Segregate Your Assets

Learning Objectives

After completing this unit, you’ll be able to:

• Explain the risks related to blind signing.
• Explain asset segregation.

How Cold Is Your Cold Wallet?

Storing your private keys offline is one of the tenets of crypto security. Crypto is a digital world, and the main threats to private keys exist online. This means that for your private keys to be secure, they need to be in an offline wallet.

In the first unit, Ledger mentioned a new social engineering threat that’s gained prominence in Web3: blind signing. And it can put any wallet at risk, no matter if it’s web-based or hardware. 

Not all smart contracts can be fully displayed to users on a hardware wallet. This means you’ll be agreeing to the transaction based on trust, rather than full knowledge of the contract conditions. And even if you can see the contract details, not everyone knows what to look for.

Think about a time you or someone you know skipped the small print before installing new software on a computer, or skimmed through the terms and conditions before joining a social media platform. This type of behavior can put someone at risk if there’s a hacker on the other side of that smart contract instead of a well meaning person or business.

To protect against this threat there are several things you can do.

• Ensure you’re using a reputable platform.
• Double check the URL to make sure it’s accurate.
• Check the contract address to see exactly where the asset is being sent to.
• Segregate your assets—we dive into this last point in this unit.

Have a Wallet to Sign, Another to Store

Simply put, when you wish to protect your assets and you don’t plan on using them, store them in a crypto account (in other words, a blockchain address) that you plan never to use for transactions. It stays offline, it doesn’t touch transactions or smart contracts—that’s truly cold storage!

Meanwhile you’ll move any assets you intend to transact with into an “active” crypto address, which you’ll use to engage with Web3. Let’s take a closer look at how that works in practice.

One Private Key, Multiple Addresses

Let’s revisit your private key for a second. As you know, having the private key for a given blockchain address is what makes you the owner of that address, giving you access and control.

What you may not know is that just one set of private keys can generate multiple different blockchain addresses (public keys). Despite sharing a recovery phrase, each of these addresses is independent from the others, meaning you can treat them as separate accounts.

So on one hand you can have a set of cold accounts that have never been used to sign anything on the blockchain. And all while, you can have another set of accounts (each blockchain will need at least one of its own) that you intentionally use for signing transactions. 

The result: If you do make a mistake and sign a malicious smart contract, the rest of your assets remain safe. Only when you want to spend or sell a given asset should it be transferred to your active wallet.

As always, it’s up to you to decide how much of your crypto is exposed to smart contract risk. You are in charge.