Safest Sofar
Zymbit Hardware HSM backed multisig Safe. Finally a system for running dapps trustlessly.
Demo
About
The problem it solves n response to the recent security breach of app.safe.global where North Korean hackers compromised a developer's laptop and exposed AWS credentials, this project offers a comprehensive security solution for Gnosis Safe wallets. The implementation runs a complete Gnosis Safe infrastructure stack on a Raspberry Pi 5, creating a self-contained, air-gapped transaction signing environment that operates independently from vulnerable web interfaces. The security cornerstone is the integrated Zymbit HSM6 (Hardware Security Module), which provides military-grade key protection. This dedicated hardware stores all private signing keys in a physically isolated, tamper-resistant environment with features including: Physical tamper detection that can automatically wipe keys if breached Encrypted key storage with dedicated secure processing Hardware-based random number generation for cryptographic operations Secure authentication mechanisms before allowing signature creation User Interaction and Data Flow First they acquire the hardware, a pi500, the HSM6, the GPIO headers and assembled their own hardware wallet.. The opperating system is stored on a SD card that is later soulbound to the computer and the HSM. The project architecture and development process The system architecture features multiple security layers, beginning with a locally hosted version of the Gnosis Safe software that eliminates dependency on potentially compromised web services. This allows users to create, sign, and broadcast transactions directly from the Raspberry Pi without exposing sensitive operations to internet-connected services. Product Integrations Gnosis Eternal Safe, Zymbit HSM (zymbit.com) Key differentiators and uniqueness of the project This is a first of it's kind product, it's a dedicated runner for dapps, this allows security at a level not generally attainable. Trade-offs and shortcuts while building We're in hardware, physical hardware, so the complexity has been emmense, plus all things must be compiled on the smaller hardware for security reasons.