Vela Wallet
An Ethereum wallet you actually own. Every piece of it — the apps and the
services behind them — is MIT-licensed, builds from public repositories,
and runs on your own machines.
- Your account is an unmodified Safe v1.4.1 on ERC-4337 (EntryPoint
v0.7), signed by passkeys or FIDO2 security keys and verified on-chain as
P-256 by the precompile at
0x100 (EIP-7951; RIP-7212 on rollups). No seed phrase, no Vela contract in the funds path, no admin
role for us.
- One Rust core, four native apps: SwiftUI on iOS, Jetpack Compose on
Android, SvelteKit on the web (and the browser extension), gpui on desktop.
The same
vela-core makes every decision on all four.
- Self-hostable end to end: the relay, the public-key index, chain data and
exchange rates are separate repositories, and the apps can be pointed at yours.
Website · Docs ·
Self-hosting guide ·
Whitepaper ·
Architecture ·
Releases
What's worth reading here
- The core makes the decisions. Every rule that guards money — send, fees,
signing requests, RPC failover, contacts — is a Crux
state machine in
rust/crates/vela-core. The apps render
what the core returns and run the effects it asks for, so the rules are tested
without a browser, a device or a network.
- No hand-rolled crypto. Hashing, curve maths, ABI and CBOR come from
alloy-core, sha2, p256/ecdsa and ciborium/coset at pinned versions. A frozen
conformance corpus is replayed through Rust, the Kotlin and Swift bindings and
the shipped wasm.
- CTAP in the core.
vela-core talks to a phone over hybrid (QR) transport
and to USB security keys directly, so an app you compile yourself can still
sign for a wallet created at getvela.app.
- Fees are signed, not trusted. The relay is paid in band: a transfer inside
the MultiSend your key signs. You see the amount before signing; the relay
can delay or refuse, not change it. No paymaster.
How the fee is set.
- Any EVM chain with the P-256 precompile (EIP-7951 / RIP-7212). Chain setup
deploys the missing Safe and ERC-4337 contracts that anyone can deploy.
- Clear signing from ERC-7730 descriptors, with an explicit blind-signing
warning for anything that can't be decoded.
- A dApp cannot take over the account. A request for a call from your Safe
to itself —
addOwnerWithThreshold, enableModule, setGuard and the rest
of that family — is refused, inside a batch or a MultiSend as well, as is
any leg carrying a delegatecall and a SafeTx typed-data signature. The
rule is in the core (self_call_guard.rs), so every client has it.
Architecture
┌────────────────┬────────────────┬────────────────┬────────────────┐
│ iOS │ Android │ Web │ Desktop │
│ SwiftUI │ Compose │ SvelteKit │ gpui (Rust) │
│ app-ios/ │ app-android/ │ app-web/ │ app-desktop/ │
└───────┬────────┴───────┬────────┴───────┬────────┴───────┬────────┘
│ UniFFI/Swift │ UniFFI/Kotlin │ wasm-bindgen │ crate dep
└────────────────┴───────┬────────┴────────────────┘
▼
┌──────────────────────────────────────────────┐
│ vela-core (rust/crates/vela-core) │
│ Crux state machines — business rules │
│ primitives · abi · eip712 · safe · │
│ webauthn · ctap · i18n (15 locales) │
│ pure, deterministic — no I/O, no network │
└──────────────────────────────────────────────┘
Why it's built this way (and why the React Native app it started as was
retired), how shared assets are generated and gated, and how each app is built
and shipped: docs/ARCHITECTURE.md.
Repository map
| Path | What | Start with |
|---|
rust/ | vela-core: state machines, crypto, ABI, WebAuthn/CTAP, i18n; UniFFI and wasm bindings | cargo test --workspace --features vela-core/i18n-all in rust/ |
app-desktop/vela-wallet | Desktop app on gpui (macOS, Windows, Linux) | cargo run |
app-web/vela-wallet | Web wallet and the Chrome extension | pnpm install && pnpm dev |
app-ios/VelaWallet | iOS app, SwiftUI | ./rust/scripts/build-ios-xcframework.sh, then Xcode — and ./rust/scripts/check-ios-core-fresh.sh before any device test, because xcodebuild never rebuilds the Rust |
app-android/vela-wallet | Android app, Jetpack Compose | generate the bindings (ci.yml android), then ./gradlew :app:installDebug |
app-web/getvela.app | The website and the user docs | bun install && bun run dev |
app-web/trusted-signer | Trusted Signer — the independent signing page published at sign.getvela.app, one reproducible file per version | bun samples/build-single.mjs (or node) to build; python3 -m http.server to try |
|
This is the beginning of the README. Read the rest at the original. Read the full README ↗
