How it works, without the fine print

No download, no registration. You open the app, create a key pair, and walk away with a meta-address that can stay on your letterhead indefinitely.

1. 01Open the app. Choose the Numbered Account tab and press Generate keys. Both private keys are created inside your browser.
2. 02Secure them. Save the JSON backup, or choose a passphrase so the keys sit encrypted on this device.
3. 03Hand out the meta-address. Copy it as text or display the QR. Publishing it is harmless; it has no power to spend.
4. 04Collect payment. Each payer derives a new one-time address from it. Scan their receipt QR to claim, then sweep.

Lockvane builds on ERC-5564 stealth addresses over secp256k1, with two private keys in your keeping. The spending key authorises transfers. The viewing key can only tell which incoming payments are yours, which means you can share it with an accountant and still keep sole control of the funds.

The meta-address is simply the two corresponding public keys placed side by side:

st:eth:0x <33-byte spending pubkey> <33-byte viewing pubkey>
              └─ 132 hex characters in total

From it, a payer computes a single-use address that does not point back to you:

ephemeral r,  R = r·G
S        = r · K_view              (sender)   ==  k_view · R   (you)
h        = keccak256(compress(S)),  view tag = h[0]
P_stealth = K_spend + h·G
address   = keccak256(uncompress(P_stealth)[1:])[12:]

The view tag is a single byte. A scan compares it before anything else and runs the full elliptic-curve computation only when it matches, so scanning stays quick once an announcer contract is in place.

A sealed invoice takes three scans and involves no server. Each step runs in a browser, and until the on-chain announcer contract is deployed, the receipt QR is what carries the announcement.

Each format is an ordinary URL, so a phone camera lands on the correct screen without installing anything:

Payment request
https://lockvane.org/pay?to=st:eth:0x…&token=NVDA&amount=1.5&memo=invoice%2042

Receipt / announcement
https://lockvane.org/app?claim=1&addr=0x…&eph=0x…&tag=87&tx=0x…#receive

addr holds the one-time address, eph the compressed ephemeral public key, and tag the view tag. These three fields correspond exactly to the ERC-5564 announcement event, so when the scanner takes over from the QR, the format stays as it is.

Orders are filled by an intent router instead of a public order book, so a trade never waits in a mempool for others to read. Choose from 189 assets across 35 chains, type the amount in ordinary units, and the quote shows the filling venue and the flat fee before anything leaves your wallet.

With one click the destination can be a new stealth address derived from your own meta-address, which folds the trade and the private receipt into one step.

Each release keeps five commitments, and every one of them is tested rather than simply promised.

• Keys stay on your device. Key generation, derivation and recognition are client-side code only. No network request sits anywhere in the key path.
• Nothing held on our side. No custody, no private keys, no sessions. The only secrets are server-side env vars used to reach third-party routers.
• Encrypted when stored. An optional passphrase seals the keys with AES-256-GCM, using a key derived by PBKDF2-SHA256 over 310,000 rounds through WebCrypto.
• Closed on failure. A missing key returns a 503 that names it, never a quiet fallback that could mislead or expose anything.
• Tested against mainnet. Before each release, a read-only script simulates genuine transfers from genuine holders. It signs nothing.

The limits deserve equal weight. Settlement on chain is public. The venue that fills a trade sees both the deposit and the destination address. And your IP address is visible to whatever RPC you connect to, unless the node is your own.

If you find a vulnerability, please report it privately by email rather than in a public issue. The procedure is set out in the SECURITY.md file that ships with the source.

Each route is a Next.js handler served from the same deployment. Reads are cached where caching is safe, and nothing that handles a key is reachable.

The relay is there because certain networks intercept the chain’s RPC domain at DNS. Sending requests through the app’s own origin keeps balance reads and sweeps working where the direct endpoint is blocked. Batch sizes are capped and log ranges are limited, so the public RPC cannot be abused through this route.

curl -X POST https://lockvane.org/api/rpc \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]}'

A stealth address helps only if it is used at the moment an address is requested. The extension sits right at that moment: a small chip appears next to any address field, one click fills in a new one-time address, and the receipt is stored locally.

Its key format matches the app’s, so a single backup and a single passphrase serve both. There is no backend and no host permission request; the content script runs only in the tab where you pressed the toolbar icon.

# from a local checkout of the source
npm install
npm run build:extension       # output goes to extension/dist
# chrome://extensions → Developer mode → Load unpacked → extension/dist

The source has not been published yet. With a checkout in hand, the app builds without any secrets.

cd lockvane
npm install
npm run hooks:install     # pre-push gate, run once per checkout
npm run dev               # http://localhost:3000

Four checks stand behind the statements on this page, and CI runs the same four: