I believe the idea is pretty standard though. It's almost synonymous to how non-hardened keys are normally derived.

I guess this non-standardness will actually be a bit of an annoyance to technical users, but the real beauty is indeed the solution rhavar came up with, that is to derive a private key out of a public key
like

And to then derive the deposit address from that, as we described above.



Yes! All of our code is open-source. We will think about holding some sort of competition, but for now, any critical vulnerability will probably be compensated with a fictitious share in the rollover profits over the next N cycles of z%. (so that you are actually incentivized to report the vulnerability, instead of abusing it..)

Note: read "probably" for now.

"Critical" -- meaning:
 - Anything that can lead to a loss of funds to the client, due to poorly implemented wallet code.
 - Anything that can lead to a loss of funds to the operator of a custodian, due to poorly implemented custodian code.

Other bugs we're also anxious to catch (but are by far not as critical) is anything that either breaks our service from being provably-honest.
 - For example, if we're missing a check somewhere in the wallet code that allows custodians to dupe the client in a way whereby it will be impossible for the client to ever prove the custodian fricked him over.

Or bugs that "break" your privacy.
 - For example, a bug in the implementation of the blind schnorr signature scheme that for example would allows us to learn your unblinded coins along with your blinded coins.

Indeed, if our "wallet" custodian shuts down, you will no longer be able to access your bitcoin. However, I think you have the wrong understanding of moneypot. You shouldn't use our wallet as a wallet to hoard your coins in until the end of days.

Instead, you should us as an intermediary between your primary wallet, and the goods and services you want to acquire.

Let's assume you make 5 transactions a week currently from your primary wallet to something like bitrefill, or another payment service.

Now, instead of those 5 transactions, you can also make a single transaction to moneypot, and then use our lightning services to pay for your goods on bitrefill. Much cheaper!
Of course - not every service accepts lightning, but in that case you will still be able to make use of our batched / immediate transactions.

Again, all while enjoying a revolutionary amount of privacy.


While I agree with your initial statements, (you should aways use any service with caution!), I don't see how we can distance ourselves any further from the previous owners of this domain than we've already done. What are other issues you're having that cause you to view us negatively?

Quick sidenote: while you do not hold the keys to your bitcoin, you do solely hold the keys to a claim equivalent to the bitcoin you deposited.

thanks for your question, because this allows us to point out some of the beauty of moneypot.

So, with a regular wallet that uses BIP39, you take your mnemonic, convert it into a seed using PBKDF2, so far so good, this is what moneypot does client-side as well.

Now, moneypot does something similar to BIP32, but not exactly.

Most wallets using BIP32 would derive a master key from the seed using PBKDF2 and a salt. Then, from that master private key, they generate (mostly?!) hardened private keys while using a path like m/0/0'..


Now, what moneypot does, is that it takes your seed, and generates a private key out of it through a hash function, I assume it's mostly kind of similar to a standard BIP32 wallet up to this point. Derive the resulting public key, and you have your "xpub", or claimantGenerator.


Because moneypot is a custodial wallet, the client can't just tweak the private key by an index to then derive the adress.

What we actually do is the following (although the next step is not really related to it being a custodial wallet) : We take the private key derived from the seed, and add another private key to it. The final result serves as our "child key". The added private key is the hash of an index parameter + the previously derived private key from our seed (see above), converted to a public key. I assume this is pretty standard too for most wallets.

This function is described here.

This derivation function is equivalent to as can be seen here.
Deriving by the claimantGenerator allows you to generate addresses without access to the seed/private key, which could be useful in certain situations!

Note: This does mean that if one of your child keys + your xpub leak out, an attacker could probably access *what would be equivalent to* your "xpriv", just like all unhardened keys. However, this would only be a problem for new hookins which are accepted but not yet claimed, as the coins resulting from claims from hookins are not derived from the same private key, but rather from the wallet seed.



How do we actually do this? In the case of a public key for a deposit address, we take the private key from the seed, and we first derive it by it's purpose. In this case, it's a deposit address, so "bitcoinAddress".
After that, we take the resulting private key, and derive it again. This time we derive by the index. Let's say it's our first key, so we derive by 0.

And you get

You can check it out here
We end up with a private key that's actually a key for a yet to exist  "bitcoinAddress 0". Let's call the public key resulting from this private key "claimant bitcoinAddress 0"

However, we do not want to derive an address from this key and subsequently send this key to the custodian, because then we would not be able to prove that we initiated or signed certain actions pertaining to this address. Such as claiming coins!

So what do we do? We hash the resulting public key again, and convert the hash into a private key. From that private key, we derive the public key, and then add the public key to the custodian's fundingKey.
From the resulting public key, we derive either a nested segwit address, or native.

The database function is described here and the function to add the public keys together is described here. Although, they're not really that interesting because it still hides the abstracts away.

Now, whenever we deposit funds on bitcoinAddress 0, we send a hookin to the custodian using "claimant bitcoinAddress 0". The custodian derives the private key from "claimant bitcoinAddress 0" and can subsequently claim the bitcoins deposited on the address. Now, because the custodian does not know the private key to the claimant, only you, the client, can initiate a claim! thus making it provably-fair, as the custodian will be unable to provide a valid signature for the claimant, and thus cannot falsely claim that your coins have already been claimed.

Of course, you could also send us your claimant and ask us for a deposit address, but that solution would not be as elegant, would it? (This is exactly what we do for lightning invoices though!)

---

So, no. You cannot use any standardized third-party tool to derive your deposit addresses, for moneypot is far too "un-standard". However, it wouldn't be too hard to come up with an api to generate keys following the same derivation as the wallet does.

Let us know if anything was vague, or if it was too technical.

---

No, you're not missing much. I'd say that that is about right. Sure, there are a lot of things that can go wrong, but we believe that this could also blossom into something cool, otherwise we wouldn't have started it.
I'm not dismissing your concerns, I think they are understandable, obviously we do hope you change your mind sooner or later.

Hi, yes, that was the project previously hosted on this domain. While we are not completely aware of the exact depths of their scummy behaviour, we do recognize they probably were up to no good, and have undoubtedly scammed people.

It's a complicated story as to how we got this domain, and we do not actually know entirely how it ended up in our hands.
So, in short, It originally belonged to rhavar, which used it for a gambling bankroll service slash wallet. He ended up selling that project to the abovementioned - what turned out to be - scammers.

At some point, he (or a group representing him) has bought back the domain from Monsterbyte.io (which merged with the buyers of "moneypot.com"), and we currently "lease" it from him. Note: rhavar is in no other way currently directly involved with moneypot.

So while we accept that you might want to give us this negative connotation due to the domain name, we do not believe it is right, and hope you'll view us differently over time.

I do not necessarily see how the three are correlated with each other, but there are numerous arguments why a service such as moneypot would be useful. For one, it pushes other services and bitcoin to innovate. While we recognize that extreme trust is required to use a custodial wallet, and currently, maybe ever, we are not deserving of that trust. So you're just going to have to make a decision based on the risks vs the rewards.

The risks:
 - We could scam everyone and run with the deposited funds. please note: It is impossible for us to unprovably scam any individual user, at least; that's the idea.
 - You might lose funds due to poorly implemented code.

The benefits:
 - Make transactions with enormous privacy. (every input is blinded using an established blind schnorr signature scheme.)
 - Use lightning efficiently and with privacy.
 - Make use of our cheap on-chain transactions.

You're right. There's definitely a lot of room for improvement. In your opinion, apart from using a different domain name; how could we improve how you view us?

Yes, We understand your frustration, however if you want to enjoy complete privacy, tor is more or less required. You can download the standalone tor client for windows, or install the package on linux, and then simply route all your browser traffic through
Tor is not synonymous to the Tor Browser, but this should perhaps be a bit more clear, I agree.

A VPN with a rotating IP would also suffice in most cases.

Hi, yes. While I am unfamiliar with the "UC Browser", this generally means that your browser is inherently incompatible with the moneypot wallet. There is no way the wallet works without big integers. Unfortunately that means you'll either need to use another browser, or see if you can upgrade this one somehow.

Thanks. Yes, I don't think we have emphasized enough yet how radical it is that we are using blind schnorr signatures, and  the impact of it for the privacy of our users.


This is no fault of your own. We will have to look into this, but I believe we were previously unable to resolve this issue. The problem is that tor by default does not allow Indexeddb, and even if it's allowed through about:config, it still won't work. I'm sorry, I currently do not have a more detailed explanation. However, the tor browser wouldn't really be ideal either way: It is recommended that you use a browser which gives persistent storage.

As an alternative we would suggest to use a regular browser, but to route your traffic through tor manually. You could also use our electron app, but we understand if users are hesitant of doing so at this stage.

We forgot to mention that we were originally only planning on paying the first 10 users.

We've paid the above 3 posters. For users who post an invoice after this post, it's not guaranteed you will get paid!
Good question. Your wallet is in constant sync with the custodian. Each claimable you send to the custodian gets stored both locally, and on the custodian. However, it could be that through a crash, a database mutation, or whatever, you lose access to your local wallet.

In that case, you can fully recover your wallet by using the restore function using both your original mnemonic + password. You just click resync once you created your wallet, and it should return all your original claimables, at least those that were originally accepted by the custodian. Which in turn allows you to rederive your coins, and thus get your funds back.

We have an electron application for both linux and windows.

All your claimables, coins and such are saved client-side, in your IndexedDB.
If you want to make a transfer, you need your seed, which is derived from your password + mnemonic phrase. Your mnemonic phrase is also stored client-side, however the password is - obviously - not.

So, someone who has access to your browser, given that the password has enough entropy, will not be able to spend your coins.

As long as your password has sufficient entropy, I don't see the difference?

Yes. If you send an IMMEDIATE transaction, you will pay the full price. we assume the weight is ~561 WU, so you will pay that times the immediateFeerate, which is to be confirmed within 6 blocks.

You can also choose to send your transaction batched, which means you only pay the price of an input. Depending on your address type, but generally this will be 31-34 B. Whenever someone initiates an immediate transaction, it will also send your batched transaction along.

Yes. Generate a lightning invoice of any amount, and send that to a fellow moneypot user to pay.

Paid!

Fees are updated automatically. If you're trying to send a hookout / feebump, you should make sure you do it within a minute after fetching the latest feerates.

Even then, it could happen that the custodian has already refreshed, and so your hookout / feebump might get blocked. If that's the case you should [DISCARD] your hookout/feebump and try again.


Care to eleborate? I don't think I follow.

Paid both! 1 more.

This makes sense. Coins will only be added after you make a claim on either a deposit (Hookin & Invoices), or reclaim the remainder of your coins when making a transfer. (Hookout / LightningPayment / Feebump)

Sent!

Sent!

Could you give an example / screenshot of what could be improved?

Sent!

Thanks!


Sent!

Yes, standard transactions are also supported!

I see. I've put it on our todo list.


Sent!

Thanks. We will try to add more documentation in the near future and or fix those broken links ASAP.

Sent!

---

Let us know if you encounter any errors trying to withdraw!

No. Moneypot does not give users access to the private keys belonging to their deposit addresses. They're generated specifically so that only we can access them.

You actually do this yourself by converting the public key you generated client-side into a private key, which is then converted back into a public key and tweaked by our funding key. You then send us the original public key, so that we can derive the private key belonging to the address. If you're interested, you can read more here. https://www.moneypot.com/docs/derive-deposit-addresses/ (Ignore the bugged Replications  )



PS: If you wish to receive your BTC, post your payment request!



Sent!

How does it work?

We've just launched an exciting new bitcoin wallet which you can access here wallet.moneypot.com

It comes with a bunch of new unique features such as lightning, blind signatures, internal transfers, and much more.

We're interested to know what you think of it. Please have a look around, and let us know what you dislike, like, or think could be improved.

---

If you wish to get the 0.0005BTC, you need to include a lightning invoice in your reply, and the invoice needs to be generated from moneypot. We will pay the invoice, after which you are free to spend the funds as you please.


Payment is for the first 10 participants only.

We know, you're probably wondering; "What?! Moneypot?! Again?!"

Rest assured, we are not in any way related to the previous owners of Moneypot.com, for we have only the domain name in common.

---

Preface: Moneypot is currently in beta so we want to re-emphasize to not deposit more funds than you are willing to lose.

moneypot is a completely functional bitcoin wallet. It has all the quirks one could reasonally expect from a web wallet: feebumping, custom fees, segwit.

However, it introduces a number of new, unique features, which we think you're going to like;
 

• moneypot utilizes so-called "blind signatures", which allows the user to transact with the utmost privacy. Your inputs and outputs are cryptographically unlinked within our ecosystem.

• moneypot utilizes in-house coin selection algorithms, allowing us to not only batch transactions at scale, but we are also able to make the smartest choices when selecting inputs.

• moneypot brings lightning to the average Joe. No longer will you be required to set up your own node, or use a separate wallet for your lightning transactions. moneypot allows you to pay and generate invoices from the comfort of the same wallet you do your daily transactions with.

• moneypot is provably-honest. We will be unable to get away with duping any single person.

• moneypot offers their service at cost. Apart from very limited anti-dusting fees, all of moneypots services are ran at cost. There are no hidden fees.

• moneypot allows instant and free transfers between users.

---

What are the drawbacks?!

• moneypot is a custodial wallet. Through malice, error, or other causes, your funds* could potentially disappear at any given time, without you being at fault. Your funds as in the collective of all of the users of a custodian(s)
  

• moneypot is coded by -humans-, sentient beings, and so there might be unspotted glitches in the wallet software that could lead to a loss of funds.

---

In what scenario would I use this wallet?

We think moneypot is to be fully appreciated when used as your day-to-day wallet. Used correctly, a transaction costs as little as a regular input. And that's not even mentioning the ease with which you can use our lightning services to pay for any service or everyday goods, all while retaining full privacy.

---

FAQ:
 Why should I trust you with my bitcoins?
   - You should not. Everyone needs to assess the risk they're willing to take with their coins, and we hope we offer enough to make it worth it for you to take that risk. There is no compelling argument we can make as to why we are worthy of safe-guarding your coins, because really, we aren't.

For more frequently asked questions, you can visit our FAQ

---

How exactly does moneypot work?

In layman terms: moneypot takes the bitcoin you deposited, and returns to you a claim to a set of coins equal to the deposited amount. Only you have the keys to those coins, and you use them each time you want to make a transaction. Due to how moneypot works, we do not know your coins, nor the keys. We only know whether or not they are valid, and whether you are the actual owner of them.

For more detailed information, please check out: Overview

---

How to use

Step 1. Visit wallet.moneypot.com

Step 2. Choose a custodian (use the affiliated ones for now. See below)

Step 2.1 Choose both a password and a name. Save your password and mnemonic phrase!

Step 3. Deposit bitcoin through either lightning or a normal transaction.

Step 4. Start blazing!

---

Electron
Moneypot also offers an electron shell, should users be interested in using that. We think it could be of benefit to both your privacy and security.

For more information, please visit Releases

---

Source code

For those interested in the source code, our github repositories are publicly accessible. You are welcome to contribute, run your own custodian, or point out bugs.

For those who spot critical security vulnerabilities; please PM us here on bitcointalk or send an email to our support.

moneypot-wallet
moneypot-lib
moneypot-wallet-electron
moneypot-custodian

---

We support both TOR and clearnet for our affiliated custodians.

---

Our PGP key used to sign releases

38876AFC1172E3DFA17A84BB2E5F4A83BFE81B1B

You can import this using


Latest wallet release

---

About

~