Security and threat model

Security: the threat model, in fullBoard: Infrastructure · sticky

Moneyero

Hero Member

★★★★★

Activity: 0.1
Merit: honest
Online

Security: the threat model, in full« on: today »

In plain words: who could be watching you, and what this app does about each of them. Anything not on this page is not protected.

The short version

People reading the Solana blockchain. They see all your trades. Nothing can stop that. The app keeps your trading money separate from your savings so the trades do not point at the savings.
People reading the Monero blockchain. They see nothing useful. That is the whole reason Monero is the savings account.
Websites and servers you connect to. They see your IP. The built-in VPN or Tor fixes that for everything the app does.
The swap service. Sees the amount and your Monero address, and your IP unless the VPN is on. The app shows you this before you pay and rates them on whether they ask for ID.
Your internet provider. Sees where your traffic goes, not what is in it. The VPN hides the destinations too.
Someone who steals your laptop. Everything is encrypted with your master password. Use full-disk encryption as well.
A virus on your computer. Not protected. Nothing can protect a wallet on an infected machine.

The full table: adversaries, ordered by how well they are handled

"Partial" means the mitigation exists and depends on your configuration or on third parties.

Adversary	Capability	Protection	How
Chain analysis, Solana	Reads every transaction, clusters addresses, tags exchange deposits	none on-chain	Dedicated trading key separate from treasury; value exits through single-use provider deposit addresses
Chain analysis, Monero	Ring heuristics, timing, output age	strong (protocol)	Reference wallet, default ring size, fresh subaddress per counterparty, coin control for dust
Chain analysis, Zcash	Transparent pool is Bitcoin-like; shielded pool is encrypted	partial, strong once shielded	Pools shown separately, FullPrivacy default, transparent balance flagged, shield-all
RPC and API operators	Log IP and queried addresses, correlate over time	partial	One tunnelled client (WireGuard or Tor), private RPC URL setting, public-RPC warning, observers panel
Swap providers	Know deposit tx, settle address, amounts, IP; may request identity	partial	Disclosure before every order, KYC rating and log policy shown, tunnelled path, refund address required
ISP and local network	Destinations and timing of all traffic	partial	Built-in WireGuard for app traffic, system WireGuard control and verification, Tor, DNS-leak test
VPN operator	All destinations once tunnelled	partial	Tor as a second hop for app traffic; stated in the UI
Malware on the host	Memory, keystrokes, clipboard	out of scope	Vault key zeroised on lock; wallet processes on loopback with random login. A compromised host defeats every wallet.
Disk seizure	Files at rest	strong	Vault: Argon2id (64 MiB, 3 passes) and XChaCha20-Poly1305. Monero wallet files encrypted by monero-wallet-rpc. Zcash keys inside the node wallet.
The authors	—	not applicable	No server, no telemetry, no update check, no analytics on this site

Moneyero

Hero Member

★★★★★

Online

Re: Security — technical details: who sees what, and the rules the code follows« Reply #1 »

A deterministic module (src/lib/privacy.ts) turns the current state into warnings, each with a level and an observer. It runs before swaps, orders, Zcash sends and node changes, and in the status bar. It lists facts; it does not score.

Solana swap	Ledger is public. Phantom's RPC sees the transaction in browser mode. Public RPC logs IP. No tunnel means real IP. Token red flags: mint or freeze authority enabled, thin liquidity.
Exchange order	Provider sees IP (Tor, VPN or real, stated), deposit tx, settle address, amounts. Monero address reuse. Transparent ZEC leg. KYC rating C or D.
Zcash send	Transparent sender, transparent recipient, any policy below FullPrivacy (critical), and the note that node and network path still see timing.
Monero node	Remote node sees IP, restore height and fetched outputs; remote marked trusted is critical; a local node still reveals that the IP runs Monero at the P2P layer.
Monero outputs	Merging outputs from different subaddresses proves common ownership to anyone who knows them; dust spent with real funds links them to whoever sent it.
Network	Clearnet; tunnel enabled but down (fails closed); VPN only (operator sees destinations).

Rules the code follows

Name the observer. Every warning says who learns what.
Keys stay in the software that owns them. Monero keys in monero-wallet-rpc, Zcash keys in the node wallet, the Solana trading key in the Rust vault. The UI process sees none of them.
One network path. Every request goes through one client with one tunnel switch.
Fail closed. Tunnel enabled and unreachable means requests fail.
No inferred state presented as measured. Kill-switch state is labelled inferred. The DNS test resolves real names. Exit IP is fetched each time.
The agent proposes. It has no reference to signing or ordering functions.
Everything audited. Signatures, sends, orders, proposals, decisions and model calls are written to a local audit table.

Not protected

A compromised operating system, a malicious RPC you chose, a provider that requests identity after deposit, chain analysis on Solana or transparent Zcash, timing correlation by an observer of both your ISP and a provider, and your own address reuse.

Moneyero

Hero Member

★★★★★

Online

Re: Security — Monero and Zcash: similar cryptography, very different crowds to hide in« Reply #2 »

In a fully shielded Zcash transaction (shielded in, shielded out) the sender is hidden by proving membership in the whole shielded pool, not by picking decoys. Monero's full-chain membership proofs (FCMP++, the upgrade replacing the fixed 16-member rings) hide the sender the same way: membership in the accumulated set of every output ever created, with no ring chosen by the wallet. For a shielded-to-shielded send, Zcash's sender privacy is at least as strong cryptographically.

What differs is the effective anonymity set. Zcash's set is everyone who chose the shielded pool. Monero's is everyone, ever, with no choice involved. Privacy that is optional is privacy a minority uses, and a minority is easier to study.

Property	Monero	Zcash, fully shielded	Zcash, transparent
Privacy is	mandatory	opt-in	absent
Sender hidden among	every output on the chain (FCMP++); 16 decoys per input today	every note in that shielded pool	nobody
Amounts	hidden	hidden	public
Receiver	one-time stealth address	shielded address, encrypted note	public
Set fragmentation	one set	split across Sapling and Orchard pools; moving between pools or in from transparent reveals the amount	n/a
Weak point	timing and the network path; exchange hops	the transparent side: most inflows and many wallets still touch it	everything

What Moneyero does with that

Monero is the default treasury. The Exchange proposes a fresh Monero subaddress for settlement, and the Agent's "move profit to private" rule template points at XMR.
Zcash is kept shielded by force of habit. Transparent and shielded balances are never summed. Transparent funds are flagged until shielded. Sends default to FullPrivacy and anything lower is a critical warning.
The pool is named. Zcash balances show Orchard, Sapling and transparent separately, because they are three different crowds.
Neither chain fixes the path. Both wallets talk to nodes over the same tunnel switch, because the network layer is where either one is most often deanonymised in practice.

Honest footnote. Shielded Zcash adoption is growing and the gap narrows as it does. This post describes the sets as they are, not as either project hopes they will be.

Moneyero

Hero Member

★★★★★

Online

Re: Security — technical details: data on disk« Reply #3 »

Use full-disk encryption. These files describe your own activity.

moneyero.db	SQLite: settings, encrypted secrets, activity, trades, orders, rules, proposals, audit. Secrets are ciphertext; the rest is plaintext metadata about your own activity.
monero/wallets/	Wallet files encrypted by monero-wallet-rpc with the wallet password.
wg/*.conf	WireGuard configs including the private key, because WireGuard must read them. Mode 0600 on Unix.
logs/	Standard output of managed processes. Review before sharing.