Fruit Bat Docs

Wallet

The experimental crypto wallet.

A basic self-custody Ethereum wallet, like Brave's, in a side panel. It's new and hasn't had a security audit: keep only small amounts in it. It's off until you turn it on in Settings › Wallet, and the panel asks you to confirm you understand this before setup.

What it does#

  • Create or import a 12- or 24-word recovery phrase. Accounts are at m/44'/60'/0'/0/n, the same as MetaMask and Brave, so the same phrase gives the same addresses. You can add accounts and name them.
  • Networks: Ethereum, Base, Arbitrum One, OP Mainnet, Polygon and Sepolia (test). USDC is shown on each; Add coin adds any token by contract address, reading its name and decimals from the network.
  • Send and Receive (with a QR code). Activity tracks your transactions until they're confirmed and links to the block explorer.
  • Sites use it through window.ethereum (EIP-1193) and EIP-6963, so "Connect wallet" buttons find it. It supports connecting, transactions, personal_sign (including Sign-In with Ethereum), eth_signTypedData_v4, switching networks, wallet_watchAsset, and read-only calls.

Keeping you safe#

  • Keys: the phrase is encrypted with your password (scrypt N=2¹⁷, AES-256-GCM) in <profile>/wallet/vault.json, readable only by you. Unlocked keys live only in memory and are wiped when it locks: after 5, 15, 60 or 240 idle minutes (your choice), and whenever Fruit Bat quits. Five wrong passwords make you wait.
  • Audited libraries, checked before use: keys and signatures come from @noble/curves, @noble/hashes, @scure/bip39 and @scure/bip32, pinned to the 1.x line (which works with Electron's require). Before touching any key, the wallet runs published test vectors through them: BIP-39, the well-known test phrase, EIP-155's example transaction, EIP-712's example, and others. If anything doesn't match, it refuses to create, unlock or sign. The CI smoke test runs the same check on Windows, macOS and Linux builds.
  • Sites only get what you approve:
    • A site sees nothing until you connect it to one account.
    • Every transaction and signature waits for Approve in the panel. The panel opens by itself when a site asks, and the toolbar button shows a count.
    • Which site is asking comes from Electron (the frame that sent it), never from the page.
    • The wallet is only offered in the top frame, on https or http://localhost.
    • At most 3 requests per site can wait. Closing or leaving the tab turns its requests down, and so does locking.
  • Plain-English approvals:
    • Payments show the amount and the real recipient, even for token transfers.
    • A first-time recipient is flagged, as is sending to a contract.
    • Unlimited token approvals, "approve all" for a collection, and permit signatures get red warnings.
    • Calls that would fail are tested first and flagged.
    • You can't approve something you can't pay for.
    • A Sign-In with Ethereum message for a different site than the one asking gets a warning.
    • Typed data for another chain is refused.
    • eth_sign (blind signing) isn't supported.
  • Windows: off in private windows unless you allow it, and always off in Vampire Bat, because an address would identify you and defeat Tor.
  • Network servers: free public servers (PublicNode, with each network's own as backup), no account or key. They can see your addresses and balances, but never your keys. Every server must report the right chain id before it's used. Settings › Wallet › Network servers can use your own (https or localhost).
  • Recovery phrase: Settings › Wallet shows it after your password (hidden again after a minute). Remove wallet also needs the password.

Not included (yet): swaps, buying crypto, NFTs, hardware wallets, Bitcoin or Solana, and prices in dollars.