Wallet System
QELT Hub supports both external Web3 wallets (self-custodied) and server-managed custodial wallets for email users. Both wallet types can interact with all platform features including the DEX.
Web3 Wallet (External)
Users who authenticate with an external Web3 wallet use their own self-custodied wallet directly. QELT Hub never has access to their private keys.
How It Works
- The wallet connects through the wagmi/WalletConnect stack
- The user's wallet address is read from the connected wallet
- All blockchain transactions are signed directly by the user's wallet
- The user maintains full control of their private keys
- Transaction requests are sent to the wallet for user approval before being broadcast
Supported Wallets
Extension & Mobile
Extension & Mobile
Mobile
Extension & Mobile
Universal Protocol
Custodial Wallet
For users who register via email/password, QELT Hub generates a custodial wallet — a blockchain wallet whose private key is encrypted and stored on the server. The plaintext private key and mnemonic are never stored.
Creation Flow
User Registration
User registers with email + password.
Wallet Generation
The system generates a new Ethereum-compatible wallet using BIP39 (12 or 24 word mnemonic) and BIP32 HD derivation (m/44'/60'/0'/0/0).
Key Encryption
The wallet's private key and mnemonic are encrypted using AES-256-GCM with a key derived from the user's password via Argon2id.
Secure Storage
The encrypted data is stored in the database — the plaintext private key and mnemonic are never stored.
Seed Phrase Backup
The user is presented with their seed phrase and must acknowledge they've backed it up. A verification step confirms the user wrote it down correctly.
Security Properties
- Password-derived encryption: The wallet can only be decrypted with the user's password — no one else (including server admins) can access the private key
- Seed phrase backup: Users are required to back up their 12/24 word seed phrase
- Audit logging: Every wallet access (creation, decryption, seed view) is logged
- Re-encryption on password change: When a user changes their password, the wallet data is re-encrypted with the new password
Encryption Details
Custodial wallet private keys are encrypted using industry-standard algorithms with strong key derivation.
| Parameter | Value |
|---|---|
| Encryption Algorithm | AES-256-GCM |
| Key Derivation | Argon2id |
| Memory Cost | 64 MB (65536 KiB) |
| Time Cost | 3 iterations |
| Parallelism | 4 threads |
| IV Length | 128 bits |
| Auth Tag Length | 128 bits |
| Salt Length | 256 bits |
How Wallets Interact with the DEX
Both wallet types can interact with the QELT DEX, but the signing mechanism differs. Both pathways support token swaps, ERC-20 approvals, liquidity provision/removal, and token transfers.
External Web3 Wallet → DEX
- 1User initiates a swap/transaction on the DEX UI
- 2Transaction is prepared by the frontend
- 3Transaction sent to wallet for signing (MetaMask popup)
- 4User approves and wallet signs the transaction
- 5Signed transaction is broadcast to QELT blockchain
Custodial Wallet → DEX
- 1User initiates a swap/transaction on the DEX UI
- 2Transaction details sent to server-side signing endpoint
- 3Server decrypts private key using session credentials
- 4Server signs and broadcasts the transaction
- 5Private key immediately cleared from memory
Next Steps
Learn about the decentralized exchange where both wallet types come together for DeFi trading.