**Proponent**: 1fN87Fgj5BUhezFgbLiGbXTMrBVggnmYBX9anzMBky8KaJ5

**Date**:  07.06.2023

**Requested DOT**:    1 year budget ~ 173473,98 DOT (exact amount of DOT will be calculated on the day of the on chain treasury proposal)

**Short description**: Maintenance of Ledger Apps for Polkadot, Kusama, Statemine and Statemint. 

**Project Category/Type:** Software development

**Previous treasury proposals**: none

## Overview and Context

Zondax has created and currently maintains the Polkadot, Kusama, Statemine, and Statemint Ledger Apps, which offer users a secure and effortless way to interact with the substrate chains mentioned using their Ledger devices.
 
Maintenance has been funded by the Web3 Foundation until now. The current contract expires at the end of June 2023. For the sake of continuity and to promote further decentralization, we are glad to request funding to the treasury to continue our services.

Our goal with this proposal is to enhance the apps functionality and ensure its continuous compatibility with runtime upgrades and major modifications. We are committed to delivering a high-quality Ledger app that meets the evolving needs of the community.

- [Polkadot](https://github.com/Zondax/ledger-polkadot)  
- [Kusama](https://github.com/Zondax/ledger-kusama) 
- [Statemine](https://github.com/Zondax/ledger-statemine) 
- [Statemint](https://github.com/Zondax/ledger-statemint) 

In order to keep the apps up to date, every time there is a breaking upgrade development work is required and a security code audit review is conducted before any new release. These steps are crucial before the official release of the upgraded version in Ledger Live.


Most of our contributions to the blockchain ecosystem can be found in our [GitHub organization](https://github.com/zondax): 

Over the last few years, Zondax has been involved in a large number of projects for most of the key players in the blockchain industry. For this reason, we are confident that we can provide a long term commitment. 

**About us**

Zondax is a growing and distributed team with experience and projects for more than 50 blockchains. Zondax has been contributing to the Substrate ecosystem since 2018-2019. The team has received and completed a large number of W3F grants and currently maintains most Ledger apps for the ecosystem. Apart from the substrate ecosystem, Zondax participates and contributes to other large ecosystems such as Cosmos, Avalanche, Algorand, Filecoin, ICP, etc. 
Our team includes experts in most blockchain aspects, cryptography and programming languages.

## Proposal objectives

Our goal with this proposal is to enhance the app functionality and ensure its continuous compatibility with runtime upgrades and major modifications. We are committed to delivering a high-quality Ledger app that meets the evolving needs of the community.

In order to keep the Ledger apps up to date, every time there is a breaking upgrade development work is required and a security code audit review is conducted before any new release. These steps are crucial before the official release of the upgraded version in Ledger Live. 

The secure code audit used to be conducted by Ledger, however today, in order to be listed on the Ledger Live “My Ledger” section, all embedded apps must go through an integration process that includes a security audit performed by one of the selected trusted partners of Ledger as stated in their [developer portal](https://developers.ledger.com/docs/embedded-app/security-audit/)  
  

Full proposal can be found [**here**](https://docs.google.com/document/d/1T5mLWymjBLsx9C_nEXrCpyQVI_X4z-UbFz35W-P-E1w/edit#heading=h.d02lx6lgu5q0 ) 

**Legal structure**

Zondax AG

Dammstrasse 16

Zug 6300

Switzerland

UID CHE-491.796.576

(Post edited to incorporate feedback and restructure to follow [template](https://docs.google.com/document/d/1T5mLWymjBLsx9C_nEXrCpyQVI_X4z-UbFz35W-P-E1w/edit)

Proponent: [Polkadot Address] 1fN87Fgj5BUhezFgbLiGbXTMrBVggnmYBX9anzMBky8KaJ5

Date: 07.06.2023
1 year budget:   703’582 CHF ~ 154715,24 DOT (exact amount of DOT will be calculated on the day of the on chain treasury proposal) 

## Overview and Context

Zondax has created and currently maintains the Polkadot, Kusama, Statemine, and Statemint Ledger Apps, which offer users a secure and effortless way to interact with the substrate chains mentioned using their Ledger devices.

Maintenance has been funded by the Web3 Foundation until now. The current contract expires at the end of June 2023. For the sake of continuity and to promote further decentralization, we are glad to request funding to the treasury to continue our services.

Our goal with this proposal is to enhance the apps functionality and ensure its continuous compatibility with runtime upgrades and major modifications. We are committed to delivering a high-quality Ledger app that meets the evolving needs of the community.

- Polkadot  https://github.com/Zondax/ledger-polkadot
- Kusama https://github.com/Zondax/ledger-kusama
- Statemine https://github.com/Zondax/ledger-statemine
- Statemint https://github.com/Zondax/ledger-statemint

In order to keep the apps up to date, every time there is a breaking upgrade development work is required and a security code audit review is conducted before any new release. These steps are crucial before the official release of the upgraded version in Ledger Live.
The team

Zondax is a growing and distributed team with experience and projects for more than 50 blockchains. Zondax has been contributing to the Substrate ecosystem since 2018-2019. The team has received and completed a large number of W3F grants and currently maintains most Ledger apps for the ecosystem. Apart from the substrate ecosystem, Zondax participates and contributes to other large ecosystems such as Cosmos, Avalanche, Algorand, Filecoin, ICP, etc. Our team includes experts in most blockchain aspects, cryptography and programming languages. 

**Legal structure**

Zondax AG

Dammstrasse 16

Zug 6300

Switzerland

UID CHE-491.796.576

Most of our contributions to the blockchain ecosystem can be found in our GitHub organization: https://github.com/zondax

Over the last few years, Zondax has been involved in a large number of projects for most of the key players in the blockchain industry. For this reason, we are confident that we can provide a long term commitment. 

## Project Overview and Scope:

The phase includes general support, project management, bug-fixing, and incidental development  in relation to the following Hardware Wallet software (Ledger apps):

- https://github.com/Zondax/ledger-polkadot
- https://github.com/Zondax/ledger-kusama
- https://github.com/Zondax/ledger-statemine
- https://github.com/Zondax/ledger-statemint

Support includes:

- Upgrading Ledger SDK or firmware that affects the application
- Providing device support for Ledger Nano S, Nano Plus, Nano X, Stax
- Fixing security issues related to Ledger SDK layers
- Monitoring and addressing repository and issue triage
- Supporting breaking upgrades such as runtime and tx_version breaking upgrades
- Addressing incidental development and modifications
- Ensuring resource availability through internal training and resource rotation
- Analyzing and providing early warnings for known security issues that may affect your application
- Changes, additions or removal of pallet or methods.
- Prioritizing and providing early warnings for urgent issues or vulnerabilities
- Coordinating periodically with Ledger

Evaluation criteria: a PR will be sent to Ledger in the following repositories and should result in official public release upon successful review of the security audit report. 

- https://github.com/LedgerHQ/app-polkadot
- https://github.com/LedgerHQ/app-kusama 
- https://github.com/LedgerHQ/app-statemine
- https://github.com/LedgerHQ/app-statemint

Estimated delivery:  continuous delivery upon completion of improvements and breaking upgrades.  

## Financial Offer

For this project we estimate the equivalent of  1.5 FTEs ( at 164hr/mo/FTE ). 

- C / Rust Software Engineers
- Project manager
- Support on demand from:  Cryptographers and other software engineers 

Calculations have been made using a flat hourly rate of 140 CHF/hr irrespective of the specific role. This is due to the broad range of skills that the scope of the work requires. 
We preview a monthly cost of 34’440.00 CHF/month.

Following each upgrade, a security audit is required before the public release of the app. An external security audit, conducted by an independent third-party auditor approved by Ledger, will be performed on the Zondax-developed Ledger App. Zondax will collaborate with the auditors and implement any essential app modifications and improvements identified during the audit process.

Experience gained over the past 12 months indicates that the expected annual audit cost for the mentioned four apps is approximately 240,000 CHF. This budget will ensure thorough and regular security assessments.

The engagement will be valid for 1 year from the day of payment.

- Development: 12 x  34’440  = 413.280 CHF
- Third-party Audits:  240’000 CHF
- Total amount (VAT excluded)    653’280 CHF (1 year)
- Total amount (VAT included) :  653’280 CHF + 50’302 CHF = 703’582 CHF

## License and Legal Notes

### Submission
Zondax implements changes under the Apache 2.0 license. Zondax is building upon apps  that the W3F has already submitted to Ledger. We will submit PRs to Ledger with the corresponding improvements. We assume that as part of the payment, the Foundation and Treasury authorizes us to submit changes of the upgrades to Ledger. 

### Compensation
The compensation is paid upon approval of the proposal or according to the compensation mechanisms provided for in the Polkadot Protocol, respectively. 

### Liability and warranty
Zondax shall develop the solution according to the present proposal under the Open Source Apache 2.0 license. Accordingly, any warranty and liability is limited to what is expressed in the Apache 2.0 license. In general, Zondax disclaims any liability and warranty to the extent permitted by law arising from the present proposal and the resulting agreement.

### Applicable Law / Place of Jurisdiction
Swiss law is applicable. The place of jurisdiction is Zug.


Ledger Apps Maintenance Proposal (Polkadot, Kusama, Statemine, Statemint) 

 Summary:

1. Zondax has created and currently maintains Polkadot, Kusama, Statemine and Statemint Ledger Apps which offer users secure way to interact with the mentioned substrate chains.
2. Maintenance has been funded by the Web3 Foundation until the current contract ends in June 2023.
3. Zondax is now requesting funding for maintenance and to enhance the apps functionality and ensure its continuous compatibility with runtime upgrades and major modifications.
4. Zondax is experienced in developing for blockchain ecosystem such as Substrate, Cosmos, Avalanche, Algorand, Filecoin, ICP.
5. Security code audit is required before releasing the updated version in Ledger Live.
6. The team includes experts in most blockchain aspects, cryptography and programming languages.
7. Legal structure: Zondax AG, Switzerland, UID CHE-491.796.576.

#1812 Ledger Apps Maintenance Proposal (Polkadot, Kusama, Statemine, Statemint)

No Active Proposals