SHI2 Wallet documentation

Custody: where your keys live

SHI2 Wallet is non-custodial in the strict sense: there is no server, no account, and no recovery desk. Your seed phrase is generated in your browser, encrypted in your browser, and stored in your browser. Nothing that can move funds ever leaves the device.

What	How
Encryption	AES-256-GCM via WebCrypto. The key is derived from your password with PBKDF2-SHA256 at `310,000` iterations, with a random 16-byte salt and 12-byte IV per keystore.
Storage	One encrypted blob in `localStorage`. A wrong password fails the GCM auth tag cryptographically. There is no server-side check, because there is no server.
While unlocked	Decrypted seeds live in module memory, never in app state. A reload does not ask for the password again: the seeds are also held in this tab's session storage, encrypted under a random non-exportable AES-256 key kept in IndexedDB, valid only inside the auto-seal window, rotated on every restore, and destroyed by Lock, by Reset, or by closing the tab. A new tab always asks for the password.
Auto-seal	The vault seals after 15 minutes without input by default (configurable, 0 disables). Sealing one tab seals every tab.
Across tabs	A cross-tab guard propagates locks and wipes: delete the keystore in one tab and every tab resets. Rewrite it and every tab re-locks.
Demo isolation	The `/showcase` demo is severed from real storage at the storage layer itself. Every path that could write the keystore is gated on the demo flag, so a demo can never overwrite your real one.

Taking your keys with you

Self-custody that cannot be left is not self-custody. Settings holds two doors, both behind your password and both closed in the demo. Reveal Seed Phrase shows the twelve words, which open every seal of that lineage on every chain. Export account keys shows the private key of the active seal alone, in the exact shapes other wallets ask for on import: hexadecimal for MetaMask or Rabby, and the base58 sixty-four byte form for Phantom. The two are deliberately separate, because a key that opens one address is the right thing to hand over when only one address needs to move, and the words are far more than that. Neither is ever written to storage, sent anywhere, or left in memory once the panel closes.

Metadata poisoning is designed out: only public data (labels, indexes, addresses) persists between sessions, and on every unlock all addresses are re-derived from the seed itself. The lock screen shows no address at all. Nothing unverified is displayed before the seed proves it.

II.

Getting started

Creating a vault

The ceremony shows your twelve words once, then requires you to recall three of them, chosen at random, before you may set a password of at least 8 characters (the strength meter is local and deterministic). A browser that refuses storage (private mode, full quota) is reported loudly instead of letting you believe a vault exists.

Every new vault is born marked: a background search finds an address ending in dead within seconds and makes it your first seal. Creation never blocks on it. If the search needs longer than 20 seconds, the wallet proceeds and tells you.

Restoring

Restore with your twelve words on any device, set a fresh password, and the same addresses rise again. The password only guards the local copy. The words are the wallet. An imported seed's first address may already hold funds, so the marked seal is added alongside it, never over it.

III.

Losing a device

Nothing that matters lives on the device. Funds are on-chain. The keystore is an encrypted local copy of keys that derive from the twelve words. Install the wallet anywhere, restore with the words, and everything returns. There is no password reset and no support channel that can help. This is by design, because any channel that could recover your wallet could also steal it.

The words are the single point of truth

Lose the twelve words while your device is dead, and no one can help. This is exactly what the Afterlife Protocol exists for: if you can no longer transact, silence eventually falls, and your named heir can still claim the Tablet (section XV). Write the words on paper. The Testament (section XVII) gives your heir everything else they need.

IV.

Seals and dynasties

One vault holds up to 8 seed phrases (dynasties) with up to 64 accounts each, derived on the standard EVM path m/44'/60'/0'/0/{index}. Each seal has its own address, balances, and history. One password seals them all.

Unlocking a completely full vault takes under a second. The derivation pipeline was rebuilt after profiling showed 4.7 seconds. It now measures 0.9.

The Forge: marked addresses

The Forge searches your own seed's address space for addresses bearing a mark, by default the protocol's dead suffix. It searches over the extended public key only: Web Workers never see a private key, and the seed never leaves the main thread.

Property	Detail
Speed	About 3,600 candidates per second per thread via public-key point arithmetic. This is 29× faster than naive derivation, verified address-identical against the signer library.
Marks	2 to 5 hex characters. Expected work is stated before you start: a suffix of n characters costs about 16ⁿ candidates.
Determinism	A sequential-window protocol (windows of 65,536 indexes) guarantees any device, any thread count, finds the same address for the same mark.
Honesty	The both-ends mark (`dead` at the start and the end) has only ~39% odds of existing in your seed's search space at all. The UI says so before you burn CPU, not after.

Which seal stands first

A vault raised here is born with a marked seal: a background search finds an address ending indead within seconds and makes it yours. A restored seed is different. Its first address may already hold funds, so the marked seal is added beside it rather than over it, and the plain address keeps the place it was born into. Order in the list is birth order, which is rarely the order that matters to the owner, so any seal can be lifted to the top from The Seals. Only the display order moves. The derivation index, the address, and the path are untouched, because moving a row must never change which address belongs to whom.

Two marks in one address, dead at the start and at the end, is a different order of work from one. A single suffix costs about 65,536 candidates and lands in seconds. Both ends cost about 4.3 billion, which is more than the whole account space of a seed, so it may simply not exist there. The panel states those odds before it starts. The Tablet address is where the double mark is actually within reach: it is chosen by a CREATE2 salt rather than a derivation index, and that space is large enough to hold one.

Forged seals and other wallets

Forged addresses usually live beyond the BIP-44 gap limit of 20 sequential accounts. MetaMask or Rabby importing your twelve words will not find them automatically. Each seal carries its full derivation path. Add the account by index in the other wallet, or keep using SHI2 Wallet.

VI.

Sending

The lookalike guard

Address poisoning is how most drained wallets are actually drained. An attacker mines an address whose first four and last four characters match one you already send to, dusts you from it so it lands in your history, and waits for you to copy it. The short form every wallet displays, 0x1234...abcd, hides exactly the part that differs.

So the review screen compares the destination against the addresses you have proven you trust: your contacts, your own seals, and every address this wallet has actually sent to. If the ends match but the whole does not, both addresses are printed in full with the differing characters highlighted, and you decide with your eyes open. A first-ever recipient is marked as such too, quietly. This works in both realms, with EVM compared case-insensitively and Solana exactly, because base58 is case-sensitive.

Every send passes a Review step with a network-cost estimate first, and is recorded as success only when the receipt says success. A transfer that mines but reverts is reported as a failure, never as done.
Recipients: raw addresses, ENS names (resolved against Ethereum mainnet regardless of the active chain), and your local address book, which keeps EVM, Solana and Bitcoin addresses (the Bitcoin ones serve Swap's Bitcoin leg). Optional whitelist-only mode restricts sending to the book, your own seals, and your Tablet, and it applies to Bitcoin destinations in Swap as well.
The Max button measures the real gas buffer instead of guessing: 2× headroom on execution cost, and on OP-Stack chains 3× on the separately-billed L1 data fee, read live from the chain's own oracle.
Wallet-born transactions carry eleven UTF-8 bytes, SHI2 Wallet (0x534849322057616c6c6574), appended to calldata (~176 gas). Open any of them on an explorer and read the input data as UTF-8 to see it. The tag is estimate-guarded and skipped anywhere it could break a transfer. Aggregator calldata is never touched.
Amount input is locale-aware: comma or dot decimals by locale, thousands separators stripped, and Arabic-Indic, Persian, and Devanagari digits accepted.
A send that lingers in the mempool can be sped up or cancelled from Chronicle. The wallet reads the broadcast transaction back from the chain, nonce and fees exactly as sent, then signs a replacement with the same nonce: the same transfer with both fees raised at least 12.5 percent and never below the current market, or a zero-value transfer to your own address that cancels it. One nonce can land only once, so the original and the replacement can never both settle. Before anything is broadcast the original's receipt is checked, and a send that already landed is simply marked as such. Solana transactions cannot be replaced this way.

VII.

Swap and the Crossing

One panel, two legs, any chain on either side. The token button on each leg opens a picker with every chain down the left, Solana included, and a search box on the right that takes a name or a pasted contract address. The wallet's active network does not limit the choice: the same seed signs on all ninety-one EVM networks and, through its derived key, on Solana, so you never have to switch networks first. Pick USDC on Base to sell and SOL to buy, and the panel does the rest. Bitcoin sits in the receive picker too: any asset on any chain can end as native BTC at an address you type.

Behind that single panel sit three engines, chosen from the pair of legs and each keeping its own guards: LI.FI for EVM to EVM, whether the same chain or a different one, Jupiter for Solana to Solana, and the crossing engine for Solana to EVM and back, and for the last hop into native Bitcoin from either realm. Every route is executed, not merely quoted: the wallet sends the transaction and verifies it landed. A complete form quotes itself after a short pause, and a quote that ages refreshes itself rather than leaving dead numbers.

Guard	Behavior
Token by address	Paste a contract address into the receive picker and its metadata is read from the contract itself. The homoglyph guard still applies, and the full address stays visible, because the address is the token's only identity. After a successful swap the token is saved so its balance shows in Assets.
Slippage	Presets 0.1% / 0.5% / 1% plus a custom value up to 50%. Changing it voids the current quote. Slippage wide enough to feed sandwich bots draws a warning instead of silence.
Anti-MEV	On Ethereum and BNB Chain the trade can travel through a private relay, Flashbots Protect or 48 Club, so the public mempool never sees it before it lands. Those are the only two relays wired in. Everywhere else the panel says plainly that no relay is available on this network, rather than drawing a shield that is not there.
Price impact	The change between the USD worth of what you pay and what you receive, taken from the aggregator's own numbers, never computed cosmetically. Past five percent it becomes a warning.
Thin pools	When every route is filtered out because the trade would move the price too far, the panel says by how much, taken from the aggregator's own refusal, and offers both ways out: an amount computed to fit under the limit, and selling the whole balance anyway with the loss stated in the button itself. The aggregator's ten percent ceiling is its policy, not the chain's, and it is your coin, so the wallet raises the ceiling on your say-so rather than deciding for you. Quarter, half and three-quarter buttons sit under the amount as well. A thin pool is the normal state for a young meme token, not a fault.
Auto-quote	A complete form asks for its own route after a short pause, and asks again when the 75-second passage expires. Nothing executes without your press.
Quote age	Bridge quotes expire after exactly 75 seconds and are re-checked after a slow token approval. A stale quote is refused before signing.
Recipient guard	The address embedded in the route is compared with the recipient you expect, before signature. Cross-chain sends cannot be canceled, so mismatches never reach the network.
Bitcoin destination	BTC can be the receiving leg from any chain. The wallet holds no Bitcoin key, so it never offers an address of its own: you type one, it is checked against the bech32, bech32m and base58 checksums, and the recipient embedded in the route is compared with it character for character before signing. Bitcoin routes take longer and carry a minimum, both shown in the quote.
Balance pre-check	Value plus worst-case gas is checked up front, so an opaque node rejection after signing never reaches you.
Simulation before signing	The exact transaction is run against a node first. A route that can no longer deliver the minimum it quoted reverts there, and the wallet says which guard refused it, in the contract's own words, before any gas is spent. A node that merely times out never blocks a valid trade, because a silent node is not a refusal.
Gas is not part of your position	For a native coin, the amount buttons and Max sell a share of what is left after the route's own fee is set aside, never a share of the raw balance, because the fee is the price of selling anything at all. The reserve is priced with the same fee the transaction will actually be signed with, which is higher than the plain gas price a node quotes. When a quote costs more gas than the balance can carry, the panel says so with the figure, offers the corrected amount in one tap, and disables the button rather than letting the refusal arrive after the press.
Smart slippage	The tolerance chooses itself from the route's own price impact, which is the honest measure of how thin the pool is. A deep pair stays at half a percent. A thin pool gets more room, because a pool that moves for your trade also moves for everyone else's in the same block, and a limit set too tight makes the trade revert and burn gas for nothing. The automatic value never passes three percent, and picking a preset or typing your own switches it off for good.
Protocol fee	When active, a 0.25% fee is included and printed on the quote screen. It is currently inactive. The label, the status and the charge all derive from one constant and cannot diverge.
Testnets	Aggregation does not exist on testnets, and the wallet says so instead of simulating.

Destination-side settlement of a crossing belongs to the bridge and can take minutes after the source receipt. A crossing that reverts at the source moves nothing.

Finding what to buy

Discover, under Explore, lists for the active network the pools GeckoTerminal ranks as trending and the pools created most recently, with price, 24-hour change, volume, liquidity and the pool's age, shown exactly as GeckoTerminal reports them. Tapping a token reads its contract, or Jupiter's index on Solana, for its real decimals and opens the swap panel with it on the receive side. The list is a market feed, not a recommendation: a pool that leads the table can lose its liquidity within minutes, the panel says so, and nothing is ever bought without your press on the swap button.

VIII.

Token import and approvals

The hall of a token

Tapping any row in Assets opens that token's own hall: a price chart over a day, a week, a month, a quarter or a year, what you hold and what it is worth, the issuer powers still live on it where the data exists, and a link to the block explorer. Under the chart sit the three things you can do with it right there: send, receive, and swap. Swap opens the trading panel with this exact token already on the sell side, matched by its contract address rather than its symbol, because two tokens on one chain can share a name and only the address is the identity. On a testnet the swap button is absent, since no aggregator serves those.

Importing a token

Metadata is read from the token contract itself, with no third-party list. Because that metadata is attacker-controlled text, symbols are capped at 12 characters, names at 48, decimals validated 0-36, and control and bidi characters stripped. Anti-spoofing rejects a symbol that collides with an existing token even through Cyrillic or Greek lookalikes, using an NFKC skeleton comparison.

An imported token has no market listing, so its value comes from its deepest DEX pool through DexScreener, and only when that pool holds at least $1,000 of liquidity. A price from a two-dollar pool is not a price, and the row shows no value instead of a number that means nothing. Listed coins keep their CoinGecko price. Both sources are read through the backend cache when it is reachable, and directly otherwise.

The revoke panel

The approval scanner reads on-chain approval logs, then re-verifies each against current chain state, so revoked history is never shown as live. Allowances at or above 10³⁰ are classed unlimited and sorted to the top. When a public RPC caps the scan range, the result is flagged incomplete. A list that hides its own gaps is worse than no list.

The panel exists for a serious reason: inheritance transfers the Tablet, not its history. Spending approvals granted by the previous owner survive, and the heir, who never consented to them, gets a panel to see and demolish them.

The same scanner serves your own address, not only the Tablet. Approvals, under Explore and in Settings, lists every allowance and operator approval still standing for the active account on the current EVM network, and strikes each down with a transaction signed by that account: approve to zero for a token, setApprovalForAll to false for a collection, or approve to the zero address for a single NFT. Each revoke is estimated before it is signed, recorded in Chronicle as pending, then confirmed or marked failed from the receipt. Solana keeps no such log, so the door does not appear in that realm.

Small balances

Assets can fold every holding priced under one dollar into the resting group, from a switch at the foot of the list that appears only when there is something to fold. A token with no price is never treated as small, because no price is not the same as no value, and the native coin stays in view even when everything else is small.

IX.

Launching a token

The Launch menu sends a token to the launchpad you choose, from this wallet, with your keys, on the launchpad's own contracts and open APIs. The list opens with BNB Smart Chain, the wallet's home, then Solana, Ethereum and Base in order of trading volume on DEX Screener, at most three pads each. Five pads launch natively, Solana included: the vault's seed also derives a Solana key on Phantom's own path, so the same twelve words sign in both worlds and never leave the device. A pad with no verified public creation path is an honest outbound link, never a form that ends in nothing.

Pad	How it launches
flap.sh	The house pad of BNB Smart Chain, and the launch venue of the SHI2 token itself. flap.sh and docs.flap.sh were checked on 2026-10-14 and expose no public create-token contract, SDK or API, so the wallet does not pretend to launch there. Pick it and flap.sh opens in a new tab, where the launch happens on their own site. The wallet never dresses an outbound link up as a form.
pump.fun	Solana. The metadata pins through pump.fun's own IPFS route, PumpPortal's local API assembles the creation unsigned, and the vault's derived Solana key signs it on this device together with the newborn mint key. We broadcast it ourselves. Creation is free, the route takes half a percent of the first buy only.
LetsBonk	The same local route pointed at LetsBonk's LaunchLab pool on Solana. Identical custody: assembled unsigned, signed here, sent by us.
four.meme	The wallet signs you in with a message signature, uploads your image, asks four.meme's backend to countersign the creation, then submits `createToken` on BNB Smart Chain, the wallet's home chain. Supply is fixed at one billion by the platform, and the raise parameters are copied from their live public config, never invented.
Clanker	A direct call to Clanker's public v4 factory on seven chains, Ethereum, Base and BNB Smart Chain among them. The token and its Uniswap pool deploy in one transaction, simulated first. Optional creator lock, seven days at minimum, and an optional first buy.
Flaunch	A Uniswap V4 launch on Base through Flaunch's public contracts and keyless IPFS uploader. You set the starting market cap and your own share of the trading fees. Flaunch charges no protocol fee below a 10k USD market cap.

Launching costs gas plus whatever first buy you choose. The wallet never takes custody of the new supply: it lives in the launchpad's contracts, under that launchpad's published rules. Every EVM launch is inscribed in your Chronicle with its network and transaction. A Solana launch is not, because the Chronicle builds its explorer links from an EVM network and would point at the wrong chain. Its receipt carries a Solscan link instead.

Watching other wallets

Every address is public, and the Watch menu treats that as the feature it is: paste any address or ENS name and see what it holds across the five EVM networks with the most users, Ethereum, BNB Chain, Base, Arbitrum, and Polygon. Paste a Solana address and it is read on Solana instead, through the same path the Assets tab uses. Balances come from the chains, prices from the same public feeds the rest of the wallet uses, and assets without a public price are counted out loud instead of silently rounded to zero.

A watched wallet gets a baseline: the value it held when you began watching. What the panel shows after that is honest value change, labeled as such, because deposits and withdrawals move it too. Trade-by-trade PnL of a stranger's wallet needs a paid indexer of their whole history, and this wallet does not pretend to have one. Watching is read-only in the strictest sense: nothing is ever signed, and the watchlist lives in your browser, not on a server.

XI.

The Solana realm

Solana is not an EVM chain, so the wallet treats it as a realm of its own rather than as the ninety-second row in the chain list. Pick Solana at the top of the network selector and the same twelve words yield one Solana account, derived on the path Phantom and Solflare use, m/44'/501'/0'/0'. Restore the words in either of those wallets and the same address appears. One account per seed, on purpose: EVM seals sit at mined derivation indexes (that is how an address comes to end in dead), and binding Solana to those indexes would produce addresses no other wallet ever shows. Nothing is uploaded, and no second seed exists.

Assets, Send, Receive, and Swap all work in that realm. SOL and every SPL or Token-2022 balance you hold appear on their own, with names and prices from Jupiter's public token index. A token Jupiter does not know is still listed by its mint address, with no price invented for it. Sends build the transfer instructions locally, simulate them against the chain before anything is signed, refuse to sign if the simulation would spend more SOL than you reviewed, and say in advance when the recipient needs a token account opened and what that costs. Swaps are quoted and routed by Jupiter, with the slippage you set and the price impact Jupiter reports, behind the same fee-payer and simulation guards as launches. Confirmation is polled from the chain over plain HTTP rather than trusted to a websocket, and a transaction whose fate the network never reports is shown as unconfirmed with its signature, never as failed.

The Chronicle is different here, and better. On EVM chains it can only record what you did from inside this wallet, because a full account history needs a paid indexer. Solana gives that history away, so in this realm the Chronicle also reads the chain itself: recent transactions, what they did to your SOL and token balances, the fee, and whether the chain rejected them. Nothing is guessed about intent, because the same program can mean many things, and a wrongly named transaction is worse than one described plainly.

The hall of a token you hold carries what the issuer can still do to you. On Solana: whether the token is on Jupiter's verified list, and whether freeze authority or mint authority are still active, meaning your balance can be frozen or diluted, with holder count and liquidity beside them. On EVM networks: a reading from GoPlus, fetched through the SHI2 Wallet API so the token you are looking at is not reported to a third party together with your address. It lists only what is flagged (honeypot, buy and sell tax, mintable, blacklist, pausable transfers, owner can change balances, hidden owner, ownership that can be taken back, cannot sell all, unverified source, upgradeable proxy), plus holder count and the creator's share, with the age of the reading. It is a reading, not a verdict, and it never shows a score or a green light: what GoPlus does not know is left unsaid rather than shown as safe. On Solana the swap panel shows the same warnings before a trade. On EVM the reading lives here, where you look when you already own the thing.

Two honest limits. Public Solana RPC endpoints refuse browsers for the one call that lists token accounts, so that read passes through the SHI2 Wallet API server. Every other call, including the broadcast of your signed transaction, goes from your browser straight to the public RPC. And the Solana Tablet is a prototype until its program is deployed, so the Afterlife panel in this realm runs as a model: the wallet says so in place, with a way back, instead of showing an empty screen. Crossing between realms and the Solana Oracle are both shipped, in sections XII and XIV.

XII.

Crossing between realms

Solana and the EVM chains are different machines, and value does not simply walk between them. There is no separate bridge screen for it: pick a Solana token on one leg of Swap and an EVM token on the other, and the panel books a route through the LI.FI aggregator, which treats Solana as one more chain and hands back a ready-made transaction. Both directions work, from any of the ninety-one EVM networks into Solana and back out.

What the wallet refuses to do matters more than what it does. A crossing cannot be undone, so the recipient address is shown in full, never shortened, and the route itself is read before anything is signed: if the address embedded in it is not the one you reviewed, character for character, the wallet stops. On the Solana side the transaction must also name your account as the fee payer, and a simulation measures the SOL that would actually leave before a key touches it. On the EVM side the comparison is exact rather than case-insensitive, because a Solana address that differs only in capitalisation is a different address.

Any asset you actually hold can cross, not only the native coin: pick it and the wallet asks the aggregator which token of the same symbol exists on the other side, then says plainly what will arrive, for instance that USDC on Solana arrives as USDC on Base. If the destination chain has no such token on any route, the panel says so instead of quietly swapping you into something else. When the asset is a token rather than the native coin, the spend cap on the Solana side is zero, because only fees and account rent may leave your SOL balance.

Quotes expire after 75 seconds, the panel says how long is left, and an expired quote refreshes itself rather than leaving dead numbers on screen. Routes are quoted with a slippage limit of 1 percent, and the amount that would arrive at worst is shown beside the estimate, never only the optimistic number.

XIII.

Limit orders that outlive the tab

The Sentinel in the next chapter is honest about its limit: it fires only while the wallet is awake. On Solana there is a second kind of order that does not share that limit. Set a price in the Limit panel and the order is handed to Jupiter's on-chain trigger program, where their keepers execute it when the price arrives, whether or not this wallet is open.

The trade-off is stated in the panel, before signing, because it is real: the amount you are selling moves into Jupiter's on-chain escrow account while the order stands, and returns when it fills or when you cancel. That is not custody by us, and it is not custody by a company either, but it is no longer sitting in your own account. Open orders are listed with their price, and each can be cancelled in one signature.

The price you type is a ratio, not a market quote: how much of the output token you want for one of the input token. That is exactly what the on-chain program stores, so what you see is what is enforced, with nothing translated behind your back.

Because escrowed amounts have genuinely left your account, they are not counted in the total at the top of the wallet. So that the money is never forgotten, a line under that total says how many orders are still standing on-chain, and opens the panel in one tap.

XIV.

The Sentinel and the Oracle

Beside the Sentinel hangs the Knell: one-shot price bells, set from any Market row or from the hall of a token you hold, including imported tokens, which are keyed by contract or mint. EVM tokens are priced from their deepest pool, so a bell on a pool under $1,000 stays silent rather than ringing falsely. Solana tokens take Jupiter's price. When a coin crosses your threshold the bell rings once, in the app and as a browser notification if you allowed it, then falls, so an alert never becomes a noise. Bells ring only while the wallet is awake, and the wallet says so where you hang them. The Assets header also carries a daily line, the change in your holdings' value since yesterday, labeled as value change because deposits and withdrawals move it too.

Client-side Sentinel (shipped)

Standing stop-loss and limit orders, checked every 45 seconds while the wallet is awake and unlocked. It is not an anti-sleep keeper, and the UI says so.
Execution takes a 10-minute lease with tab identity, closed against multi-tab races via the Web Locks API. A refresh mid-execution cannot double-fire an order.
Prices older than 90 seconds never sign. Display tolerates 5 minutes. Spending does not.
Three attempts, then the order fails permanently. Your cancel is final and is only ever overridden by the on-chain fact of an already-broadcast transaction.

On-chain Sentinel (built, awaiting deployment)

SHI2Sentinel holds orders that survive sleep: Chainlink-triggered, with an executor tip of 0.5% by default, capped at 1%, and a 90-day order TTL. The owner is protected by a dynamic floor, the oracle price at execution minus at most 1% slippage (hard cap 10%), plus an absolute minimum-output floor. Failing either reverts everything. No deposits: funds move only via your allowance at execution, and you can cancel anytime before. The router whitelist is fixed at deployment with no admin function. On BNB Smart Chain it names one router, SHI2Router, the wallet's own.BUILT · AWAITING DEPLOYMENT

The Oracle (shipped)

The natural-language order parser is rule-based and deterministic: no LLM, no API key, fully client-side, in the same 20 languages as the interface. Three audited rules keep it safe: trigger direction is never guessed, the first-named token is the one released, and every number carries its token unit so "buy 100 USDC with ETH" can never become 100 ETH.

XV.

The Afterlife Protocol

The full mechanism design lives in the whitepaper. This is the operator's view.

Step	What happens
1 · Raise	Raise your Tablet: a smart account whose address ends in `dead`, mined deterministically so the address is identical on every device, even before deployment.
2 · Name	Name exactly one heir and a silence period: 180, 365, or 730 days. Default one year. You can change or unbind either at any time.
3 · Live	Every transaction the Tablet sends is an implicit check-in, and Light the Incense in the Afterlife tab is the explicit one, a single stamp that resets the clock. Transactions from your plain seals do not touch the timer. The interface tells you this to your face.
4 · Silence	If the timer runs out, the heir may start a claim. This opens a hard 30-day grace window.
5 · Grace	One transaction from you, any transaction, cancels the claim instantly. As long as the incense burns on-chain, the Tablet is yours.
6 · Handover	If grace passes untouched, ownership transfers. Assets follow the account: every token, every balance, in one transfer.
7 · Clean slate	The heir receives an unconfigured Tablet. Your heir setting and timer are deleted, never inherited. The revoke panel then shows them every approval you left behind.

Fail-open is the protocol's spine: a broken or malicious inheritance module can never freeze the Tablet, because every fund-moving path treats the module as optional. Availability of your own money outranks every other property.

Deployment status: the contracts run on a local development chain today, covered by 89 tests. On networks without contracts the app shows the Afterlife panel as an explicit model. Public deployment begins on BNB Smart Chain, the wallet's home, after the security checklist.

XVI.

The final form and the gas for the heir

Inheritance moves the Tablet, not what it holds, and a Tablet holds whatever the owner traded into: a dozen meme tokens on a chain the heir has never used. So the owner inscribes a final form: the one coin everything should become for the heir. The default is Bitcoin. An heir who receives one balance in the oldest and most widely held coin needs no knowledge of the chains the owner traded on, no gas on any of them, and no wallet that speaks smart accounts. Bitcoin has no contracts and no address a Tablet could derive, so the owner also writes the Bitcoin address the estate should arrive at. The wallet checks it against the bech32, bech32m and base58 checksums before it can be signed, and the module stores it beside the wish, written by the Tablet itself in a transaction the owner signs, readable by anyone and independent of this wallet's servers. The other forms stay on offer: the native coins of the main chains and USDC where it has an official issuer, because a wish that names a coin no aggregator can route into would leave the heir with an instruction nobody can carry out.

The conversion itself does not happen inside the contract. The module keeps transferring ownership, and after the claim the heir's claim panel reads the wish and carries the estate across, asset by asset, into that form, one signature per step on the heir's side. That keeps the contract small and auditable, and keeps every swap behind the same guards the wallet uses for its own trades. For Bitcoin the panel first turns every token into the chain's own coin, then carries the whole balance across in one route through the LI.FI aggregator to the inscribed address, because Bitcoin routes carry a minimum per hop and a dozen small crossings would each pay it. The recipient embedded in that route is compared character for character with the wish before the heir signs. Such routes take longer than a swap on one chain, the heir sees the time and the minimum in the quote, and anything no route accepts stays in the heir's keeping instead of being sent somewhere the owner never named. What crosses is only what came from the Tablet: the heir's balance is measured before the sweep and the difference is what travels, so an heir's own coins never ride along uninvited. Every step that lands is written to the Chronicle with its transaction hash. If the owner chose Bitcoin and left no address, the claim panel asks the heir for one and moves nothing until it passes the same checks.

A fresh heir wallet has no gas, and a claim that lands on an empty wallet is a claim that stalls. So the same signature can set aside about five dollars of the chain's native coin inside the module. On the home chain that is BNB. It is refundable to the Tablet while the owner lives, and released to the heir at the moment the claim completes. If the heir turns out to be a contract that refuses the native coin, the claim still completes and the fund stays withdrawable through the Tablet the heir now owns.

The Solana Tablet

Solana has its own version of all of this: a program called shi2_afterlife, written in Anchor, in which the Tablet is an account owned by the program and derived from your key. The same rules apply. You name an heir and a silence period of 180, 365 or 730 days, every rite you stamp is proof of life, the heir opens a claim after the silence and waits thirty days of grace, and at the end the Tablet's owner becomes the heir, with SOL and tokens following the Tablet. The final form, its Bitcoin address and the gas fund live there too: the address is kept as up to 64 bytes of text inside the Tablet, and the fund is a portion of the Tablet's own lamports that ordinary withdrawals can never touch, released to the heir at the claim.

The program is built and tested against a real local validator through the full lifecycle, including the claim, and it is not yet deployed to mainnet, because deploying a program costs SOL and that is the project owner's call. Until then the Solana Afterlife panel is a prototype and says so. Solana holdings do not reach the heir through the EVM Tablet: they reach them through this Tablet once it is live, and through the Testament until then. Whoever owns the Tablet draws its SOL and tokens to their own key from the panel, the owner while alive and the heir after the claim. The heir's panel can also run the whole crossing by itself: draw the Tablet, turn every token into SOL through Jupiter, and carry what came from the Tablet across in one route to the inscribed address, leaving the heir's own SOL untouched. It is the same sequence as the EVM claim panel, and Swap stays open as the manual path with the address already filled in.

XVII.

The Testament

The Testament is a printable paper document for a notary, a safe, or a sealed envelope. It contains public addresses and instructions for your heir, and never a seed phrase, private key, or password, which the document itself states out loud. It ships with a calendar file: recurring check-in reminders, three per silence period, so two months apart on the shortest period and eight on the longest, each with an alarm 12 hours ahead.

XVIII.

WalletConnect

The bridge to external dApps is fully coded and dormant until a relay project id is configured. When active, it is deliberately narrow:

Seven whitelisted methods. Unknown methods are rejected, not forwarded. eth_sign (raw blind signing) is rejected forever.
A personal_sign payload that is exactly 32 opaque bytes is flagged as a disguised transaction hash.
The request's chain must equal your active chain, and typed data's own embedded chain id must match too. An innocent-looking envelope can wrap a permit for a chain you never saw.
Every peer-supplied string is sanitized (bidi overrides, zero-width characters, control characters), and the approval screen shows the origin host, never the dApp's self-chosen title.

XIX.

Networks, RPC, and the backend

91 EVM mainnets plus Base Sepolia for testing. One seed, the same address on every one of them. Solana is a realm of its own, reached from the top of the network selector: one account derived from the same seed on the standard path, with its own balances, sends, swaps, limit orders and history (section XI). It is never mixed into a per-network total: choose a network and the Assets tab shows that network alone. The one place both realms stand together is All chains, at the top of the same selector, which lists every asset you hold anywhere, each row naming its own network, and says how many networks answered.
Per-chain RPC overrides accept http(s) endpoints and are probed with eth_chainId before saving. In the demo they live only in tab memory, so a private endpoint with an API key is never exposed.
Each network has a primary public endpoint and, where one exists, a fallback. The wallet tries them in order and only then a relay on shi2wallet.app/api that forwards the same JSON-RPC bytes to those same endpoints. This exists because some ISPs hijack the DNS of chain RPC domains (Indonesian ISPs do it to Robinhood Chain's, one of the ninety-one networks in the list), and a silent endpoint must not read as an empty wallet: when balances cannot be read, the list says so under the last reading. Your own RPC override is always used alone.
The optional backend caches public prices, proxies swap quotes, proxies token-security lookups, reads Solana token accounts, relays JSON-RPC as that last resort, and pins launch metadata, all behind a rate limiter. Its logs record the route and the method, never the query string, so the contract you were about to buy and the address you were about to pay are not written down. It holds no keys and no funds, and cannot intervene in inheritance. The app works without it.
All chains: pick it at the top of the network selector and the wallet reads this same address on every EVM mainnet it knows, six networks at a time with a fifteen-second cap each, then adds the Solana realm to the same list. What you get is one list of every asset you actually hold, largest first, each row naming its own network. A network that does not answer is counted as silent and left out of the total, never counted as zero, and the count of silent networks stands under the list, where a tap names them. On EVM networks only native coins, each network's built-in tokens and the ones you imported are read, because there is no indexer. The Solana realm lists whatever the account holds. The scan runs only when asked, never on the sixty-second refresh, and its result is kept for two minutes. Tapping a row takes the wallet to that network, which is also what makes sending and swapping from there act on the right chain. Any row can be hidden, including a native coin. Hiding a token also folds it away on its own network, while hiding a native coin only affects this list, because the coin that pays for gas must never vanish from the network that spends it.

XX.

Privacy and storage

Telemetry: one empty counter ping when an address is forged, carrying nothing. No secret ever leaves your device, and no account or identifier is created for you. Your address does leave, because reading a public chain requires sending it: to the RPC endpoints of each network you use, to the price and token-security proxies below, and, if you open All chains, to every network the wallet knows. The table under this paragraph is the complete list, and the proxies exist so that a third party sees our server rather than your address next to your IP. Prices come from public endpoints without an account. Market numbers are cached for 90 seconds and always carry their age. Stale data is never passed off as live.

Data	Where it lives
Seed phrases	Encrypted blob in localStorage. While unlocked, the decrypted copy is in memory, plus a second copy in this tab's session storage encrypted under a random AES-256 key the browser holds as non-exportable in IndexedDB. That second copy is what lets a reload reopen the vault without the password. It dies with the tab, with the auto-lock window, and with Lock, and its key is rotated on every restore.
Password	Nowhere. It exists only in your head and, momentarily, in the key-derivation call.
Address book, settings, activity	localStorage, local to the device, wiped by Reset.
Token prices	CoinGecko for listed coins, DexScreener for imported tokens. Both go through the backend cache when it answers, so the price source sees the backend's address rather than yours, and directly otherwise.
Price charts	Listed coins through the backend cache, which sees the backend's address rather than yours. Imported tokens and SPL tokens directly from GeckoTerminal, read from your browser, so GeckoTerminal sees your address and which token you opened.
Token security	GoPlus, only through the backend cache, never directly: the contract you are looking at is exactly the token you are about to buy, and that should not reach a third party together with your address. Readings are cached five minutes on the backend.
Relics (NFT)	An indexer, through the backend proxy only: Alchemy for EVM networks, Helius for Solana. The indexer sees our server and your address, never your address next to your IP, and your address is never written to a log line. Readings are cached two minutes on the backend and are marked when they are served stale.
Relic images	Only from the indexer's own CDN or from the IPFS and Arweave gateways this wallet picks. Anyone can send an NFT to any address, so an image host named in the metadata is a host the sender chose, and loading from it would hand that sender your IP next to the address they picked. Images from anywhere else are not loaded at all, and the card shows the token number instead.
Pool rankings	GeckoTerminal, read directly from your browser when you open Discover's trending or new lists, so GeckoTerminal sees your IP and which network you browsed, but never your address.
All-chains scan	The public RPC of every EVM network, read from your browser with your address, only when you ask for the scan. A network where you have set your own RPC uses that endpoint alone.
Logos and token icons	Chain and partner logos are files shipped with the wallet, so showing them contacts no one. Token icons on Solana load only from a short list of known hosts (GitHub raw, Jupiter, Arweave, IPFS gateways, CoinGecko). An icon hosted anywhere else is replaced by the token's initial rather than fetched, because loading an image tells its host your IP.
Anything on a server	One integer: how many marked addresses were ever forged, counted by an empty ping. No account, no database of you.

XXI.

What SHI2 Wallet does not do

Read this before trusting us with anything. Every product has edges. These are ours, today.

Solana is a realm of its own, not a chain in the portfolio: its balances, sends, swaps, limit orders, and Tablet live on their own screens, reached by switching realms. It shares the seed and nothing else.
Bitcoin is a destination, never an account. Swap and the estate crossing can deliver native BTC to an address you write down, and the wallet holds no Bitcoin key, shows no BTC balance, and cannot send from one. Tron is not supported at all.
No hardware-wallet support yet.
The inheritance and on-chain Sentinel contracts are not yet on any public network. The in-app Afterlife panel runs as a model until they are.
No third-party audit yet: 1064 web tests, 89 contract tests, 50 deploy-gate tests, 95 keeper tests and 29 Solana program tests, and more than twenty adversarial review rounds exist instead, and mainnet is gated on a security checklist.
Client-side Sentinel orders execute only while the wallet is awake. Sleep-proof keepers arrive with session keys.
The Relics gallery needs an indexer key on the backend. Until one is set it says so plainly and links out to a marketplace, rather than showing an empty gallery.
One heir per Tablet in v1. Multi-heir with splits is deferred deliberately.
No display currency other than USD, no bulk send, and no profit-and-loss per token. Each was weighed and set aside: a half-converted screen shows two currencies at once, a bulk send from a plain account is only a queue of signatures, and a local history that never saw your outside deposits would print a profit figure that is wrong.
No recovery service of any kind. See section III, and mean it.

XXII.

Deep links

Every screen is addressable: /app?go=<target> opens a tab or ritual directly, and the intent survives the unlock screen. Unknown targets are discarded and the URL swept clean.

Target	Opens
`assets · legacy · activity · ai`	The four tabs.
`send · receive · swap · limit · launch · watch · market · discover · earn · buy · nft · accounts · forge · settings · approvals · connect`	The rituals: modals for each, ready to use.
`futures`	Opens the Futures panel, which today explains that perpetuals are not wired in yet rather than trading anything.
`allchains`	Not a modal: it turns on the All chains view in the Assets tab. Real wallets only, since it reads live networks with a real address.
`bridge`	Kept for old links. Opens Swap, which absorbed the Bridge rite.

Questions about the token belong in the $SHI2 whitepaper. Try everything in the showcase. No keys, no vows. Read it by one lamp, and check every line against the code.