I would like to develop an app on an EVM compatible L1, however MetaMask currently does not have it on its list of supported networks. Hence the only alternative I can think off would be to manage private keys directly as follows.
On initial load:
- Prompt connect wallet
- Prompt existing
privateKeyinput or new key-pair generation and store in
passwordinput and store
passwordand store in
On subsequent loads:
passwordAttemptinput and if
privateKeyand store in
sessionStoragefor signing transactions when required.
I'm also looking to develop the frontend in Create React App which to the best of my knowledge is resistant to certain attacks such as XSS. But I'm not sure of other security vulnerabilities of directly managing the private keys in the app, other than the web app being compromised by for example a malicious actor deploying malicious code to a production environment.
Could someone please shed light on the pros and cons of using a browser wallet extension and managing private keys directly in app? Also if such vulnerabilities exist would a native app implementing similar privateKey management solve the shortcomings of its web app counterpart?