Building Infrastructure to Privately Create and Sign Transactions

A smart contract may be transparent when executing blockchain transactions, but it tells you nothing about the interface through which you draft and sign that transaction - and that interface is where some of the largest losses in this industry have started.

Contracting is the moment an agreement becomes binding. It is also the moment a user hands over authority, almost always by approving something a screen has described to them.

An enormous amount of effort goes into making the contract itself trustworthy. Audits, formal verification and bug bounties are all aimed at the code that executes, which is understandable enough, since that code is permanent, public and expensive to get wrong.

However, almost none of that effort reaches the interface through which the contract is invoked. That interface is fetched from a server, assembled from third-party dependencies, resolved through a domain name and delivered over a connection secured by a certificate authority. Each of those is a party you are trusting, and none of them is visible at the point where you sign.

PriFi is an approach to taking privacy and security across the whole lifecycle of a transaction seriously, reducing exposure every step of the way.

In this article, we will recap the concept of PriFi briefly before looking at the contracting stage of a transaction's lifecycle, and at how Logos Storage and Basecamp point towards a way of delivering interfaces that users control themselves.

What is PriFi?

PriFi (private finance) is an infrastructure design philosophy that aims to make every step of the transaction supply chain private, secure, and immune to leakage. It allows people and institutions to choose to safeguard their identities and information when coordinating, settling, and enforcing transactions.

It is not a single solution and is best understood as an ongoing principle of development for sovereign and privacy-preserving infrastructure, a north star guiding the course for building parallel systems that hand true control to their users.

The lifecycle of a transaction can be seen as seven distinct stages:

In a previous article we covered the first three stages, where two parties find each other, coordinate, and agree what they are going to do. This one looks at the fourth stage - contracting.

Contracting sits between coordination and settlement, and it inherits problems from both. The terms were agreed somewhere, the transaction will be broadcast somewhere, and the interface is what joins those two moments together.

Read our article on private and local-first coordination for more on the first three stages.

Where contracting is exposed

The interface you use to build a transaction is not a fixed object. It is reassembled every time you load it, and it can be different tomorrow, or different for you specifically.

Research into the integrity of modern JavaScript has found that scripts on a significant share of websites change content every single day, and that a client has no reliable way to tell a routine update from a hostile one without information it does not have.

It has already happened at scale. In the Bybit compromise of February 2025, the interface used by the signers was served from cloud storage, its JavaScript was modified, and the injected code was written to activate only when the transaction came from particular contract addresses.

Everyone else saw a perfectly normal application, and the malicious code was removed afterwards.

Roughly $1.5 billion was taken, and the smart contracts were never touched.

Domain names are a second weak point, because they do not really belong to the projects that use them. Curve Finance and Convex Finance have both lost their frontends to DNS compromise while their contracts continued to run exactly as written. In the case of Convex, the change was made by a support agent at the domain registrar, on an account that had two-factor authentication enabled.

The third weak point is the dependency chain. A single compromised package account can inject code into the signing surface of every application that depends on it, none of which has been breached itself, and all of which will serve the result to their users without knowing.

All of this converts into losses at the point of signature. When a wallet cannot decode what it has been handed, the user is asked to approve a screen of unreadable data, and a signature over structured data can hand away spending authority while looking like a harmless message.

In each of these cases, the code that executed was correct, public, and auditable. However, it was not the code that the user expected, as they were trusting a compromised third party.

How content addressing changes what an interface is

Logos Storage is content-addressed file sharing and retrieval. You provide a file to the network and get back a content identifier, and anyone who has that identifier can retrieve the file.

The property that matters for contracting is written into the requirements for the module. Files should be addressable by a content identifier such that users are sure that the content they download is the content they expect.

Applied to a frontend, that can change what an interface for a blockchain transaction is. A content identifier is derived from the bytes it names, so the same identifier resolves to the same interface for everyone who asks for it. Serving one visitor a quietly different page from another is made far more difficult, because a different page generates a different identifier.

Content addressing also changes who can serve an interface. Anyone who has downloaded a file can provide it to others, so an application does not depend on its publisher remaining willing, able, or uncompromised in order to stay reachable.

In future versions of the network, Logos plans to deliver authenticated source and build claims through a package-provenance profile, helping users to verify the packages they import.

Content addressing helps ensure that the bytes match the name you asked for, but does not tell you that the name is the right one – that still needs to be accounted for out-of-band.

As long as you are sure of the CID, you can verify it. Instead of trusting a server, a registrar, a certificate authority and a dependency tree on every single page load, you are trusting the source of the identifier and how it reached you.

The remainder of the interface exposure problem is addressed elsewhere in the stack. The Logos Core package manager specifies cryptographic hashes for packages, verification of file integrity during and after download, and delegatable signing chains for decentralised publisher and authorship integrity.

Retrieving an interface is a signal too

Which interface you fetch is information in its own right. A request for the identifier of a particular exchange's frontend announces what you are about to do before you do it, and content addressing alone does nothing to hide that.

This is where Logos Storage meets the work we covered in our previous article on coordination. Testnet v0.3 introduces downloads over Mix, using a transport layer for relatively larger messages, and running over Logos Mix with RLN.

The goal at this stage of the Logos Testnet is that a node downloading a file should not be linkable to the content it downloads.

The node providing the file is not anonymised yet. Publisher anonymity has been specified but not implemented, and full unlinkability on both sides, with cache nodes able to plausibly deny knowledge of what they hold, is a requirement for mainnet rather than for this testnet.

Read the full specification for more information about Mix.

Basecamp and local-first contracting

Content addressing is only as useful as the client that checks it, and a browser is not that client. A browser is built to fetch and execute whatever the server at the other end of a domain name decides to send.

Basecamp is an interface that runs the Logos stack on your own machine. It loads module interfaces as plugins from the modules you have installed, rather than fetching a page from a server each time you want to use one.

There is no domain to hijack, no certificate authority to mis-issue and no hosting provider in the path between you and the application you are signing with.

In Testnet v0.3, the package manager can source module contents through Logos Storage, so what Basecamp loads arrives over the content-addressed network. At this stage of development, indexing and metadata remain on GitHub, and fully decentralised distribution is a later milestone.

Basecamp also loads module interfaces in separate processes, so an application that crashes, or misbehaves deliberately, cannot take the rest of the stack down with it. That is containment rather than verification, and the two are worth keeping distinct.

Download and install Basecamp at logos.co/basecamp.

What is still being built

Much of what is described above is foundational infrastructure rather than a finished product, and the distinction matters.

Logos Storage today is content-addressed file sharing and retrieval. Privacy-preserving filesharing, where neither publisher nor downloader can be identified, is a separate feature still in progress.

Downloads over Mix in Testnet v0.3 will protect the node doing the downloading, although it is important to note that content providers will remain exposed until later work lands.

The storage backend for the package manager is now available and will be steadily improved in future testnets, meaning that users can download packages without relying primarily on GitHub, while fully decentralised distribution and the signing chains that establish publisher integrity are goals for later releases.

These are the primitives that a verifiable contracting flow gets built from. PriFi is a principle of development rather than a product, and Logos infrastructure is being built out with this principle first in mind.

Read more about the architecture of the Logos stack at docs.logos.co.

The place to build for PriFi

An interface you can check for yourself is not a feature that can be added to a hosted application later. It follows from how the application reaches you, which means it has to be designed from the bottom of the stack upwards.

Testnet v0.3 is running now. If you would like to get involved, download Basecamp and run a node on your machine.

If you want to contribute capacity and play a role in the network, check out the node operator guide.

Building infrastructure for everyone is an open, collaborative effort. If you have ideas, objections, or want to understand more about what Logos is building at the edge of PriFi, join the conversation on the Logos forum.