Wallet Safety

Safety Checks

What The Connection Code Does

• Connects to the wallet to read the selected address.
• Requests a temporary verification message from Gatekeeper.
• Asks the wallet to sign that message.
• Sends the address, public key, and signature back to Gatekeeper for server-side verification.

const accounts = await provider.connect();
const selected = accounts[0];

const nonceData = await requestNonce();
const messageHex = toHexUtf8(nonceData.message);

const signed = await provider.signMessage({ message: messageHex });

await finishLink({
  address: signed.address || selected,
  publicKey: signed.publicKey,
  signature: signed.signature,
  messageHex,
});

What The Server Checks

• The signature must match the public key.
• The wallet address must be derived from that public key.
• The session must still be valid and unconsumed.

const proof = verifyWalletSignatureProof({
  walletAddress: wallet,
  publicKey: body.publicKey,
  signature: body.signature,
  message,
  messageHex: body.messageHex,
});

if (!proof.ok) throw new Error("wallet_signature_invalid");

The Message You Sign

This is the kind of message you should see in the wallet signature popup.

Robbie Gatekeeper wallet verification

Sign this gasless message to link your wallet with Discord.
Discord user: ...
Guild: ...
Nonce: ...
Expires: ...

Never share your seed phrase or private key.

Advanced Audit

This section is for experienced users who want to inspect the verification flow. It describes the browser actions and server checks without exposing internal secrets, API keys, or private infrastructure details.

Endpoints Used By Verification

Client Code Path

The important audit point is the absence of transaction methods. The wallet is asked to connect and sign a message only.

// The verification page uses the wallet provider already injected
// by StarKey/Ribbit. It does not import a remote wallet SDK.
const accounts = await provider.connect();
const selected = typeof accounts?.[0] === "string"
  ? accounts[0]
  : String(accounts?.[0]?.address || "");

const nonceData = await requestNonce();
const messageHex = toHexUtf8(nonceData.message);
const signed = await provider.signMessage({ message: messageHex });

await finishLink({
  provider: kind,
  address: signed.address || selected,
  publicKey: signed.publicKey,
  signature: signed.signature,
  messageHex,
});

// There is no sendTransaction, submitTransaction, transfer,
// approve, allowance, private key, or seed phrase request here.

Server Code Path

Gatekeeper verifies the proof, stores the linked wallet, then consumes the session so the same signature cannot be reused.

const message = buildWalletAuthMessage(session);
const proof = verifyWalletSignatureProof({
  walletAddress: wallet,
  publicKey: body.publicKey || body.public_key,
  signature: body.signature,
  message,
  messageHex: body.messageHex,
});

if (!proof.ok) {
  throw new Error(proof.reason || "wallet_signature_invalid");
}

store.upsertWallet({
  guildId: session.guild_id,
  projectId: session.project_id || null,
  discordUserId: session.discord_user_id,
  walletAddress: wallet,
  source: "wallet_connect",
});

store.consumeVerificationSession(token);

Signature Verification

The server derives the SUPRA address from the submitted public key and checks that the signature matches the server-built message.

const derivedAddress = deriveSupraAddressFromPublicKey(publicKeyBytes);
if (normalizeWalletFull(walletAddress) !== derivedAddress) {
  return { ok: false, reason: "public_key_address_mismatch" };
}

const candidates = [
  new TextEncoder().encode(message),
  bytesFromHex(messageHex),
  new TextEncoder().encode(String(messageHex)),
].filter(Boolean);

const valid = candidates.some((candidate) =>
  nacl.sign.detached.verify(candidate, signatureBytes, publicKeyBytes)
);

Data Sent To Gatekeeper

What The Bot Collects

This is the transparent record created by wallet verification. It is used to prove wallet ownership, link the wallet to Discord, and prevent replay.

Replay Protection

• The verification link is temporary and expires after a short window.
• The signed message includes a nonce and expiration.
• After a successful verification, the session is consumed.
• Trying to reuse the same link or old signature should fail.

Internal Events

RobbieBuyBot wallet activity events are separate from wallet verification. They are accepted only by a protected internal endpoint using a server-side API key. That key is never present in the browser, the Discord panel, or this documentation page.

Red Flags

• Deny if the wallet shows a transaction approval for verification.
• Deny if the domain is not https://gatekeeper.robbiesuprameme.xyz.
• Deny if anyone asks for your seed phrase or private key.