COLDSTAR

Full Installation

# Install the complete Coldstar cold wallet
$ cargo install coldstar

# Or add to your project
$ cargo add coldstar

Individual Crates

# Just the signing engine
$ cargo add coldstar-signer

# Transaction builder + network client
$ cargo add coldstar-transaction coldstar-network

# Privacy layer with ZK proofs
$ cargo add coldstar-privacy coldstar-zk

# USB shuttle for air-gap transfer
$ cargo add coldstar-usb

# Terminal UI
$ cargo add coldstar-tui

Build a Bootable Cold Device

# Build a minimal Alpine Linux ISO with Coldstar pre-installed
$ cargo install coldstar-iso
$ coldstar-iso build --output coldstar.iso

# Flash to USB drive
$ coldstar-iso flash --iso coldstar.iso --device /dev/sdX

System Requirements

# Minimum
Rust   >= 1.75.0
OS     Linux (x86_64, aarch64), macOS (aarch64)

# For cold device ISO builds
Docker >= 24.0  (Alpine rootfs builder)

# For USB shuttle
Linux  udev rules for USB detection

Wallet Creation

coldstar-wallet

use coldstar_wallet::{Wallet, WalletConfig};

let config = WalletConfig {
    name: "my-cold-wallet".into(),
    network: Network::Mainnet,
    encryption: Encryption::Aes256Gcm,
};

let wallet = Wallet::create(config, &password)?;
let pubkey = wallet.public_key();

Transaction Signing

coldstar-signer

use coldstar_signer::{Signer, SigningRequest};

// On the cold device:
let signer = Signer::from_encrypted_key(&keyfile, &password)?;
let request = SigningRequest::deserialize(&unsigned_bytes)?;

// Review transaction details before signing
request.display_summary();

let signed = signer.sign(&request)?;
let output = signed.serialize();  // bytes for QR/USB

Network Client (Hot Device)

coldstar-network

use coldstar_network::{RpcClient, Cluster};

let client = RpcClient::new(Cluster::Mainnet);
let balance = client.get_balance(&pubkey).await?;
let tokens = client.get_token_accounts(&pubkey).await?;

// Build unsigned transaction
let unsigned = client.build_transfer(
    &pubkey, &recipient, amount
).await?;

// Submit signed transaction
let sig = client.submit(&signed_bytes).await?;

USB Shuttle

coldstar-usb

use coldstar_usb::{UsbShuttle, Payload};

// Detect and mount USB drive
let shuttle = UsbShuttle::detect()?;

// Write unsigned tx to USB (hot device)
shuttle.write_payload(Payload::unsigned(&tx_bytes))?;

// Read and sign on cold device
let payload = shuttle.read_payload()?;

// Write signed result back
shuttle.write_payload(Payload::signed(&signed_bytes))?;

Zero-Knowledge Proofs

coldstar-zk

use coldstar_zk::{SchnorrProof, PedersenRange, Verifier};

// Prove you own a key without revealing it
let proof = SchnorrProof::generate(&keypair, &challenge)?;
assert!(Verifier::verify_ownership(&pubkey, &proof));

// Prove balance is within range
let range = PedersenRange::prove(balance, min, max)?;
assert!(Verifier::verify_range(&commitment, &range));