I would like to develop an app on an EVM compatible L1, however MetaMask currently does not have it on its list of supported networks. Hence the only alternative I can think off would be to manage private keys directly as follows.
On initial load:
- Prompt connect wallet
- Prompt existing
privateKey
input or new key-pair generation and store insessionStorage
- Prompt
password
input and storehash(password)
inlocalStorage
- Encrypt
privateKey
withpassword
and store inlocalStorage
On subsequent loads:
- Prompt
passwordAttempt
input and ifhash(passwordAttempt)
matcheshash(password)
inlocalStorage
decryptprivateKey
and store insessionStorage
- Retrieve
privateKey
fromsessionStorage
for signing transactions when required.
I'm also looking to develop the frontend in Create React App which to the best of my knowledge is resistant to certain attacks such as XSS. But I'm not sure of other security vulnerabilities of directly managing the private keys in the app, other than the web app being compromised by for example a malicious actor deploying malicious code to a production environment.
Could someone please shed light on the pros and cons of using a browser wallet extension and managing private keys directly in app? Also if such vulnerabilities exist would a native app implementing similar privateKey management solve the shortcomings of its web app counterpart?