Authentication

The app gates entry behind a wallet signature — there are no passwords or accounts.

Sign in

1. Open /app and click Connect Wallet.
2. Your wallet (any EIP-1193 provider: MetaMask, Rabby, Coinbase Wallet…) asks you to sign a Sign in to Just Bundle message.
3. The signature is verified client-side and a 12-hour session is stored locally. The sidebar shows your connected address; sign out from the same place.

The app also detects wallet/account changes — switching accounts in your wallet re-gates the app automatically.

Token gate

Access can be restricted to $BUNDLE holders. The gate checks balanceOf on Robinhood Chain against the contract set in assets/js/auth.js (GATE.token). Until the token exists, verified signature is the only requirement.

Honest scope

This is frontend gating on a static site — a motivated user can bypass it. The security boundary that matters is the engine vault: bundle keys live on your machine, and every signing call requires the vault password. The website never sees them.

Engine vault vs. wallet login

Two separate identities:

• Connected wallet — your identity on the site. Used for solo trades and for launchAndBuy in standalone mode.
• Vault wallets — the bundle. Generated locally by the engine, unlocked with your vault password, never exposed to the page.