Grand Warden
Intelligent security, verifiably yours.
About
The problem it solves In today’s digital landscape, people manage dozens of online accounts, each requiring a unique password. Unfortunately, many users still rely on weak or reused passwords, and the tools available to store and manage credentials often fall short in protecting their privacy and security. Traditional password managers typically store encrypted credentials on centralized servers, which can become prime targets for hackers or be subject to insider misuse. Even when encrypted, users must place full trust in the service provider to keep their data safe, creating a single point of failure. GrandWarden addresses these challenges by combining decentralized storage, strong encryption, and confidential computing technologies to create a next-generation password manager built on the SUI blockchain. By using Walrus, a decentralized storage solution, GrandWarden ensures that users’ credentials are stored in a tamper-proof and distributed environment rather than on vulnerable centralized servers. Seal encryption protects data end-to-end, so only the user can decrypt their credentials. A key innovation in GrandWarden is the integration of Oasis ROFL, which runs credential breach checks inside a secure Trusted Execution Environment (TEE). This means that when users opt to verify their passwords, the checks occur in a confidential, decentralized runtime that keeps both the data and the code hidden from everyone, including the platform operators. This privacy-first approach ensures users can assess password safety without risking exposure. By putting control firmly in the hands of users and leveraging privacy-preserving technologies, GrandWarden makes managing online credentials both safer and more private. It helps reduce risks of mass data breaches, insider threats, and misuse of personal information. With GrandWarden, users gain a trusted companion for protecting everything from critical financial accounts to everyday subscriptions, empowering them to navigate the digital world securely and confidently.
How it's made
Challenges we ran into One of the biggest hurdles was getting Walrus to work with zkLogin. Our initial plan was straightforward: authenticate users through the standard zkLogin flow, approve transactions with the user’s salt, and push credentials into Walrus storage. But the reality hit hard — zkLogin works mainly on the devnet, while Walrus only runs on the testnet and mainnet. It was like trying to plug a USB-C cable into a USB-A port. We then discovered Enoki, a tool by Mysten Labs that promised smoother zkLogin integration and the ability to sign transactions on the testnet. It solved the network mismatch, but it opened an entirely new can of worms. We now had to deal with using a zkLogin-derived address to store blob data in Walrus, which turned out to be far trickier than expected. The transaction fees were shockingly high — likely because Enoki removes the need for a user salt through complex cryptographic calculations, and validating plus signing with zk signatures demanded a hefty amount of testnet tokens, far more than we had. On top of that, Walrus itself offered two upload methods: via HTTP or via the SDK. Both had their quirks, different authentication flows, and varying performance trade-offs. We spent days bouncing between them, testing one approach only to backtrack and try the other, burning through precious development time. Even without gas fee issues, the combination of zkLogin, Enoki, and Walrus felt like trying to solve three different puzzles at the same time, each with pieces that didn’t quite fit. In the end, after many late nights and dead ends, we made the difficult decision to remove zkLogin from the project to ensure we could deliver a stable and functional product.