Self-custody
LIVEThe wallet is built from your own seed on your own device. It is not a connector wrapper around someone else's wallet, and the seed never leaves the device for our backend.
KNIGHT SHIELD WALLET · PRO
A self-custodial Midnight wallet for users who want to see — and control — what is happening underneath.
PRO is Midnight-native and security-first: real wallet state, shielded and unshielded roles, contract-backed @username routing and a local encrypted seed vault. It is an expert surface, not a trading floor — no charts, no tickers, no market theatre.
Every capability below is labelled LIVE, WIRED, MOCK or ROADMAP against the current wallet build. This page explains the product; it is not the wallet application.
Knight Verify is designed to confirm identity continuity after a replaced phone, a restored wallet or a new device — before access continues. A generic passkey proves device control; this proves continuity. It is not implemented in the current wallet build.
Section 01
The wallet builds itself from your seed and talks to Midnight directly.
The wallet is built from your own seed on your own device. It is not a connector wrapper around someone else's wallet, and the seed never leaves the device for our backend.
The HD wallet derives shielded, unshielded and DUST roles. PRO surfaces the private (shielded) and public (unshielded) split instead of collapsing it into one number.
DUST keys are derived as part of the Midnight role architecture, and the backend can sponsor DUST for a new user's first SafeSend registration when the wallet has none. Staking-generated DUST is not live.
Balances and transaction history come from Midnight wallet state, not from a local simulation.
Preview, preprod and mainnet endpoint configurations exist. Preview is the currently exercised target.
Mobile-first installable progressive web app architecture, built to behave like an application rather than a browser tab.
Section 02
Human-readable routing backed by a Compact contract, with proof infrastructure in place. Username operations are live; money movement is not.
Send to a human-readable @username instead of forcing raw addresses. Claim and lookup run through Midnight Compact circuits: register_routing_details, resolve and is_username_registered.
SafeSend ZK artifacts and prover/verifier configuration are present, and the PWA uses a Midnight proof server as part of the architecture.
A new wallet with no DUST can have its first SafeSend registration sponsored by the backend so identity claim is not blocked on day one.
Recipient resolution is real. Actual money movement still uses a local mock — no funds move on any network today.
Section 03
What PRO reveals that the default Knight experience deliberately hides.
PRO shows NIGHT balances directly rather than a single simplified amount.
Shielded (private) and unshielded (public) holdings are shown separately so you always know which side you are spending from.
Raw receiving addresses are exposed in PRO for users who want to verify or copy them directly.
The PRO receive flow offers @username, Private and Public receiving choices. QR receive is a preview aid, not production network scanning.
Where the current interface exposes them, transaction identifiers and technical detail are visible instead of hidden.
The displayed conversion rate is a mock value. Do not treat it as market data.
Section 04
Key material stays on the device. The architecture is written down here in full because PRO users should be able to check it.
The seed is encrypted on-device with AES-GCM and stored in the device vault. The backend never sees it.
Vault keys are wrapped using material derived from your passcode, so possession of the device alone is not enough.
Optional biometric unlock uses a WebAuthn PRF key path, enabled only when the authenticator genuinely supports it.
Backup and restore covers the vault, SafeSend identity, wallet state and payment history, encrypted end to end.
The wallet auto-locks, and the passcode can be rotated without rebuilding the wallet.
A deliberate device-erase path removes local wallet material from the device.
Legacy Vault in the current build is interface only. No contract is connected.
Section 05
Direction and retained prototypes. Nothing in this section is live, and no yield, rate, generation figure or date is being claimed.
A StakingManager prototype (stake, unstake, timelock checks, stake info, reward estimation) and a Compact staking prototype with staked balances, timestamps, total staked, configurable lock period and reward-rate fields exist in the earlier wallet repository. That architecture is retained but is not wired into the current wallet.
An advanced Midnight economics direction. Older documentation described DUST self-sufficiency; those figures are historical planning material, not current network truth.
Deeper token-native controls beyond the current PRO balance split.
Multi-token support and swaps were planned for a later advanced-wallet release. They are not current functionality.
Want the plain-language version instead? Knight is the same wallet with the crypto mechanics deliberately kept out of the way.