macu-wallet/README.md

macu wallet

A non-custodial, multi-chain (Ethereum/EVM, Bitcoin, Solana) desktop wallet built on Electron. One seed phrase, standard BIP44 derivation, encrypted at rest.

Run it

npm install
npm start

Requires Node.js 18+ and npm. First run creates a new wallet (or import an existing 12/24-word phrase).

What's here

• src/core/keystore.js — mnemonic generation, scrypt + AES-256-GCM encryption at rest
• src/core/chains.js — BIP44 derivation for Ethereum, Bitcoin (native segwit), and Solana from one seed
• src/core/balances.js — reads balances over RPC / a block explorer API
• main.js / preload.js — Electron process split: only main.js ever touches a decrypted private key; the UI talks to it over a narrow IPC bridge
• src/renderer/ — the UI (create/import, backup phrase, password, dashboard, send ETH)

Before this holds real funds — read this

This is a solid, correctly-structured foundation, not a finished, audited product. Specifically:

1. No security audit. Wallet software handling real private keys should get an independent security review before real money touches it. I can't provide that as a chat assistant — please have someone qualified review this, or start on testnets.
2. Sending is only wired up for Ethereum. Bitcoin needs UTXO selection + PSBT signing; Solana needs instruction building. Same pattern as wallet:sendEth in main.js, but each chain's transaction format is different — happy to build these out next.
3. Default RPC endpoints in config.json are free public ones. Rate-limited, and you're trusting a third party's node for balance data. Swap in your own Infura/Alchemy/Helius keys for anything beyond testing.
4. No hardware wallet support. A production wallet usually lets a user keep keys on a Ledger/Trezor instead of software-only storage — worth adding before this holds meaningful amounts.
5. The password is the only thing standing between the encrypted file and your funds. There's no recovery mechanism by design (that's what non-custodial means) — losing the recovery phrase means losing access, permanently.
6. Test on testnets first. Use Sepolia (Ethereum), Bitcoin testnet, and Solana devnet before ever sending real assets.

Next steps I'd suggest, in order

1. Get it running locally and create a test wallet on testnets
2. Wire up Bitcoin and Solana sending (I can help build these)
3. Add a "confirm transaction details" screen before any send fires — right now it sends immediately, which is too easy to fat-finger
4. Get a real security review before mainnet use with meaningful funds