# JoyID DAO Co-Build MVP ## Metadata **Status**:: #x **Zettel**:: #zettel/permanent **Created**:: [[2023-12-11]] **Notion**::[JoyID DAO Co-Build MVP](https://www.notion.so/cryptape/JoyID-DAO-Co-Build-MVP-e1fa104df87c457394f04a5a22ecef85) **Topic**:: [[♯ JoyID DAO Co-Build]] ## Synopsis - Implement a Lock Script “JoyID Co-Build Lock” that can sign transaction in JoyID using Co-Build protocol. - Implement a web app PoC to create DAO transactions using “JoyID Co-Build Lock” and JoyID. The are two other alternatives proposed before: - Add the feature in “JoyID Co-Build Lock” to verify the DAO information in the witness so the user can see the information when signing transactions. See [[JoyID DAO Lock V1]]. - Add another type script to verify the DAO information in the witness. See [[DAO Co-Build Type Script V1]]. The are cancelled for two reasons. Firstly, the system DAO type script will support Co-Build protocol in the future. Secondly, wallets can parse the DAO transaction information from transactions. ## Actions - [x] [[CKB DAO Co-Build Compatibility]] - [x] Signing - [[Journal 2023-12-15#17 03 JoyID signChallenge|JoyID signChallenge]] - [[Journal 2023-12-16#23 20 Verify JoyID Signature Using Python CryptoDome|Verify JoyID Signature Using Python CryptoDome]] - [[Journal 2023-12-17#08 02 Test vector for JoyID secp256r1 signing|Test vector for JoyID secp256r1 signing]] - [[§ How to Verify JoyID WebAuthn Signature]] - [x] Lock Script - [x] Web App > [!attention] > JoyID signs a message of 37 + 32 = 69 bytes, but ckb-auth accepts message of 32 bytes. > > Workarounds: > 1. Skip SHA256 on message in ecc verify. > 2. Modify ckb-auth to accept message of any length. > 3. Find another library to verify the signature, such as RustCrypto p256. > > Solution: 3, use p256 ## Scenarios ### S1: Depositing CKB 1. User Alice signs in using JoyID 2. Alice sees his JoyID Co-Build Lock address 3. Alice sees the link to the testnet faucet 4. Alice deposits CKB from faucet to his JoyID Co-Build Lock address The Co-Build PoC Lock address is different from the CKB address displayed in the JoyID account page. Currently, it's impossible to deposit CKB from JoyID Lock to DAO via JoyID interface and API. ### S2: Depositing DAO 1. User Alice signs in using JoyID 2. Alice clicks the button "Deposit" and fill how many CKB to deposit into DAO 3. Alice reviews the transaction details and confirms the signing in the JoyID popup. ### S3: Listing DAO Deposits 1. User Alice signs in using JoyID 2. Alice sees a list of DAO deposits 3. Alice expand details for one deposit ### S4: Initiating DAO Withdraw 1. User Alice signs in using JoyID 2. Alice selects a deposit in the Deposits List (S3) and clicks the button "Initiate Withdraw" 3. Alice reviews the transaction details and confirms the signing in the JoyID popup. 4. Alice sees the new ongoing withdraw in the Deposits List (S3) ### S5: Completing DAO Withdraw 1. User Alice signs in using JoyID 2. Alice selects an ongoing withdraw in the Deposits List (S3, S4) 3. User fills in the recipient address. 4. Alice reviews the transaction details and confirms the signing in the JoyID popup. 5. Alice sees that the deposit is removed from the Deposits List and the account balance increases. ## Verifying JoyID DAO Lock uses the `parse_message` function in the [Co-Build PoC](https://github.com/cryptape/ckb-transaction-cobuild-poc/blob/main/docs/migration.md) to extract `message_digest` and `seal`. Then the lock script verifies whether `seal` is the correct signature of `message_digest` signed by JoyID using the provided public key. The hash of the provided public key must match the hash in the script args. The signature is generated using the API [`signChallenge`]() in the package `@joyid/ckb`. The seal has the same binary format as the [`witness_args.lock`](https://github.com/nervina-labs/joyid-lib-demo/blob/master/docs/protocol.md#data-structure) in the JoyID Lock. ``` witness_args.lock = unlock_mode | public_key(_hash, only for secp256k1) | signature | web_authn_msg ``` The PoC does not supports sub key unlocking yet. ## Transaction Building The JoyID DAO Co-Build MVP adopts the Co-Build transaction building protocol. The protocol stores all the information required to build transactions in [`BuildingPacket`](https://github.com/cryptape/ckb-transaction-cobuild-poc/blob/main/schemas/basic.mol) internally to create DAO transactions. ## Challenges - The system DAO type script uses the WitnessArgs layout. ## Future Works - Integrate Co-Build in the JoyID lock script. - Integrate Co-Build in the system DAO type script.