NotWallet

Demo

About

Over $2.14B was drained in Web3 exploits recently, with >68% stemming from private keys compromised on internet-connected disks. While hardware wallets prevent this, less than 8% of users own one because of high costs ($150+), charging cables, and fragile 24-word seed phrases written on paper. NotWallet solves this crisis by turning any contactless card you already carry—a metro card, gym ID, arcade token, or Visa debit card—into a bank-grade, air-gapped hardware wallet with $0 extra equipment. Using Multi-Factor Key Derivation (MFKDF), NotWallet reads the card's physical NFC UID as an uncloneable hardware salt and combines it with a secret memory passphrase. In just 38 milliseconds, it deterministically computes your Ethereum private key in volatile RAM, signs the payload, and instantly wipes the key from memory. Zero private keys or seeds ever touch disk. If your phone is stolen, the attacker has no keys. If your card is lost, it is just inert plastic without your passphrase. NotWallet pairs with any dApp via WalletConnect / Reown and features offline clear-signing that decodes transactions into plain English, flags infinite approvals, and forward-resolves counterparty addresses against ENS to eliminate copy-paste phishing.

How it's made

NotWallet was built as a native Android app (React Native + Expo dev-client) coupled with Foundry smart contracts and a Vite presentation dashboard. Key Architectural Components & Partner Integrations: 1. Cryptography & NFC Layer: We utilized Android NFC Reader Mode (react-native-nfc-manager) to read raw NFC tag UIDs directly from everyday plastic cards. For key derivation, we implemented MFKDF using scrypt via native QuickCrypto primitives. The key exists strictly as an ephemeral in-memory buffer during signing and is zeroed out immediately via garbage collection hints. 2. ENS (ENSv2) Hierarchical Account Architecture: Instead of raw hex addresses, NotWallet builds on ENSv2's hierarchical registry live on Sepolia. We deployed our custom NotWalletRegistry (0x6ab7F8D372c3a12bF3267B49754bFF661329FB87) under notwallet.eth. Calling claim() mints user.notwallet.eth on-chain. Users can spawn arbitrary sub-wallets (e.g., bot1.agent.user.notwallet.eth) as distinct EOAs with bounded daily spend allowances, ideal for scoping autonomous AI agents. ENS also stores guardian pointers for our emergency recovery sweep. 3. World ID (Selfie Check Beta): To protect unlocked devices from unauthorized physical sweeps, we integrated @worldcoin/idkit-react-native. Irreversible actions—like lifting the 0.05 ETH transaction limit or triggering an emergency sweep—require an interactive 3D selfie liveness check via the World ID bridge protocol (policy-override-guard), proving genuine human presence with Zero-Knowledge proofs without needing an Orb. 4. Reown / WalletConnect: Integrated Reown WalletKit to provide universal QR pairing and air-gapped clear-signing with any mobile or web dApp. Notable Hacks & Engineering Challenges: - NFC Normalization: Everyday contactless cards use varied UID lengths (4-byte single, 7-byte double, 10-byte triple). We engineered a normalization pipeline that cleans standard EMV/MIFARE cards into deterministic entropy salts. - High-Performance Presentation Engine: For our live presentation deck, we eliminated GPU-heavy CSS blur convolution filters in favor of pure radial-gradient falloffs and concurrent framer-motion transitions, ensuring buttery 60/120fps navigation across all devices.