About
One maintainer, an open method, and no lock-in.
Who
Who maintains it.
nullroute is written and maintained by Xaxis, in public on GitHub, under the MIT licence. One person has written it, and so far only that person has reviewed it. That is the main reason to keep real money off it, and the reason an outside review is the milestone after hardware bring-up.
Contributions follow the rules in CONTRIBUTING.md: the spec is written with the code, every invariant names a test that exists, and no dependency is added without a written reason, because every package is attack surface on a device that holds keys.
If it stops
What happens to your funds if this project stops.
Nothing. A wallet here is a BIP-39 mnemonic and a canonical BIP-380 descriptor, and that is a rule rather than a habit: a feature that would make funds recoverable only by nullroute is forbidden (INV-INTEROP-1). The recovery drill restores and spends single-key wallets in all four script types and 2-of-3 quorums in wsh and taproot with Bitcoin Core alone, on every push to main.
The signer profile and its vectors stand on their own too. They are JSON, pinned by a SHA256SUMS that coreutils checks, and the runner uses nothing but Node built-ins. Any signer can be held to them whether or not this device exists.
Help
Where help is worth most.
- Run the kit against another signer
- Write an adapter for a signer you know and run the profile’s vectors against it. A second implementation is the test of whether the profile can be met as written, and every disagreement is a finding for one side or the other.
- Read the code that holds keys
- packages/core and the signing paths in packages/daemon are small on purpose. Read them against their specs and tell us where a spec is wrong, not only where the code is.
- Bring up a board
- The card targets the Pi 4 with the official 7 inch panel. Booting it on real hardware, and recording what the panel, touch, camera and network interfaces actually do, is the next milestone.
- Find an overclaim
- This project’s value rests on being honest about its limits. A sentence in the docs or on this site that claims more than the code does is a bug, and reporting it is as useful as reporting one in the code.
Report a flaw privately through the security policy. Anything else is an issue or a pull request on GitHub.
Licence
Free to read, run, change and redistribute.
The repository is MIT licensed. The official BIP test vectors in it are copies, and keep the terms of the BIPs they come from, and the wallet exports in spec/interop stay under Sparrow’s Apache 2.0, its licence beside them. The typefaces on this site are Source Serif 4 and IBM Plex under the SIL Open Font Licence and DejaVu Sans Mono under its own free licence, self-hosted, with the licence texts beside the files. How to contribute.