A problem that i identified and solved during the development of the launchpad: How to give explicit access from the Collection to the User to create the NFTs on their behalf but at the same time limit others from accessing that Create NFT function from a different protocol.
Reblixt retweeted
Signing @SuiNetwork off-chain messages and verifying them on-chain using Move
Your $SUI wallet is not only able to sign transactions, it can sign any message you want. Signing a message proves that you are its creator; it cannot be faked.
Sui’s TypeScript/Rust/… SDKs provide methods to sign any message, but also to verify signed messages. These SDKs are highly abstracted, and no tutorial exists to show how to verify the signature produced by the SDKs without using the verification functions they provide.
A concrete use case where such manual verification is required is when you want to verify a signature in a Move smart contract. This article will give you all the keys and concepts so that you can do it.
Plan of the article:
1) What message is actually signed by a Sui wallet
2) Digging into the signature produced
3) Putting the pieces together
4) Conclusion
This article will require some basic coding knowledge to follow, but I’ll try to keep things as simple as I can!
1) What message is actually signed by a Sui wallet
Sui supports multiple signature algorithms: Ed25519, Secp256k1, Secp256r1, and so on. For this article, we’ll focus on Ed25519 as it is the most commonly used.
Ed25519 is an asymmetric cryptographic algorithm. A wallet is composed of a private key, used to sign messages, and a public key, used to verify signed messages. In order to compute the Sui 0x address of a wallet, we have to:
- Take its public key bytes: 0xabcdef…
- Prefix it with a flag indicating which algorithm is used (00 for Ed25519): 0x00abcdef…
- Hash the result using Blake2b256: 0x7acd…
You can sign any message you want with your private key:
- A sentence: “Hello, my name is Quentin!”
- Any legal document such as a notary act
- A Sui transaction: a signed transaction can be executed by any node, resulting in changes committed to the blockchain
- Etc.
This ability to sign anything leads to a collision issue. Suppose transaction data looks like: “I want to send 3 Sui to Alice”. How do we differentiate that from the plain message: “I want to send 3 Sui to Alice”? In such a case, the user may think they’re signing an innocuous message, while they’re actually signing something that a node could execute with real consequences (sending 3 Sui to Alice).
We want to avoid this collision risk, as malicious actors could take advantage of it to trick users into signing things they didn’t intend. To address this, the Sui team introduced a system called Intent Message. An intent is something prepended to the message to indicate what kind of message it is: a sentence (a.k.a. Personal Message), a Sui transaction, etc.
An intent has 3 components:
- A scope, indicating the purpose of the message. This is a number, in our case, 0 is the scope for Sui transactions, and 3 is the scope for personal messages
- A version, version 0 includes the scopes above, but future versions (1, 2, etc.) may define different scopes
- An app ID, which defines which service should use the signed message. Here we’ll only consider ID 0, used for anything related to the Sui blockchain. Other IDs exist, such as the one related to consensus.
When a Sui wallet signs a message, it creates an intent message by concatenating the intent and the original message. Lastly, the intent message is hashed using Blake2b256. The result is the actual message signed with the Ed25519 algorithm.
Let’s practice by computing the actual message to be signed for the personal message “Hello, my name is Quentin!”:
- Get the bytes of “Hello, my name is Quentin!”: 0x48656c6c6f2c206d79206e616d65206973205175656e74696e21
- Encode it using BCS, considering it as a variable-sized vector of 8-bytes unsigned integers: 0x1a48656c6c6f2c206d79206e616d65206973205175656e74696e21
- Compute the intent: 3 for the scope, 0 for the version, and 0 for the app ID → intent bytes: 0x030000
- Concatenate to compute the intent message: 0x0300001a48656c6c6f2c206d79206e616d65206973205175656e74696e21
- Hash the result using Blake2b256: 0x4a810aa6ff40213a15ce99c5e129f36c6c474e9848d318ac43b949199de95087
We now have the hex data to be signed by the wallet: 0x4a810aa6ff40213a15ce99c5e129f36c6c474e9848d318ac43b949199de95087
The signature implementation depends on the wallet and is handled by the SDKs. What interests us now is the result of the signature.
2) Digging into the signature produced
When you call the SDK function to sign a personal message, it returns some bytes like 0x00abcdef…. You might think this represents the signature for the data shown above, but it does not!
The result is actually the concatenation of 3 elements:
- A flag indicating the algorithm used to sign: as before, 0x00 for Ed25519
- The signature itself (64 bytes for Ed25519)
- The public key of the wallet that signed it (32 bytes for Ed25519)
Let’s assume the SDK returns the following bytes after signing: 0x005853eb859dfcf886e1ed508bc0c8d8181c9c05543f0a37ec225ec4118f34eb2d13a4494fe250a8118ddaf41cac87219da228182fffa32851e970f56c6f2cfb0f91dae31b6d33559fffd6092b5a3727b5d79c224e117cac59b57358003db9eefd
Then:
- The first byte 0x00 indicates the algorithm used is Ed25519
- The next 64 bytes are the signature: 0x5853eb859dfcf886e1ed508bc0c8d8181c9c05543f0a37ec225ec4118f34eb2d13a4494fe250a8118ddaf41cac87219da228182fffa32851e970f56c6f2cfb0f
- The last 32 bytes are the public key: 0x91dae31b6d33559fffd6092b5a3727b5d79c224e117cac59b57358003db9eefd
We now have all the information to manually verify a signature in our Move code!
3) Putting the pieces together
Our goal is to verify, using Move, the signature generated off-chain from an SDK. We have:
- The initial message the user signed (e.g., “Hello, my name is Quentin!”)
- The bytes returned by the SDK’s sign function
- The address of the user who signed the message
Based on everything explained above, we need to:
a) Create the intent message from the original message
b) Hash the intent message using Blake2b256
c) Split the signed result to ensure Ed25519 was used, and extract the signature and public key
d) Compute the address from the public key to ensure it matches the expected signer
e) Use the Sui Move Framework’s ed25519_verify function to check that the signature is valid
We’ve covered the first 3 points. Let’s now look at the final 2.
To compute the Sui address from a public key, append the Ed25519 prefix (0x00) to the public key and hash the result using Blake2b256. The Sui Move Framework provides the sui::hash::blake2b256 function to perform this hash.
For signature verification, use the sui::ed25519::ed25519_verify function, which takes the signature, the public key, and the message. Remember: the message here is the hashed intent message we computed in step 2.
I’ll share an example Move implementation for all these steps in the comments!
4) Conclusion
Verifying a personal message on-chain can be a niche use case, but for some projects it’s absolutely necessary.
This article took me some time to write, if you liked it, I’d really appreciate a share, like, or follow! 🫶
Revived my 15-year-old PC and turned it into a Linux server with Coolify.io to deploy apps Vercel-style. What a fun and smooth setup journey! 🚀
I would also to thank my co contributes to bringing this framework to life @onchainpixel, @memeinyou and @tantaofsui. 🧡
Reblixt retweeted
🔊 $FLUX @runonflux is now available for trading on Kraken!
✔️ Deposits and withdrawals are enabled
🎉 Trading is now live!
Trade here ⤵️
krakenpro.onl/9f1e/e659lml9
*Geographic restrictions apply
Reblixt retweeted
Regeringen döljer kostnader, de skär inte ned.
Medborgerlig Samlings ekonomipolitiske talesperson, Erik Kärnekull, beskriver träffsäkert varför vi inte har en marknadsliberal högerpolitik att tala om i Sverige.
”Höger-regeringen” vågar inte göra upp med de massiva offentliga kostnaderna. De lever i samma bubbla som den kollektivistiska socialismen och har blivit vänsternormativa i sin världsuppfattning.
I verkligheten bör vi:
- Avveckla Arbetsförmedlingen
- Avveckla myndigheten för stöd till trossamsfund
- Avveckla Jämställdhetsmyndigheten
… och så vidare. The list goes on.
Vi måste stoppa skatteslöseriet och skattemissbruket så att Sverige får råd att lägga pengar på det som verkligen behövs: Energi, vägar, äldreomsorg och bra skolor.
För att detta ska bli verklighet KRÄVS att Medborgerlig Samling tar plats i riksdagen.
Vad väljer du: Dagens rödvinsvänster eller roséaktiga socialliberalismen eller riktig marknadsliberalism? Det sistnämnda kommer åter skapas då MED når riksdagen.
Glöm inte det då du röstar 2026.
Daniel Sonesson
Partiledare Medborgerlig Samling
MED:s ekonomiskpolitiske talesperson Erik Kärnekull kommenterar regeringens nyligen lagda budgetproposition:
#ekonomipol #svpol
Dear @SoloditOfficial
How come my router, antivirus and email provider preventing me from accessing your content.
If it wouldent be for @PatrickAlphaC i would not bother. But I want to continue my security solidity Journey.
To be better but this sucks :(
Reblixt retweeted
Dear @ThierryBreton ,
The European union and the foundation it rests upon was a promise of peace, democracy and liberty. It was supposed to be a collaboration of trade and economic opportunity.
Recent developments with the European commission, suggested politics which are close to come reality, some resolutions which already have and your open communication to the world is a sounding alarm of the outright authoritarian, totalitarian and non-democratic direction the European union and its career politicians are moving into.
It is shambolic that the European union made a resolution enabling the commission to take subjective decisions on what is regarded as ’wrong opinions’ and therefore to be censored with the label ’hate’. This is a threat to the very reason and purpose the European collaboration once was founded on. That Swedish fake-Liberty oriented parties such as Moderaterna, Liberalerna, Centerpartiet and Kristdemokraterna signed this resolution is an act of treachery to the voters they represent and the EU-commission is an executive power of this democracy threatening act.
The other act ’Chat control’ which is supported by the same fake-Liberty oriented parties in Sweden, which is going to manifest European surveillance upon all European citizens and scanning messaging apps is an act any dictatorship would take pride into and document as a huge success in their oppression of their people.
You now posing threats to an entrepreneur interviewing an eligible presidential candidate at a democratic and free platform is an abysmal and authoritarian move. @elonmusk has declared that Google and Meta (owner of Facebook and Instagram) accepted your wish to be able and quietly censor people’s opinions in social media and that ’X’ refused this. The refusal is the only democratic act.
It seems as you career politicians have forgotten why you exist. You have a job to build a better society for people and the citizens paying for your salaries with their hard earned tax money.
Nowhere were you asked to build a closed society where Europe become less free and where you finance witch hunts on large parts of European citizens, paid for with their own money.
It is a disgrace. Step back and let the market and consumers decide for themselves what they support and not. The right way is never to silence, to threaten and to censor opinions. Opinions exist whether you like it or not. Let people live free lives.
Stop killing the belief in the free European collaboration we once believed in.
Daniel Sonesson
Party leader Medborgerlig Samling
- Swedens only non-fake liberty oriented market liberal right
Reblixt retweeted
For whoever needs to hear this:
Learning technical stuff can be a real drag—sometimes, it's just boring, and other times, it's downright frustrating.
You'll have days when you're pumped up and can power through the tough parts and other days when you're ready to throw your computer out the window.
The superlearners are defined by how they handle those tough days when they feel like giving up.
On those days, you can brain-hack yourself by saying:
"I'm going to commit to doing [insert one small thing] today."
It has to be a tiny commitment so it doesn't feel overwhelming.
Some days, I do the bare minimum and call it a day.
But most of the time, once I start, I study for 2-3 hours and feel great.
On low-energy days, you might switch to watching or reading educational content instead of diving into hands-on work.
It’s still productive but takes less effort.
The key is to do something every day to keep moving forward in your career!
Remember that it's a marathon and not a sprint.
Reblixt retweeted
An Open Letter to @coinbase @krakenfx **A Thread**
We are tired of watching dog coins added while real groundbreaking tech is passed by. #Flux is the clear leader in #Depin and #Web3 so what gives?
Flux: Building the New Internet-DePin Leaders
Flux By the Numbers:
125,000+ Transactions per day (beating $LTC, $BCH, and other Bitcoin Forks)
25,000+ Applications running on the $Flux network (625% increase over the past year)
7000+ GPUs Ai and Render #FluxEdge, Alpha (leaderboard.fluxcore.ai/)
Total Cores: 101,240+(home.runonflux.io/dashboard/…)
Total RAM: 262.46 TB
Total SSD: 6.80 PB
Total HDD: 1,474.98 TB
CMC Top 175 (Organic growth and development)
11 Parrell-Asset Chains, Including BASE
Zelcash rebranded into Flux, a decentralized and cloud-based computation network, three years ago. Since then, Flux has grown into an ecosystem with different specialized offerings while maintaining an overarching vision: becoming the cloud infrastructure base of the new internet.
How does Flux address the rapidly evolving internet's needs, challenges, and limitations? Most importantly, how are we shaping the future of decentralization today?
Application Resilience
Flux's decentralized network of nodes addresses the inherent limitations and risks of the traditional infrastructural system. Applications that operate on the centralized mechanism offered by Web2 providers are often susceptible to single-point failure risks, ranging from accidents and natural disasters to distributed denial of service (DDoS) attacks. When the OVH data center in Strasbourg was knocked out in a 2021 fire incident, over 3.6 million websites went dark (including around 2% of the . FR domain extension user base).
Flux Cloud, however, offers a different approach: deployed DApps are distributed over a geographically decentralized network of 13,000+ nodes, with each application spawned on a minimum of three instances. If the current application instance goes down due to any issue, the server load is immediately rebalanced, and another instance takes over while maintaining data integrity. This positions the network as a perfect solution for handling application needs where resilience and high availability are critical factors.
Privacy and Security
Using industry-standard encryption, Flux offers incredible privacy and security for all products across its platform. Two significant solutions for securing digital assets and tokens are @zelcore_io and @SSPWallet_io wallet.
Zelcore is a multi-chain, Web3-based, non-custodial wallet platform. It features parallel assets and other integrated applications that connect Flux with other blockchains, link users to different exchanges, and enable node operators to manage their FluxNodes. Its decentralized 2-factor authentication system called Flux-ID further enhances the wallet's security. This system also ensures that all digital footprints and password information are wholly wiped off immediately after users exit the app, erasing the possibility of a compromised wallet.
Flux rolled out the SSP wallet earlier this year as a paradigm shift to self-custody, usability, and crypto-security. SSP, available as a Chrome extension, boasts a multi-sig design that requires transactions initiated on the wallet to be signed by a corresponding private key (mobile app) before being authenticated. The seeds are never shared between the devices, rendering it an impenetrable 2-of-2 wallet. SSP also retains a simple, user-focused interface that targets new Web3 users, providing a seamless interaction experience.
Decentralizing Content Delivery
Early this year, Flux released a decentralized version of WordPress, the world's most popular CMS software. WordPress on Flux offers a unique proposition, with the flexibility of WordPress and the turbo-charged performance of the Flux computational network. On the other hand, it also illuminates a pertinent issue: the centralization of internet traffic in the hands of a few providers.
WordPress on Flux benefits business owners, bloggers, journalists, and others. It relies on an infrastructure free from the genuine threat of de-platforming, ensuring the continuity of its online presence.
Also, its flexibility, affordability, and high availability offer a winning proposition for e-commerce store owners. Business owners can leverage the inbuilt Flux geolocation support to spawn their application instance on nodes closest to their target market, reducing latency and enhancing accessibility. Geolocation support also allows developers and owners to manage any regulatory or compliance-based restraints on the use and operation of their applications.
WordPress on Flux delivers impressive performance with lower overhead costs than traditional hosting providers.
Environmental Sustainability
Flux is committed to ensuring innovative solutions are scalable, energy-efficient, and environmentally sustainable. To ensure this, the ecosystem uses an ASIC-resistant mining algorithm to regulate energy levels. Flux has also migrated to adopting a Proof of Useful Work (PoUW) consensus instead of the high energy demands of a classical POW project.
Flux advocates for a negative carbon footprint to build sustainable environments. Therefore, in 2022, Flux signed the crypto climate accord– a private sector-led initiative for the entire crypto community focused on decarbonizing the cryptocurrency and blockchain industry in record time.
Decentralized Physical Infrastructure Networks:
Flux is also positioning itself as a significant player in the DePIN industry with the FluxEdge Marketplace (currently in alpha). FluxEdge will provide a vital platform that allows researchers, businesses, and startups to access GPU resources easily and at more competitive prices. It aims to address the current computing strain that has become a severe bottleneck to critical advancements in AI, machine learning, and the Internet of Things (IoT).
Flexibility and Pricing:
Payment on decentralized platforms often requires interaction with a wallet. While this may be fine for users already accustomed to the ecosystem, it usually poses a steep curve for new adopters. Therefore, Flux has a fiat payment mechanism in place that allows users to pay directly for cloud services.
In April, Flux Single Sign-on (SSO) was implemented to allow users to log into FluxOS applications without requiring a wallet. Instead, they can use the more familiar alternatives like Google Sign-in, Apple ID, or an email address.
Flux offers affordable prices for its services, making it an ideal choice for scaling out applications while managing costs. For example, renting a 2 vCPU (8 GB/100 GB) on Flux costs less than $10, compared to $176 on Google Cloud and $116 on Azure.
Partnerships and Collaboration
Flux maintains a massive network of partnerships and collaborations with companies that are top players in the blockchain and tech landscape. These include Lumen, Nvidia(inception), Suse, Presearch, Rosetta SeeedStudio, Kadena, and CoinRequest. The future of decentralization can only be made possible on a united front, and Flux is committed to breaking boundaries by fostering synergy within and across industries.
Flux's unparalleled infrastructure network, service delivery, and cost-effectiveness position it today as a foremost decentralized cloud solution provider. We are changing the narrative. We are building the new internet. We enable users to transition seamlessly into Web3 technologies. Welcome to the new world.
Reblixt retweeted
Medborgerlig Samling tar ställning för individens frihetliga rätt att äga och innovera inom digitala tillgångar och kryptovalutor.
Okunniga och klåfingriga politiker inom EU har röstat för direktiv som minskar integriteten för kryptoägare. I Sverige har Finansinspektionen uttalat anledningar varför man inte ska köpa kryptovaluta. Det är inte rimligt att digitala tillgångar ska ha sämre förutsättningar än andra råvaror eller valutor enkom för att banker räds och försvarar sina gigantiska monopol.
Vare sig Sverige eller EU har råd att vara ett sämre alternativ i världen för morgondagens ledande tillväxtjättar och innovativa tillväxtbolag att etablera sig i och skapa jobb samt idékraft.
Sverige har redan EUs sämsta tillväxtprognos och vi måste ligga i framkant för att vara en självklar destination för de bolag som kommer ta fram morgondagens teknik, lösningar och arbetstillfällen.
Att äga och innovera inom digitala tillgångar är en frihetsfråga och hänger också ihop med ett fritt internet. Det ska vi bevara. Det ska vi försvara. Det är inget att frukta. Dags att sätta stopp för politiker att ta beslut vars konsekvenser de inte ens själva förstår.
Nu tar vi ställning för innovation och kryptovalutor.
Läs mer på med.se
Daniel Sonesson
Partiledare Medborgerlig Samling
NU LANSERAR MED EN POLITIK FÖR KRYPTOVALUTOR
Kryptovalutor är en utveckling med potential att ge makten över privata finanser tillbaka till individen. MED vill öppna dörren till framtidens ekonomi. Därför lanserar vi Sveriges första politiska program för kryptovaluta.
Vi vill förändra dagens politik som går ut på att begränsa, bestraffa och övervaka. Istället vill vi skapa frihet för innovation och utveckling, stärka rättvisa och integritet för individer och öka konkurrensen för banker.
Bra politik värnar individens frihet, skapar rättvisa och möjliggör utveckling och tillväxt.
Här kan du läsa mer:
med.se/var-politik/kryptoval…
Vi i MED brinner för bra politik!
