggested fix on tracked tokens (#314)

Include staked balance for stats histogram; Update key stats numbers

Backup APIs and verifyByEmail for users

Initial review and request for information on Horizon Bridge launch; Research on backup approaches and GCS implementations; Review on Timeless source code pull request related to loading EOTP in memory; Review Timeless proposed security diagram; Provide feedback and guidance on deficiencies and potential areas of improvements

(Continued) and research on best GCS approaches for backup services 

Review of Harmony offsite initiatives; Research, summary, and written plan for Security, Monitoring, Alert initiative

(Continued)

Debugging stats generator; Fix stats issues related to factory deployed address; Identify root cause of zero-balance issues; Address deduplication

(Continued) and deploy stats in production relayer; add api for stats in relayer; update client side stats retrieval and caching; More address and balance deduplication

Stats histogram script and improvements; Granular stats counter including overall counter and balance and those related to Timeless

(Continued)

(Continued)

Fix stats bugs with balance update and address caching; add scripts to refresh all balance

Resolve merge conflict; Debugging with zero balance issues; Sync with John; Factory deployed transaction extraction and address computation

Review v2 routes and components (#310)

Review stats generator first draft (#312); Revise and debugging stats generator, simplify implementation, and significantly optimize the performance; Research on fast statistics retrieval and computation methods

(Continued)

(Continued)

(Continued) and updating testing README; review dynamic custom theming (#301); Review recovery issue (#309)

Fix recovery issues (#309); v2ui review (#304)

Review and revise v2 routes and components (#310)

Response team briefing

Sync with John on testing, statistics generator, and web3 integration

Debug and fix set-recovery-address and general operation issue; Fix major cause of failures in relayer (upgrading from old versions); Sync with Brayden Ooi (propsective frontend development)

Review and debugging and fixing various issues with innerCore testing and adjustment of time in testing (#298); 

(Continued) and various implementations for minimizing of user frictions

(Continued) and extending signup to components where new verification code is set up; 

Experiment with OS-managed verification code; Backend for user signup; Data validation; Autofill OTP in all pages wherever applicable

Security AMA (Twitter Space)

Security Reddit AMA and Medium blog review 

Research and experiments with OS-managed verification code

(Continued) and fix buggy implementation of BATCH operation in contract; Feature request for staked-transfer; RPC Log review for theft investigation

Debugging and sync on InnerCore related tests

Security AMA written responses

v16 release notes and detailed updates and notes on several issues pertaining to v16; Require recovery address before upgrading; Integration with Transak USD gateway and Apple Pay; Security AMA preparation; USDC theft investigation

Sync with John

Fingerprint IP tracing manual review for theft investigation; Fix v2ui wallet header; Review new UI theming #299;

(Continued) Fix and simplify tests pertaining to upgrade, innerCore, security, and spending limit; Simplify test utilities

(Continued)

Review Timeless Proposal

Response team briefing

Review, debug, and fix Create component refactoring (#292)

Relayer analytics ElasticSearch setup, schema, persistence implementation, data capturing, fingerprint (user agent and IP) capturing, request parsing, debugging and testing; Fix Relayer early abort errors; Sync with John

(Continued) ElasticSearch setup and persistence; Add more QR code supported formats (#233)

Prompt warning about sending funds to exchanges; README update

Review Timeless NFT avatar proposals and provide feedback

Debugging panic issue of private RPC node; Experiment and tests with private RPC nodes in production and confirmation of working node

Relayer analytics API and private RPC health check API

(Continued)

(Continued)

(Continued) and experiments with GCP network SSD, local NVME SSD and mergefs

(Continued) conclusion of the experiments and confirmed final, stable RPC node / validator setup

Debug and fix an ambiguos method call in relayer that is present for older versions; Review and fix a bug with invoking contract call in web client (causing multisig authorization issue #291)

(Continued) Compile script bug fixes, debugging cross-compile and dependency issues, and others; Setup validator

Debugging and profiling RPC and validator node data sync issues

(Continued)

Harmony core / RPC node I/O issue debugging and experiments; Sync with John on testing

(Continued)

Response team briefing

Sync with John

Assist Timeless in meeting regarding NFT and its external partner; Sync with Timeless

(Continued) RPC node and validator setup and debugging; Produce more messages in relayer

Sync with John

Relayer stablity improvement

RPC node custom compiling, setup, data sync, and debugging

Debugging relayer issues; Manual restart and inspections; Sync with Timeless on RPC issue

Sync with Timeless

Response and investigation into Timeless inquiries related to RPC issues

Response team briefing

Upgrade failure issue debugging

Letter of Acknowledgement review and suggestions

Response to Timeless inquiries related to domain registration and pricing mechanisms

Continued Token Testing review (#274)

Continued Token Testing review (#274)

Recent major theft incident tracing, analysis, and TODO suggestions

Sync with John

Review of LittleSnitch safety and feasibilities of using VPN to restrict network connections for major asset transanctions

Response to Timeless inquiry of issues related to an NFT contract and review the contract

Token Testing review (#274)

Further review and response to Timeless NFT contract

Continued Token Testing review (#274)

(Continued) Final review and testing of v16. Release v16; Release testing and documentation of issues (#287)

Provide opinion and analysis to FBI follow-up questions

Response team briefing

Response and investigation to Timeless inquiry regarding wallet creation slowness on Android

Sync with Timeless on RPC issues and solutions

Simplify tests, fix issues and implementation errors; Validate all tests

Review of Ogre theft incident report; Dispatch report to FBI and provide comments

Further bug fixes and simplification of tests; Fix testing framework README and documentations (#273, #274, #282, #283, #279)

(Continued)

(Continued) and fixing red packet, upgrade core library for intelligently flow with commands, fix issues with core flow

(Continued) and debug, testing, live testing in production of key features related to command; Validate security patch and implications

Merge conflict resolution with testing branch; Validate and review tests and test framework

Ogre theft incident investigative report (report #4)

Use command library whereever applicable; Unify commit-reveal

(Continued) Implement command library in core flow

Security issue (#276); Event parsing library issue (#277); Command library issue (#278); Verifying Reliable Relayer (#259); Security Vulnerability (#253); Testing (#279); Test Framework (#282); Test Coverage (#283) Self-hosted RPC nodes (#281); Deliverable documentation and organization

Response team briefing

Command library design, implemetation, debugging

Manual querying and analysis of all possible DFK contract addresses for theft investigation

Sync with John on testing; Fix two security issues (#275)

Continued research and design on proxy mechanisms and same-address upgrade (#189)

Debug and fix issues with command; Add command tests; Finalize security patch #275

Relayer overall error handling improvements; Better handling of cases when a contract is already deployed 

Continued research and design on proxy mechanisms and same-address upgrade (#189)

Ogre theft incident investigation (establishing theft amounts and events)

Local testing and debugging, and documenting solution to Safari HTTPS issue

Sync with Tao on various PRs (WalletConnect, TransactionViewer, hotfixes) and frontend development issues

Response team briefing

Research and design on proxy mechanisms and same-address upgrade (#189)

(Continued)

(Continued) review and next steps for (#251)

Review and detailed feedback on Testing (#263)

Sync with John and resolve key testing development issues

Ogre theft incident investigation

(Continued)

More powerful and consistent log parser; Add message template and amount formatting capability in event library; Transaction viewer rendering fixes and use event library; Fix issues with parsing external payments; Update TODO; 

(Continued)

Review staking (#268) and detailed feedback on testing (#263)

Review of theft incidents related to Ogre and others

Transaction viewer: review, feedback, and planning (#251); Merge conflict resolution; new APIs for RPC methods 

Transaction viewer fixes, transaction log parser fixes, support multiple events per transaction, fix staking events; Show commit transactions; Fix display pagination errors; Zero-day vulnerability research and its relation to theft incidents

MetaMask Security Protocol Review

Response team briefing

Sync with John

Sync with Timeless regarding NFT and MADNFT

Review and debug testing issues (John)

Review of Timeless response to security issues; Review Timeless Merkle Tree creation implementation; Experimenting and debugging with different collect reward reveal implementations

Condensed Q1 assessment

Sync with Tao and discuss next steps of developments

Sync with cylim on next frontend developments

Transaction viewer (#251) review and cleanup

(Continued) Unstake functionalities, debugging, testing

Collect reward page for staking; Common components; Fix bugs related to collect reward; Simplify utility functions; Compute funds available for redelegation

(Continued)

(Continued)

2022 Q1 Summary and Assesment

Response team briefing

Simplify reveal calls; Remove dependency to Harmony JS SDK and providers; Fix provider setup for resolver contracts; Fix bugs related to operation code; Fix Enums.OperationType.UNTRACK executor logic; Event hash script update and new events related to staking; Working version of Staking from UI; Use websocket for truffle executions

Staking api and its own rpc base; Improved staking UI, Stake table and reward display; Integration into main UI; Review Timeless custom implementation of Red Packet

Theft investigation suspect finding review

Follow up meeting from Protego (Projext X)

Sync with Timeless regarding upgrade and tokens

Staking client-side implementations, contract improvement, and debugging

Relayer, deployment, scripts updates related to Staking; Sync with John; Sync with Timeless

Theft Incident Analysis, Continued

Relayer debugging, and retry and gas fees patch for more robustness 

Theft Incident Analysis, Continued

Sync with John

Staking functionalities in contract

(Continued)

Theft Incident Analysis

Chrome Extension Build and Review; Follow-up from Erfan (Projext X, NFT anti-scam project)

Response team briefing

Theft Incident Analysis, Continued; Sync with John (5pm)

(Continued)

Probablistics self-recover multi-account relayer implementation, experimentation, deployments

(Continued) and review, merge #265

Timeless initial source code review and initial security issue analysis

Meeting with code4rena (crowdsourced audit)

Testing PR review and feedback (#263); Chrome Extension hash review and debugging

Debugging, testing, and confirming Chrome Extension Build 1.2.7; Theft amount review

Relayer debugging; Manual resets and devops scripts; Experimenting with local setups and various RPCs

Theft incident cause analysis; Contract staking implementation review; Adding staking contract; Remove cached Truffle artifacts; Relayer issue analysis and feedback

Recent theft incidents review and follow-up

Experimentation with Ganache CLI setup and migration from UI version; README for env setup

(Continued) and produce findings and next steps; Remove Harmony provider and use of JS SDK

Chrome Extension buidling, review, and debugging

Further experimentation and deployment of using websocket providers; Review and merge #261

Chrome Extension further testing and debugging

Relayer and RPC debugging and experimenting

Relayer use managed nonce and overall improvements

Analysis of relayer logs and interactions between relayer and Harmony transaction pool

Chrome Extension building, build error fixes, and hash difference investigation; Celo incident research

Sync with John

Next generation UI review and planning (#260)

Relayer error analysis and debugging

Analysis and feedback on Shashank's Security Review Analysis

Sync with Shashank; Review of minor implementation flaw identified

Debug and fix constant variable references; Response team briefing; 

Sync with SilentAuth

Chrome Extension review, building and end-to-end testing; Relayer monitoring; Review and feedback on transaction viewer (#251), , truffle-removal changes (#240) and fix errors; Domain update functionalities Q&A

RPC reliability investigation and analysis; Sync with Timeless

Response team briefing

Briefing with John

Code review and testing of extension wallet patch #124

1wallet core / web edition planning and work organization for March

Response team briefing and discussion on next steps

(Continued)

Evaluation of Numisme (Project X) and discussions

Joint evaluation on Project X prospect "FDIC for Wallet"

Theft amount verification and correction

Response team briefing; Review of Quoc's extension wallet final report

Sync with Timeless: roadmap, planning, NFT, campains, adoption strategies, technology discussions 

Initial engagement with mycryptomine on 1wallet integration and feasibility evaluation

Joint evaluation on Project X prospect Panther Protocol

Preliminary evaluation on POQ (Project X) and its legal materials (SEC letter, conclusion and patent)

Term finalization meeting with C14; Scheduling with remaining Project X prospects; Term finalization with Protego

Preparation and joint evaluation of Project X prospect Cedar

Project X decision meeting and sync up

Research and analysis on Panther Protocol (for Project X)

(Continued)

Silent Auth detailed proposal additional feedback and questions

Diligence meeting with Deepwaters

Statement of Work clarification meeting with Coalfire 

Preparation and semi-joint evaluation of Project X prospect Shift

Diligence meeting with Project X investee C14; Research and diligence on C14 thesis

Research and technical diligence on Project X investee Deepwaters

Joint evaluation of Project X prospect HOPR

Research and independent evaluation on MetaLoop; Sourcing Project X leads; Analysis on Webacy

Joint evaluation of HexaTorch

Research and offline evaluation on Project X prospect Cytus

Preparation and joint evaluation of Project X prospect Protego

Joint evaluation of Project X prospect Deepwaters

Project X deal sourcing (Xoogler meetup #2)

Evaluation of Project X leads

Joint evaluation of Project X prospect Gryphon; 1wallet design sync with Darren

Joint evaluation of Project X prospect C14

Sync with FBI (with Merkle Science)

Project X deal sourcing (Xoogler meetup)

Evaluation of Project X prospect DSCAPE, meeting, and internal discussion

Sync with Merkle Science on Tornado Cash findings

Response team briefing

Evaluation of Project X leads (Xoogler Demo Day projects)

Evaluation of Project X leads

Sync with private investigator regarding suspect

Response team briefing

Sync with Timeless; Adjustment of 1wallet v14 RPC endpoint; Performance tests and analysis

Revisiting zero-day and UAE vulnerability; Internal discussions; Victim password strength review and analysis

Response team briefing

Response team briefing; Investigation on new victim (GU); Emergency response

Malware analysis and risk review

Silent Auth proposal evaluation and feedback

Onboarding Michael M and discussions

Anchain finding presentation and discussions

Malware investigation

Theft case investigation (lead from Binance related activities)

Response team briefing

Finalization of "Use Ethereum NFT on Harmony as Avatar"

Sync with Coalfire

(Continued)

Review and experimentation of Matthew's vulnerability report #1

Revision on "Use Ethereum NFT on Harmony as Avatar"

Receivng updates from AnChain and discussions of issues and next steps

1wallet, project document: Use Ethereum NFT on Harmony as Avatar

Response team briefing

New victim browser history analysis (BL, DD) and manual inspection of all common sites

Investigation and analysis of reported suspicious Ethereum trasanction and contract address that invokes Harmony bridge

Initial engagement with Merkle Science

Research and feasibility study on amount-matching based Tornado Cash tracing techniques and past success stories

Extension production deployment and hash-verification step-by-step guide; Quick analysis of new victim / incident

New hackathon victim interview, analysis, and recommendation; 1wallet - engagement with Meson team (cross-chain stablecoin bridge integration)

Victim interview and Q&A call (DD)

Response team briefing

Sync with Silent Auth

Response team briefing

Coalfire initial engagement and scope discussion

Onboarding Matthew for extension wallet vulnerability investigation

Reproduction and verification of Quoc's extension build; Review of private investigator preliminary report

Victim interview and Q&A call (BL)

Response team briefing

Response team briefing

Discussion Matthew for extension wallet code analysis

Experimentation with XSS vulnerabilities in Vue; NDA with SecureLayer7 / Cure53

Analysis of new victim profiles and priorities (unassigned code names)

VueJS injection vulnerability experimentation

Private investigator initial briefing and preliminary assignment of work

Response team briefing

Report #3 on theft incidents (New Victims, Perpetrator Tracing, Previous Victims, Suspect, Backend Server Log, Frontend Fingerprints, Total Economical Damage); Analysis of linkage between attacks on multiple victims 

Response team briefing

Sync with Sukanta and internal discussions

Secureworks second and final engagement (not to proceed)

Engagement with red teams and security firms; Review of all victim and perpetrator addresses, blacklisting states, and movements offunds; 

Secureworks initial engagement

Response team briefing

MyContainer incident review, analysis, and discussion

Engagement with private investigators and preliminary exchange of information

Chrome extension wallet PR 117 review and testing; Sync with Quoc

Sync with Anchain; Response team briefing

Response team internal discussions and planning

(Continued) Merged and launched v15; fix 6x6 restore failure after a wallet is upgraded and renewed from v14; Full release notes;

Deploying v14 and v15 relayers, setting endpoints and system services; Monitor network stability and debug related issues

Response team briefing; Victim counselling procedure consultation (MN); Further investigation into fingerprints and transaction patterns, based on new data collected from new victims;

SecureLayer7 / Cure53 engagement and initial briefing; Internal discussions; 

(Continued) check whether wallet hasSuperOTP; Fix issues with upgrade to v15 wallet; clear otp input only when it is nonempty; Restrict non-v15 wallets from adjusting limits; Blacklist some recovery addresses and make 1wallet DAO their recovery address during upgrade; keep react component loaded during restore to ensure wallet parameters are properly passed; Ensure worker parameter has seed; move debug message to debug mode only; Add innerRoots check on localExport; Add fallback params in Upgrade; Use api.harmony.one RPC by default; improve messages related to emitted events; fix metamask tool; remove Chrome extension wallet from readme; Improve renewal messaging; Fix an issue which may cause multiple workers to be created; 

Chrome extension wallet incident response: new victim profile (MN), investigation, internal discussions; Emergency responses; Tornado Cash tracing and matching patterns against known hackers and victims

(Continued); 1wallet: Fix some issues which may cause renewal to malfunction or incorrectly make wallet "expired". Fix worker spamming logs; More granular messages and instructions when user access functionalities that require renewed / upgraded wallets; Make upgrade box promptable; Fix a bug in renewal which causes the process to stall; Fix a bug on renewal which old core parameters are used, in lieu of new ones; Implement early terimination to enable much more efficient calls to deriveSuperOTP; Fix zero-valued effectivetime in renewal; 

abortion mechanism in event message; Core lib: EOTPDerivation; core util: genOTPStr (for efficient debugging when multiple OTPs are required); Add more verbose logging to relayer; use EOTPDerivation in relevant functions; Revamp spending limit prompts and checking mechanisms; fix bug in remaining limit display in balance page; Fix renew-now link

better organized renew page

fix truffle distinction between dev and ganache; core lib: add sanity check of parameters to makeCore; CoreDisplaced and CoreDisplacementFailed error handlings; use oldInfo's (i.e. previous security parameters / OTP roots on contract) effectiveTime on deriveSuperEOTP; More structured frontend infrastructure utils (useSuperOps, useOpsBase); Fullly functional renewal for v15

AnChain sync; Response team briefing; Sync with Quoc; Analysis of possible scammer/imposter and linkage of hacks

1wallet: core flow util: deriveSuperOTP; use deriveSuperOTP in RestoreByCodes; fully functional spend limit adjustment component; 

Response team briefing; New victim analysis and next step recommendations (MC); Formulation of special process for large accounts at risk; Internal discussions

(Continued) Interview with owners of large accounts at risk

Review and debug 1wallet #228 (bundle size reduction), #241 (hotfix of missing styles); Fix bug in core processing util (missing array initialization); Increase timeout in response to RPC instability; Utilities for intelligently producing wallet name hints and make use in every place where names are referred; Create wallet component shared functions regarding before/after commit and preparing proofs; Rearrange balance and spend limit components; Spend limit adjustment components; 

(Continued)

Response team briefing

1wallet QR parser: deduplication; write secrets to separate plaintext files; fix some messages and bugs

AnChain sync and report discussions; Response team briefing; New victim interview (MC); Internal discussions

Response team briefing

Review and analysis of AnChain report; Internal discussions

1wallet v15 pre-release notes

Blacklist log analysis and discussion; IP and fingerprint tracing and analysis; Further extension code review

1wallet design review and sync with Darren

Response team briefing; Node leader log processing

Re-evaluation of staked asset migration plan and internal discussion; 

Response team briefing; FBI Sync; Extension code review on miscellaneous areas; Evidence gathering, preparation, and analysis on suspec;

(Continued) Tornado cash activity tracing on latest victims; Expansion of fingerprint tracing and IP tracing; More fingerprint analysis

Report #2 (Additional Victims, Frontend Tracing, Backend and RPC Tracing, Log Analysis, Suspect Analysis, Background, History, Interview and Evidence)

Further analysis and investigation into iframe embedding vulnerability; Analysis of property-getter override vulnerability and scope of impact; Security analysis using runtime (minimized), cross-compiled code; Internal discussions; Further IP tracing and fingerprint tracing

Response team briefing; Analysis of IP tracing and linkage of attacks; Analysis of new victim profile (O), browser history, and recent transaction history; Suspect investigation; Extension wallet deprecation planning; Internal discussions

(Continued) Suspect investigation and interview with relevant personnel; Chrome extension security expert engagement; Damage mitigation planning and briefing

Create, configure, and deploy thiefmonitor - server-side application that continously monitor transasctions from any set of addresses, and sending structured email alerts; Fingerprint and ProtonVPN analysis

Response team briefing and internal discussions; Review of Quoc's initial report on security vulnerabilities in extension wallet

Fingerprint tracking and internal discussions and disambigution

Extension wallet clickjacking and iframe embedding issue reproduction and investigation; Demonstration and further exploitations on the issue; Internal discussion; Sync with Quoc

1wallet QR code parser 

Research and analysis on npm dependencies vulnerabilities and automated tools for such analysis

Responses team briefing; Briefing with Quoc and onboarding; Aggregation and labelling of victim/hacker related addresses and transactions; Discussions and investigations on npm dependencies and potential vulnerabilities; Fingerprint tracking setup and discussions

Tracking and analyzing fingerprints in realtime; Cross-checking existing and new-found vulnerabilities with Quoc; Internal discussions; Review and feedback on hacking incident announcement blog; Investigation and analysis on post-incident interactions between victim and people with suspicious behaviors; 

(Continued)

Research and analysis on new victim's report (J); New questionaire design; Further browser history analysis and pairwise comparisons among existing victims; Internal discussions

Victim interview (J) and post-interview analysis with detailed report; Transaction hash and signature recovery / verification and discussions on the discrepencies

More research and analysis on use-after-free vulnerabilities and their potential impact on extension manipulation and private key safety; More network traffic analysis

Research and analysis on (1) Chrome flags' effects on extension security (2) tracking the existence of extension log and possible ways of using them

Tracking unexpected movement of victim funds (J, DK) and result of suspension mechanisms; Internal discussions and analysis; Research on methods of tracking hackers

Further analysis on local storage encryption strength and end-to-end code review; Comparison against MetaMask code and local storage encryption strength; Analysis, report, and internal discussions; Hacking transaction analysis, r,s,v signature analysis and transaction signature's relation to choice of wallets and RPC endpoints

Analysis on potential DNS vulnerability on Netlify and Staking Dashboard; Internal writeup and discussions; Analysis on security of extension build process, and recommnedations; Analysis of event queue processing system in extension code; Hypothesis on potential ways of attacks; Internal discussions; Review of potential hacks

Response team briefing; Validation and Aaalysis of RPC log 

More validation and analysis on RPC log; Code review on extension active-tab handling and tab-locking mechanism; Analysis and discussion on potential issues

Review and suggestions on incident announcement blog; Heap analysis on memory footprint of private key; Local filesystem analysis, research on extension versioning, event logging, and local filesystem footprint; Fine-grained network traffic analysis and capturing; Frontend fingerprint initial analysis; Internal discussions 

(Continued); 

Response team briefing; Runtime extension JS code analysis and interaction with localStorage; Internal discussions on risk and vulnerability

Bridge transaction analysis and gas usage analysis; Internal discussions

Staking dashboard code review and analysis; internal discussions; Common browsing history analysis tool; Report on common browsing history of victims;

Response team internal briefing; FBI group meeting regarding the incident and formulation of next steps

Research and analysis on bruteforce difficulty and local storage encryption strength; Hacker tracing discussions

Research and analysis on Chrome zero-day issues in 2021 and its role and potential impact in the hacks; Hacker wallet and transaction analysis

Extension code review, exception handling vulnerability analysis, writeup, and internal discussions with Jenya

User agent analysis and discussion; More code review and research on exception handling bulnerability (e.g. potential danger of stack leaking private keys); Simulation of exception under abnormal condition and using debug tools; Internal discussion and writeup

(Continued); More hacker transaction pattern analysis; 

Report appendix; Response team briefing and analysis

Chrome Extension Wallet code review: event listener usage and internal API flow

FBI initial briefing

Meeting with Shashank on 1wallet analysis and planning, Chrome Extension incident, and Tornado Cash tracing

More extension code review and analysis (use of local storage and Chrome synced storage, safety of storage usage, research)

Report editing; Aggregation of sate police reports; More code review; Internal briefing on law enforcement engagement

Chrome Extension Wallet emergency response and forensic analysis to crosschain movement of funds; Analysis of victim profiles (W, T, R, S, A)

Hacker transaction pattern analysis, Tornado Cash transaction review and tracing; Slowmist engagement and briefing; Staking dashboard and Chrome Extension Wallet version freezing and runtime code sampling

Chrome Extension Wallet incident analysis and report, #1; Whitehat hacker engagement and briefing; Victim profile analysis and identification of common traits

(Continued)

ZKU - dark forest assignment research, design, writeup, and validation of feasibility

Review #224; terminate random worker on unload; more consistent getWallet return value format; add versioning comments for api create; contract: allow DISPLACE to occur with single core when innerCores are unavailable; move contract-code acquisition to routes; set gas limit for factories; Make Upgrade component compatible with v15; 

(Continued)

Review #222 (event notifications), #227 (lazy load); Restore: filter id keys for only ecdsa public keys; remove hardcoded addresses for deploy; core flow: separate out deriveEOTP and related functions for external use; relayer: log address of newly deployed lib; Fix event notification messages; 

(Continued) use .recovery1wallet for recovery files; Use localIdentificationKey to find the right layers to export in local export and import; use new wallet proto in import/export; uniformly use uint8array for secrets/seed; core: use backward compatible init counter value; duplicate seed arraybuffer on processOtpSeed; 

Review #219, #225, #226; Resolve merge conflict; Fix wallet auto-migration; Use new wallet persistent state layout for restore; auto migrate global state; Cleanup secret-leaking debug message; 

Use two-word names and a simple timestamp for wallet names everywhere; Display creation QR code using timestamped wallet name; Restore explanation update; Properly handle wallet names without timestamps and use wallet names with timestamps to guide user selecting the right auth code to use

Auto-load identificationKey from blockchain for wallet initializations; Update core API and instantly initialize all contract instances without Truffle verification; Add more debugging messages in commit-reveal flow; Add debug method in message interface; Adjust camera scan delay;fix a bug where deleteRoot is not deleting tree from storage; added cleanStorage util; Call cleanStorage on wallet list init; fixed a bug where wallets might not be initialized before purging; Use WalletCreateProgress to highlight in-progress stage for wallet creation; Improving guides for Google Authenticator export guide; Show proper wallet names for info pops; Allow workers to build inner trees and add such an option; Use identificationKeys to identify tree to use in core commmit-reveal flow; Make RestoreByScan fully functional; Store localIdentificationKey in RestoreByCodes

InnerCore tests with snapshots; Fix bug with core construction util; innerCore retrival from contract; RPC config through env; Fix issues with wallet proto; Local export wallet with name; Fix initialization issue in OTPSuperStack; Fix focus issue with OTPStack; Fix various update and functional issues with restore-by-code, sync recovery file, and setting up new code while restoring; Recompile contracts; utilities for retrieving and processing core s ettings from blockchain

(Continued)

EOTPBuilder for encoding multiple OTPs; Exposure of util API in browser; Fix unsynced component data in restore-by-code and set-up-new-code flow, and exception handling; Testing and debugging the flows; Handling local layer storage after the flows

Properly auto destroy workers; Auto-cleanup unused inner trees; Override versions in API calls during restore; Add ability to override versions in core libraries during commit and reveal; Debugging notifications for expected OTP, restore process, and other critical steps; Testing and debugging all restore methods

Continued testing and debugging, and fixing restore issues; Fully function restore-by-code, end-to-end

refine wallet proto; separate restorebyscan component; refine syncrecoveryfile; refine recovery pages and restore pages

Test and fix various issues with Restore: using recovery file, local import, and some compile issues; Review QR code scanner hotfix (#223)

Customizable RPC endpoints in client; env sample; Fix fallback values in new persistence state layout; Build thief hunter - tools for batch scanning websites that potentially interacts with Harmpny Chrome Extension Wallet; Config the tool and acquire initial scanning results for all validator's websites on mainnet and testnet; Analysis

Review and testing of state refactory part 2 (#212)

(Continued) Bug fixes with core apis with respect to v15 changes; Cache creation code per network; Fix relayer parameters with respect to gas usage to accommodate higher gas consumption in v15; Fix potential errors of component rendering in case of network or wallet errors; Rewrite restoration option messaging and layouts

State persistence final review and debugging (#199); Export feature review, debugging, and improvements (#202)

State refactoring review and conflict resolution (#209); Further state refactoring cleanup and improvements

(Continued)

(Continued) Wallet restoration proto definition; Better restoration guide; Embed predicted address in QR code during creation; OtpSuperStack component; Core library that supports v15 core construction and computing restoration eotp; State management with cache; Component implementation for restoration by 6x6 codes and recovery file handling

Review staking dashboard code injection issues and identify possible places of injection

Review of Chrome Extension Wallet code for vulnerability and further review of staking dashboard

Presentation preparation and rehearsal

Fix liquidity, estimation, execution, and errror handling issues with Swap

Initial review of staking dashboard code for security issues

Review and debug an issue with swap such that estimate may be off and swap may fail for some pairs (#204)

(Continued)

More wallet restoration methods

Review, debug, and test address book changes (#200) and persistent store and synchronization improvements (#199) 

(continued) talk preparation

1wallet presentations and summary

1wallet short presentation

(continued) presentation appendix

Status review and updates

Client: adapt to new creation flow, compute inner cores in workers, and store appropriately; Optimize inner core tree heigh; Allow relayer to be more adaptive to arguments; Experiment and reduce wallet creation duration

Spend limit tests; Various hash computation utilities in core lib; Relayer default spend limit values; Contract: categorize reveal hash compute functions

(Continued) fix core displacement contract bug; pass most significant inner core related tests (core displacement); add null operation parameters and update various other constants;

Pass additional tests for post-core-replacement operations and transfers

(Continued) and fix bugs in recovery using inner cores

Core construction utilities; refactoring tests

Improved test flow; commit-reveal utilities for larger scale tests; inner core tests; Make tests use salted creation procedure, run deterministically, using separate creation seeds

Core library: efficiently building merkle tree with inner cores; inner tree generations; interlaced sha256 hasher

Make all core tests work again; Make new test utils for common procedures (creation, tree generation); Improve tests; Improve core libraries and fix bugs introduced by inner cores

Make most tests use test utils; Factory tests; Make tests use factory; Add more encoder, decoder, and utils in tests

(Continued)

Core: make OTP seed dual purpose (also serves as private keys), re-work identification hash to comform with public key formats; Completely reworked relayer initialization code;

(Continued) fix several issues with factory and deployer helper; fix issues with relayer deployment using factory;

(Continued) and factory helper, identification hash mechanism for permanent recovery capability, ecrecover on identification hash on contract; major refactoring and structure optimization of contracts

Recovery and Version libraries; Bolster TokenTracker library; Reduce main contract size by 40%; Improve ENS domain and subdomain libraries; Optimize WalletGraph

Core structure enhancement; Setting up inner cores at initialization; Authentication logics against inner cores; Two levels of daily limit adjustment functionalities; Detailed description of design and variable purposes in comments; Relayer new formats for creating new wallets; More efficient commit and reveal from relayer

(Continued)

(Continued) and analysis on upgrade mechanism and future directions #189

Predictable address, 1wallet deployment factory, (#172) research on proxy upgrade (#189); Bug fix: recovered wallet is stuck in wallet list

Planning, updates, implementation proposals and analysis, and milestones (#189, #190, #191)

(Continued)

Using Harmony Safe with 1wallet: create, deposit, and swap tutorials; ETH bridge report discussion; BTC bridge initial review; Unstoppable domain initial review

Fiat on ramp refacotring and customized currency selector; Allow skip upgrade version and fix layout bugs

(Continued) Self-code review and address review comments; Fix bugs in new reveal mechanism on multi-core authentication and recovery authentication;

Revamp upgrade messaging and experience

(Continued) Revamp Extend infrastructure; Script utilities for event and topic hashing; Core API for retrieving old cores; Root management utility and deletion utlities; useWallet and various common components; Contract revamp to allow authentication against old cores (old authenticator roots and times); Firelayerinitialization on Ganache; Wallet expiration checks; Wallet root checks and multi-device check

(Continued) Core library: support loading old roots; Experiments on validating new root and old root belong to same seed

Recovery expiration checks; Recovery frontend bug fixes; 1wallet DAO change; Extend frontend infrastructure, core library hash utilities

(Continued) Extend operation implementation and testing

Minimal wallet setup components; Extend wallet frontend infrastructure;

v14 WIP: core replacement logics, new reveal libraries, refacotring contracts to conform size limits, simplifying codes, testing; Timeless integration discussions on upgrade, review of alternative approaches in other projects, and discussion of various integration issues

(Continued) Batch operation support; Relayer upgrade for contract caching, better logging for requests, backoff-retry initialization,

Timeless integration: analysis of onboarding issues, suggestions, tentative solutions and improvements

Analysis, proposals, and planning for wallet renewal (#171), predictable address (#172), and 1wallet light client (#174)

(Continued); Timeless integration and 1wallet library customizations

Ethereum trustless bridge audit: more analysis on correctness of MPT membership test implementation in libraries

(Continued) Merkle Mountain Range related implementations review and analysis

(Continued) and all remaining components and libraries except ethash. Analysis on TokenLockerOnHarmony and concern over lack of MMR

Milestones, progress and development summaries, planning, public pages, and research on various issues (fiat, Apple Pay, library integration, NFT)

Ethereum trustless bridge audit: code and design review (EthereumProvder, Harmony Prover, Merkle Patricia Tree inclusion and exclusion tests, alternative MPT implementation, javascript invocations and example usage, analysis on fork resistance)

Transact integration implementation, testing, bug analysis and sync; End-to-end staging and production tests

Re-work notifications; Commit-Reveal progress experience improvement; Mobile experience improvement. Warning for sending to custody-wallet addresses; More #116

Cache global usage stats on client side; Resolve stats count issue (#162)

Trustless bridge contract code review, analysis, feedback; Comparison with trusted bridge implementations

Sync and feedback on Timeless Wallet integration technical issues; Implement fixes for issue #166 and the underlying issues (identifying post-recovery wallets, prevent infinite loop, show warnings, etc.)

Analyze and fix QR code compatibility issue (Haodi) and Google Authenticator version history

Sync with Transack. Preparation on Transak integration. Plan and acquire resources needed to enable ONE / USD purcahse; Sync with Timeless on fiat integration

Trustless bridge script code review and analysis

(Continued) and address issue #166

Sync with Harmony team re: domain services and use cases

Transack integration review and application (#155); Analysis, planning, and feedback to Timeless regarding fiat integration and Apple Pay

Wallet as Safari extension (macOS 12 / iOS 15) debugging, build, research, analysis, and experiments

Trustless bridge review; Review and feedback to security risk raised by Shshank (re: forging commit); Issue #164

Tools with individual URLs and guides; Investigation, analysis, and guidance for issues encountered by Harmony DAO grant recipients; Issues #165, #164; expert mode support for grant recipients

General integration advice and debugging and resolving Timeless address conversion issues in Python and Swift

(Continued)

(Continued)

Even mapping extraction scripts; Issue #161, cumulative analysis and debugging; Debugging and fix issues with using old wallets; Dev state dump tool; Remove recovery on recover screen when recovery address is not set; Fix infinite loop on connect; Fix NFT tracking on mobile; Gnosis Safe integration contract interaction debugging and tests

Gnosis Safe SushiSwap Transaction encoder tool; Functional Gnosis Safe SushiSwap end-to-end flow; Improve Swap mobile experience; disable mobile autozoom; add paste button on mobile OTP input; fix global usage stats overflow (use abbreviation); always show address options on wallet title; Hex options on wallet address components; allow displaying and choosing old wallet address and hex addresses in app connect screen

Timeless integration and 1wallet library sync

Generalized method for contract and method verification during app call; Tools for add Harmony protocol in MetaMask and to open Harmony Safe; Issue #161

Gnosis Safe code review, development tracking, security analysis, and identify potential backdoors

(Continued)

Fix upgrade OTP confirmation bug; Auto copy on address format switching; Mobile friendly wallet title; Auto-spawn temporary old wallets during app-call if needed; Store old wallets in state persistently; 4s retry interval; favicon; Simplified, minimal call screen

(Continued)

Release v13 (#160); Release notes; Simplify OTP confirmation flow; auto-verify domain in both directions; Fully functional Inspect and Reclaim features

Ability to inspect old wallets; Improve wallet About screen; improve Sentry event capturing; Debug IPFS issues and improve NFT visualization robustness

Ability to reclaim domain and tokens from old wallet, debug and testing; Sensisble layout and interactions on wallet about screen; Unify row components; Fix bug with wallet purge to prevent purging partial proofs which are still used by at least one wallet; NFT gateway and display stablity debugging; Reclaim reverse domain

List top 9 ERC-20 assets in wallet home screen (#158); Simplified app-call flow (#159); verify callback domain and whitelist contract and methods (#159); call data decode utility (#159); Hide temporary wallets for app connect. Test and debug Gnosis Safe integrations

Gnosis safe integration debugging on multiple environments; Analysis of causes for wallets gone missing

Support Aegis authenticator (#151, #157); Debugging wallet gone missing and bugs in purge routine; Use simple create flow in side menu; Tolerate 30 delay of OTP code;

(Continued); Released v0.12.4

Fix issues that may cause inconsistent state; Diagnosis and debug with Jenya

Gnosis integration finalization with Jenya and demo

daVinci NFT purchase IPFS issue further research and adding materials for loading state

Gnosis integration debugging; Diagnose issues with Jenya arising from local inconsistent state and old wallet version as part of Gnosis integration;

Safeguards and tests against using incompatible wallet versions for integrations

Track and untrack tokens, NFTs; Direct integration with daVinci and customization based on its unique IPFS, API, and file formats; Mobile view

DEX and hackathon integration assistance; Fix a bug where integration calls with zero send-amount would not function;

Allow integrations to make binary calls directly via hex data

Assist on #149, #150, research on #151 and 1:1 integration guidance following #149

Debugging; fix a bug which may cause wallet listing screen to run into infinite loop

(Continued) and fix the underlying cause of the inconsistent state, ensure double otp to work properly in future versions, and add fallback compatibility / auto-fix for restoring older, inconsitent versions

Offline event feedback review and analysis; debugging

Fix issue #147, #148 (error on restore when local double otp state is inconsistent)

Tests, research, and analysis on various browsers and incognito modes

Allow advanced settings for red packet (custome message, random factor); Measures to reduce errors from claiming red packet, and show urgency; Relayer error analytics and report; Diagnosis and deep parsing of errors reported by people at offline event

Fix Android failure to scan QR code issue; Automatically cleans up invalid or expired temporary wallets; Enable wallet to display a QR code of its address recognizable by 1wallet QR code scan and general camera scan; Intelligent camera selection for all scanning and mobile support; Enable 1wallet to scan QR code and recognize various formats and intents; Simplify prompt and process to save address for new user onboarding; Added a default, not-owned NFT so new user can experience collectibles; Review and revise haolin's work on QR code image upload; Fit and organize all new features; Various high priority miscellaneous user experience issues

Fix QR code scanning error message spamming issue; Added support for scanning red packet QR code; Finalize wallet restore entirely on mobile and making video tutorial; Various discussions, debugging with online users who had issues and those reported at the offline event

Unwrapping red packet: end-to-end, debugging, and live testing; Smart contract upgrade on nonce and operation time exposure; Various reusable frontend infrastructure component for NFT tracking, display, and management

(Continued) First functional red packet creation, end-to-end; Fix issue with not showing commit-reveal progress correctly whie sending tokens; Fix issues with address labels; Make several critical modules shared, exported components; Fix several library bugs (multi-call encoding, etc.)

(Continued) and research and experiment on Android Google Authenticator issue (#136); Discussions; Refine red packet implementation, flow and debugging

Red packet: Gift tab in wallet; Simplify onboarding messages; Make onboarding QR code intuitive for tapping; Substantially simplify onboarding messages; Added paste-from-authenticator button for mobile view;

(Continued)

Release v0.12.1; Make all existing components work with spending limit and newly refactored wallet smart contract interfaces (core library, relayer, api, Send, Swap, About, and various other modules)

Fix a bug that prevents automatically transfer of tokens upon upgrade (#133)

Red packet design and analysis of alternatives; Complete, detailed implementation and design proposal for red packet; Discussions and open questions

Extending daily limit to spending limit and spending interval; Smart contract library: SpendingManager; Refactor wallet smart contract and upgrade constructor and getters to be more compact and informative; Analyze Harmony Java SDK and resolve Binance withdrawal issue

More special handling on HarmonyPunk (#128)

Resolve miscellaneous address issue (#130) Further discussion with Binance on withdrawal issue; Relayer: deploy new library contracts only when necessary; NFT: get header only when necessary;

Release v0.11.1; Make Swap available to all; Limit contract call operation to respect spending limit; Remove extraneous warnings; Make swap obey spending limit; Fix bug in Wallet Graph library that causes command operations always to fail; Make commit-reveal pace faster; Hide double OTP by default; Added expert mode, which allows the user to use double OTP and freely adjust spending limit

Scripts for listing 1wallet deployment transactions and inferring their addresses

Miscellaneous fixes (HTTPS certificate, protobuf generation; context menu of onboarding QR code upon tapping); Experimentations on non-standard Google Authenticator settings; Binance withdrawal issue (#127) investigation, reproduction, discussion (9:30pm)

Review of Red Packet admin tool proposal, elaboration on NFT metadata and TODO for red packet NFT, and IPFS

Address user experience issues reported by Boris; Special processing for displaying Harmony Punk; Always show full address and address-tools on header section in desktop view

Support for video NFT

Address critical security vulnerabilities with commit-reveal (#47); Constant-time commit lookup (#3, #4); Implement suggested contract optimizations in Common Prefix preliminary report (immutable variables, unchecked arithmetics); Added NatSpec compliant comments in contract code; Fix an issue with incorrect key computation of tracked tokens; Unify all reveal operations into a single function with different operation types;

OTP Input and Refocus code review + revision + bug fixes; Provide feedback; Fix missing name issue for some ERC721 tokens

NFT Grid, support for both ERC721 and ERC1155, share same underlying token abstraction with ERC20; Support image, animation, and metadata rendering; NFT details toggle; Responsive grid; End-to-end debugging and testing for tokens; Upgrade versions and warning messages for older clients; v0.3 release; Separate view and filtering for ERC20 and NFT grids; Support sending NFT through existing transfer UI;

Token and NFT experimentation and debugging; Client API implentation for token operation

Research on daVinci market; Client: ERC20 grid; Token assets manager; Unified token key compute utility; In-browser IPFS retrieval analysis and benchmark; Client API initialization for token contracts and metadata, and API implementations for metadata retrieval and balance checking for token and NFT contracts; Refactor and modularization of client wallet components; Smart contract support for Override-Track capability; Smart contract optimization for universal deployability (<24K); Smart contract multi-track capability; Client side state management (reducer, saga, actions) for tracking tokens, token balances, and currently selected tokens; Direct support for well known ERC-20 tokens; Infrastructure support for tokens with custom decimal settings; Unifty bn.js dependecy; Multi-network support for token operations and views; Token operation hash and commit hash utilities, and debugging; Auto chaining and auto refresh token balance after commit-reveal flow; Support sending tokens; fix bugs related to reveal token operations; Distinguished UI for sending tokens (re-used from sending ONEs); Various bug fixes; Complete flow demo + verification;

(...many weeks passed. see open dev log)

(many weeks passed, content omitted. see open dev log)