Chrome Extension
What the extension does
The Valdium Wallet Chrome extension is a browser-resident keystore and signer for Valdium accounts. It generates and stores your Dilithium3 keypair locally, exposes a per-origin permission model to web dapps, and shows an approval popup whenever a transaction needs your signature. It is the same wallet trust model you already know from MetaMask or MetaMask, with one structural difference: it never touches a TLS handshake, it never funnels signing through a remote server, and it never holds your key in plaintext outside of an in-memory unlock window.
The extension is built on Manifest V3 with the background service worker as the only privileged context. The popup UI, the dapp injection script, and the in-tab provider all talk to the worker over chrome.runtime messages. Keys are unsealed there and never cross into a renderer process.
Install
The extension is in the final stage of Chrome Web Store review. Until it lists, install the latest build as an unpacked extension:
1. Download the signed zip from /downloads and unzip it anywhere on disk.
2. Open chrome://extensions, toggle Developer mode on, click Load unpacked, and select the unzipped folder.
3. Pin the Valdium Wallet tile to your toolbar — the V icon should now be visible to the right of the address bar.
Sideload caveat. Chrome will revoke unpacked extensions on every restart in some profiles. If yours flips off, re-load it from the same folder — settings and the local keystore persist.
Create or import an account
Open the extension and pick one path:
- Create new. The extension generates a fresh Dilithium3 keypair, derives the address, and shows you the 24-word recovery phrase exactly once. Write it down on paper before you click I've saved it. There is no recovery flow beyond this phrase.
- Import from phrase. Paste an existing 24-word phrase. The extension re-derives the keypair under the Valdium project derivation path. The same phrase always lands on the same address.
- Connect a hardware signer. If you keep your key on a Ledger or other external device, the extension delegates signing to it over WebUSB; the private key never enters the browser at all.
Set a local passphrase when prompted. The keystore is encrypted at rest with scrypt(N=2^17) + AES-GCM-256 derived from that passphrase. Forgetting it is equivalent to wiping the wallet — you'll need the recovery phrase to come back.
How dapps see the wallet
The extension injects a provider at window.valdium in every page (a separate object from MetaMask's window.solana and MetaMask's window.ethereum, so all coexist cleanly). The shape of the provider is intentionally similar to the the JSON-RPC provider standard request/response pattern:
const accounts = await window.valdium.request({
method: 'eth_requestAccounts'
});
const sig = await window.valdium.request({
method: 'eth_signTransaction',
params: [{ to, value, data, nonce }]
});Methods follow the val_* namespace so a dapp can detect Valdium versus EVM providers and avoid sending an ECDSA-shaped request to a Dilithium signer. The full method list is in Connect a Wallet.
Per-origin permissions
The first time a site calls eth_requestAccounts the extension shows an approval popup that names the origin, lists the permissions being asked for, and lets you pick which account is exposed. Approvals are scoped to the exact origin (scheme + host + port) and saved until you revoke them from the extension's Connected sites panel.
Signing approvals are not cached — every transaction requires a fresh click, even on a site that already has account access. This is deliberate: account-read permission and signing intent are different security questions and should never collapse into one prompt.
Reading the signing prompt
When a transaction is about to be signed, the prompt shows: the recipient address (with checksum), the VLD value, the estimated gas, the decoded calldata if the recipient is a known contract, and the chain ID. If the contract source has been verified on the explorer, the function name and arguments are rendered as readable JSON; otherwise you see the raw selector and a hex blob and the prompt warns you that the call could not be decoded.
If the prompt can't decode the call, slow down. An unverified contract is not automatically malicious, but you cannot tell from inside the wallet what bytes the contract is going to do with your VLD. Read the source on the explorer first, or pass.
In-extension faucet
The wallet has a built-in testnet faucet button. One click sends a request to testnet.valdium.xyz and drips 100 VLD into the currently selected account. Rate-limited to one drip per minute per IP. See Get Test VLD for the manual flow.
Threat model and limits
The extension protects you against: untrusted dapps trying to read your accounts, untrusted dapps trying to push a signing request without your click, and a stolen browser profile that does not also have your passphrase. It does not protect you against: a compromised operating system with a keylogger, a malicious browser extension running with permission to read your tab content, or a phishing page that convinces you to type your recovery phrase into a form. The wallet will never ask for your recovery phrase outside the initial import flow — anything that does is a phish.