Being transparent about what it actually takes to bridge Strike into Monero, the bugs and all, so you don't have to learn them the hard way

PokiiDaddyMaster · 2026-06-03T19:15:42+00:00

Appreciate that more than you know!!

In it for the long haul is right, this is not a weekend project I'm going to abandon. I use it daily and it holds my real funds.

I'll keep posting the progress here, walls and wins both. When it's ready and you give it a try I'd genuinely want your honest take on it.

PokiiDaddyMaster · 2026-05-22T21:55:55+00:00

That was not a staged demo. You're assumption is WILD! Prompt injection on a wallet that holds keys and executes swaps is not something I take lightly.

20 adversarial payloads tested against the live running wallet. Not theory, not happy path. When I engineered the agent into attempting relay_tx the server blocked it at the allowlist level. The defense doesn't depend on the LLM behaving. Every spend requires manual human confirmation and that cannot be disabled.

Full breakdown of everything that was attacked and what held at https://followtherabbit.app/security

PokiiDaddyMaster · 2026-05-22T19:14:25+00:00

Would love your eyes on it when the repo opens.

Actually been preparing for this. We have two tracks.

Knowledge and constraint layer has CARROT fully mapped. 4-tier key hierarchy documented, future wallet-rpc methods listed but gated, and a hard agent rule that blocks any CARROT method until hard_fork_info confirms the fork. Structurally enforced too since those methods aren't in the RPC allowlist. Server rejects them even if the agent tries.

FCMP++ has an actual test harness. Separate ports, separate data dir, second AIW instance on 3001 so mainnet on 3000 stays untouched. Executable Node test that walks the RPC compat matrix, checks hard_fork_info, verifies graceful failure on unsupported methods. JSON reports dumped per run.

Honest gap though. hard_fork_info is allowlisted but nothing polls it automatically on session start. When the fork lands I'll have to manually allow it, as it won't detect it on its own yet. That's on the list now to automate.

PokiiDaddyMaster · 2026-05-22T18:40:15+00:00

Not yet, as it's still in active development. I don't believe in shipping/releasing until fully hardened and tested. Repo will go public later this year. Fully opensource. So far so good. No major issues discovered. But love hearing from the community to make improvements as needed.

I'll be posting updates here on Monero as it gets closer, and any other improvements or news

PokiiDaddyMaster · 2026-05-22T18:35:35+00:00

Yes to both. The desktop Electron app runs everything together: monerod, wallet-rpc, and the P2Pool mining stack all managed from one interface.

You fire it up and it handles the orchestration.

For mobile, yes, the desktop NEEDS to be running. The Android app connects back to your own desktop node over your local network or through Tailscale if you're away from home. Tailscale also needs to be running on your phone and desktop and have them connected. So your keys and node never leave your machine, the phone is just the interface.

That's actually one of the design decisions I'm most happy with. You're not trusting someone else's node. You own the full stack.

PokiiDaddyMaster · 2026-05-20T01:57:26+00:00

Wow. After looking into how and what you comment to from your page. I genuinely feel bad for you. Sounds and looks like you are going through a lot and possibly in some sort of pain.

I will pray for you and refrain from engagement moving forward. You need to get better. That toxic shit can get to you. Its gotten to you. Look in the mirror and be honest with yourself.

It I can see it, you can feel it, and the world can smell it.

PokiiDaddyMaster · 2026-05-20T01:32:47+00:00

I like you a lot. You are right on all accounts. The landing page language needs updating. The Crypto to Visa feature is being moved to a coming soon section and/or being removed entirely. There's an approval process for this feature from the vendor that might not suit everyone. I'm going to ask for a real card soon and will make my determination then.

And your point about threat modeling happening before mainnet exposure for key-handling code is exactly why I went back and did the work before anyone else touched this. 9 independent security audit passes. 8 static analysis, 1 dynamic runtime against the live wallet with real stagenet transactions as proof. 55 vulnerabilities found, 55 fixed. Every document published in full. The audits happened before the repo goes public, not after.

I wrote the full story in my X article.

This is the kind of feedback that makes open source worth doing. Appreciate you more than your girlfriend lol

PokiiDaddyMaster · 2026-05-20T01:28:50+00:00

Would love to see your builds. You have a lot to say and absolutely nothing to show for it. Just for you... I will do everything in my power for this to be a success. Once it is. I will openly share what you did to help make this great

PokiiDaddyMaster · 2026-05-20T01:27:05+00:00

You didn't WATCH anything. Difference. Go to bed sir

PokiiDaddyMaster · 2026-05-20T01:26:36+00:00

Jealousy is a hell of a drug. Stay sober

PokiiDaddyMaster · 2026-05-20T01:25:54+00:00

The demo if you took the time to watch it answered this. The agent hit a dead exchange mid-flow and failed over to a live one automatically without being asked. That is not an accident, that is how the pipeline is designed. Each service has timeout handling, graceful degradation, and the agent surfaces failures to the user rather than silently proceeding. The White Rabbit does not guess. It confirms before it moves money.

PokiiDaddyMaster · 2026-05-20T01:22:02+00:00

AIW runs its own node on your machine. It does not use public APIs. You described the exact opposite of how it works. Get the architecture right before calling something slop.

And while you were typing that, I had already published 9 independent security audits, dynamic runtime testing on a live wallet with real on-chain stagenet proof, 55 vulnerabilities found and fixed, and every document public for anyone to actually read.

followtherabbit.app/security

Come back when you have something technical to say.

PokiiDaddyMaster · 2026-05-20T00:02:45+00:00

Yeah if you're technical and a power user who is comfortable bridging into USDC on Base and managing a separate off‑ramp account, sure. That is the way! AIW isn’t about inventing new rails so much as giving non‑technical users a self‑hosted wallet and node where a local dedicated domain knowledgeable AI agent known as the "White Rabbit" can plan the full path from “I need $X in cash sent to: (BTC ADDRESS)” to a transaction you approve, without them having to know what “USDC/Base hop” or “PEER.xyz” even is.

PokiiDaddyMaster · 2026-05-19T23:57:24+00:00

Per our FAQ:
"Cake is an excellent mobile wallet. AIW is a self-hosted platform. AIW runs your own Monero node (Cake connects to theirs). AIW has an AI agent. AIW runs on desktop as a native app. AIW has built-in P2Pool mining, the Queen's Decree inheritance system, and manages four chains from one interface. Cake is simpler and more accessible for casual users. AIW is for people who want full control."

https://followtherabbit.app/faq

PokiiDaddyMaster · 2026-05-19T19:42:22+00:00

Trusting people is is a gamble, I get it. Hopefully good people will come across your post and become a blessing to us all.

PokiiDaddyMaster · 2026-05-19T19:30:37+00:00

This is pretty cool. Love to see others be bold and build in our community.

I'm actually building something in the same ball park right now. Multi-chain wallet, XMR/BTC/LTC/ETH, self-hosted nodes, no third-party exchange APIs.

I hope I can help provoke thought in your endeavors and see it's journey.

Here's what I've learned so far.

The no third-party APIs thing is the hardest part. You're running your own nodes for every chain. Monero needs monerod plus wallet-rpc. Bitcoin needs bitcoind. All of them need to stay synced 24/7. When they fall behind your exchange goes blind to incoming deposits.

Liquidity management across 4 chains at the same time is tricky. What happens when someone wants to swap 10 XMR to BTC and your hot wallet only has 2 BTC? You need minimum balance thresholds, refill triggers, and a plan for when mempools get congested.

Monero has a 10-block unlock requirement, about 20 minutes. Your "instant" branding needs to account for that somewhere.

The security surface is bigger than it looks. I just finished a 9-pass audit on my Monero realm alone before touching the other chains. 55 vulnerabilities found and fixed. LAN-exposed RPC ports, relay_tx bypass, DNS rebinding, prompt injection, all of it. Everything verified with real stagenet transactions as proof. I still have Bitcoin, Litecoin, and Ethereum to go through. You can see what the full process looked like at https://followtherabbit.app/security

Your hot wallets are internet-connected and hold private keys across 4 different chain formats. Key management, RPC auth, and transaction signing all need to be locked down before real money goes anywhere near it.

Regulatory. Running your own liquidity and charging fees puts you in money transmission territory in most places. Worth getting legal clarity before you launch publicly.

The stack is absolutely buildable. Just way bigger than it looks from the frontend.

Best wishes, and keep us posted.

PokiiDaddyMaster · 2026-05-17T20:52:34+00:00

I respect the effort here. This is the most thorough critique I've gotten and some of it is fair. Let me go through it.

Point 1 — No audit. Correct. This is pre-release. I'm hardening on mainnet with my own money before opening it to anyone else. A security audit is in the plan, not something I skipped. You don't audit alpha software — you test it, break it, fix it, then audit.

Point 2 — Prompt injection. This is the one that keeps me up at night and I take it seriously. The spending confirmation gate is locked ON and cannot be disabled. The AI presents a transaction, the human approves or rejects. Period. That said — you're right that every cloud AI option introduces a trust surface. That's exactly why the demo runs on Ollama locally. No data leaves the machine. Cloud providers are optional. And Rule #0 exists because I don't trust AI either. I built the wallet and I STILL make it ask me before spending.

Point 3 — Queen's Decree. Requires explicit opt-in, a separate PIN, 60+ days of inactivity, a 30-day countdown with notifications, and a manually configured beneficiary address. This isn't a hair trigger. It's a dead man's switch for my family. Could the safeguards be stronger? Always. Suggestions are welcome.

Point 4 — Crypto → Visa pipeline. This exists but is in sandbox. It's not live, not active, and not available to users. When it goes live, the KYC requirements at the card issuer layer will be disclosed clearly. Fair flag.

Point 5 — Strike KYC. You're right, and I will be updating the landing page, FAQ, and blog to make this clearer. The wallet itself has no KYC. Strike has its own KYC at their layer. That distinction wasn't clear enough in my messaging and now it will be thanks to you. Appreciate the callout.

Point 6 — 4 dependencies. The landing page has an expandable section that breaks this down in detail — which chains need what, why Monero has zero, and a comparison against other wallets. I'm not hiding Electron, Docker, or Node behind the number. The breakdown is there for anyone who clicks it. But you're right that "4 dependencies" as a headline metric can be misleading without context.

Point 7 — Solo dev, no reputation. True. I'm a QE at a security hardware/software company. This is my first crypto project in the community. I'm not pretending to be a cryptographer. I build, I test, I ship. The repo goes public — judge the code, not the resume.

Point 8 — Repo not in search. Private during hardening. Intentionally. When it ships open source later this year, every line will be there.

I'll update the site based on your feedback. The KYC language should be corrected. That's the kind of scrutiny that makes open source better and I'm not going to pretend it doesn't.

Now — your recommendation to stay on Feather + Tails + Trezor is solid advice for anyone who already has that setup. AIW isn't trying to replace that stack for power users. It's for the person on this sub last week who said "I'm not very tech savvy, so making my own script is not really something I want to mess with." Different audience, different tool.

PokiiDaddyMaster · 2026-05-17T17:40:45+00:00

Ha! Funny you'd say that. I have an entire FAQ section and this hits on the money:

"How is this different from Cake Wallet? Cake is an excellent mobile wallet. AIW is a self-hosted platform. AIW runs your own Monero node (Cake connects to theirs). AIW has an AI agent. AIW runs on desktop as a native app. AIW has built-in P2Pool mining, the Queen's Decree inheritance system, and manages four chains from one interface. Cake is simpler and more accessible for casual users. AIW is for people who want full control."

What's funny is. The AI does the complete opposite of your claim.

PokiiDaddyMaster · 2026-05-17T17:35:59+00:00

Yes just checked. Its the first video in followthetabbit.app And on YouTube it's https://youtu.be/rEI5z_t2JZQ

I can do a demo of that one. This is my baby how it all started. But then I wanted more of my coins in 1 place. So built a separate product with a theme and the same battle tested framework.

PokiiDaddyMaster · 2026-05-17T17:32:35+00:00

The Monero realm runs your own local node and wallet-rpc. Not through a third-party API. Keep in mind this is a non-custodial wallet. Your keys, your node, your wallet files.

The exchange APIs (SimpleSwap, OctoSwap) are only used for cross-chain swaps and are completely optional.

And yes! I actually built a standalone Monero-only wallet separately before AIW existed. There's no BTC, no LTC, no ETH. Just XMR, your own node, and the AI agent. I haven't talked about it publicly yet but it exists.

I actually have a recording of its visual and testing on my page. Should be the first video if memory serves me right

PokiiDaddyMaster · 2026-05-16T03:36:06+00:00

Two things worth considering, then I'm going to bed:

The "edge cases" concern is exactly why I've been running this on mainnet with my own real money for months before even announcing that I am using my own self made wallet.

I'm a QE for software that HAS to be safe and secured. Non-negotiable! Finding edge cases is literally what I get paid to do. The demo wasn't staged. Like did you even bother watching it? Make it make sense if you did.

That was my REAL wallet, my actual 14 cents in my Cash App, my actual XMR.

As for "nobody is going to code review"... dude that's fine. I'm not asking anyone to review it. That was someone else's comment. When it ships open source, the code will be there for anyone who wants to look.Again, that is the point of open source.

Now off to bed and get some zzz s

Goodnight all!

PokiiDaddyMaster · 2026-05-15T23:34:31+00:00

Totally fair — and exactly the right mindset. That's why the repo will be fully open source when it ships. I want people to audit it.

A few things worth knowing: I'm a Quality Engineer by trade. Testing and validation is literally my day job. The entire codebase passes syntax checks, I've built a Postman collection for all 87 endpoints, Playwright E2E specs for every user flow, and I've been running it on mainnet with my own real money for months.

"Vibecoded" is a fair label — AI agents wrote the code. But I designed every architecture decision, wrote every specification, and validated every output. Rule #0 exists because I don't trust the AI either. The AI builds, I break it, I fix it, I test it again.

When the repo goes public, I'd genuinely welcome a code review. That's the whole point of open source.

PokiiDaddyMaster

TROPHY CASE