XOWallet

XOWallet is a key module of the XODEX ecosystem, the most powerful DeFi platform built for Telegram. It offers a seamless blend of security, innovation, and user empowerment.

With a multi-layered security architecture, XOWallet ensures the safety of user funds and data through advanced encryption, non-custodial principles, and MPC transaction signing.

XOWallet enables seamless management of assets between devices and platform without exposing private keys and seeds.

Security

Multi-Party Computation (MPC) and Sharding

  • Split Key Architecture

    • XOWallet uses MPC to divide private keys (“shards”) between the user's device and a high-security HSM module managed by Fireblocks, the industry leader in MPC.
    • The shards are never combined on any single server or device, ensuring no one entity—neither XOWallet nor Fireblocks—ever holds the complete key at any point.
    • Even if one shard is compromised, it's incomplete on its own and becomes useless after a short time due to key rotation.

  • Key Rotation

    • Shards constantly rotate, limiting the window in which an attacker would have to obtain all key shares. Once a new shard is generated, older ones are invalidated.

Encryption and PIN Protection

  • AES Encryption

    • All data (including user shards) is stored with AES encryption.
    • Encrypted data resides in Telegram cloud storage, but only users can unlock it.

  • PIN-Guarded Access

    • To authorize transactions and decrypt AES-encrypted data, a 4-digit PIN is required in conjunction with Telegram authentication and additional security checks provided by XODEX.
    • Rate-limiting and hardware-based safeguards significantly reduce brute-force attacks.
    • SPKI Infrastructure adds an extra layer of security for your PIN.

  • Layered Key Derivation

    • The PIN code alone does not generate the encryption key. Additional elements are used, strengthening protection against PIN-based attacks.

Hardware-Level Security & Rate Limiting

  • Secure Device Features

    • Time-based lockouts make PIN-guessing or brute-forcing highly impractical.
    • Physical attack vectors are mitigated by ensuring that unattended devices are locked and require authentication to access XOWallet.

  • Potential for Biometric Authentication

    • Future updates plan to introduce biometric options. This would further supplement the existing PIN-based authorization.

Non-Custodial by Design

  • User Retains Full Ownership

    • You retain sole ownership of your wallet. Neither XOWallet nor Fireblocks can reconstruct your private key alone.
    • The wallet is "self-custodial" in that no outside party can access or spend your funds.
    • No entity manages your funds. Funds are never stored in an omnibus account or commingled with any other customer funds.
    • Every customer has a segregated set of keys on segregated on-chain addresses.
    • Customer funds are never converted to on-balance sheet assets of XODEX or Fireblocks.
    • All your assets and transactions are recorded on the relevant blockchain without the intervention or assistance of personnel.
    • No entity can move your assets without your signature.
    • No entity can block you from accessing and releasing funds.

  • Exporting Keys

    • Users can request to export full private keys (though not recommended).
    • Once exported, the added layers of MPC-based security are lost, placing full responsibility on the user.

Disaster Recovery & Resilience

  • Disaster Recovery

    • Fireblocks provides offline, encrypted backups of their key shares.
    • Users can recover their key shards through either Fireblocks or XODEX, reducing a single point of failure for disaster recovery.
    • In extreme scenarios (e.g., Fireblocks ceasing operations), users can retrieve their shards through a standardized recovery kit/tool, allowing them to reconstruct the complete key.

  • IPFS-Hosted Frontend

    • XOWallet's interface is hosted on IPFS, ensuring that the front end remains immutable once audited. This means users can trust the code without needing to compile it themselves. Hosting on IPFS also eliminates the backend as a single point of failure, enhancing the security and reliability of the wallet.
    • Ensures that even if primary servers go down or XOWallet services are disrupted, users can still access their wallet interface in a decentralized manner.

Security Audit

  • Fireblocks' MPC has undergone audits and offers a public bug bounty.

Open Source

  • Major components are planned to be released.
  • The MPC provider (Fireblocks' library) is already open source and audited.
  • The ultimate goal is to make XOWallet as decentralized and trustless as possible—while carefully balancing user experience and security.

Additional Clarifications

  • No Plaintext Seed Phrase Input

    • Unlike some Telegram bots that store seeds in plaintext or repeatedly prompt for them, XOWallet never exposes seed phrases in memory.
    • Users do not have to re-enter seeds on server restarts, minimizing phishing and hacking risks.

  • Regulatory and Censorship Resistance

    • XOWallet is exploring more decentralized architectures (e.g., IPFS hosting) to reduce single points of failure.
    • Even if central services face regulatory hurdles, the user's ability to export and control keys provides ultimate self-custody.

  • Roadmap for Enhanced Authentication

    • Plans for 2FA, multi-signature, guardian mechanisms, and biometric access are under research.
    • The team aims to give users the choice of how much responsibility (and risk) they take on.

  • Telegram Mini App vs. Other Platforms

    • Currently launched as a Telegram Mini App for convenience and broad device coverage.
    • Browser extensions and native apps are already in progress.
    • XOWallet's integration uses raw signing to minimize reliance on Fireblocks' infrastructure, while still leveraging its security benefits.

  • Telegram Bot Security

    • The Telegram bot is secured with multisig accounts, requiring multiple signatures for critical operations.

Future Directions

XOWallet combines user-held key shards with Fireblocks' secure MPC to deliver a wallet that is both user-friendly and robust against theft, phishing, and brute-force attacks. With additional layers of AES encryption, hardware-level PIN protection, and a commitment to ongoing improvements (like biometric authentication and decentralized hosting), XOWallet aims to provide a best-in-class security experience.

Long-Term Vision

  • Reduce reliance on central entities and gateways by further decentralizing each layer of the stack.
  • Offer flexible, user-configurable security options—ranging from default MPC-based protections to fully independent key management.
  • Continue open-source efforts to foster transparency and community trust.

If you have further questions or seek more in-depth technical details, please watch for upcoming updates on our documentation site and feel free to reach out to the XODEX team for ongoing discussions.

Was this page helpful?