<h1 id="overview">Overview</h1>
The @noble/curves package is a highly secure and thoroughly audited JavaScript library designed for elliptic curve cryptography (ECC). As a part of the noble cryptography suite, this package emphasizes security, minimalism, and ease of audit, all while maintaining zero or minimal dependencies. Its streamlined design and comprehensive feature set make it an ideal choice for a wide array of cryptographic applications, such as secure messaging, digital signatures, and key exchange protocols.
With its focus on robust security, straightforward auditability, and high performance, the @noble/curves package stands as a reliable solution for modern web and mobile applications that require strong cryptographic operations.
&nbsp;
<h2 id="aboutpaulmiller">About Paul Miller</h2>
<a href="https://github.com/paulmillr">Paul</a> is the founding developer behind @noble packages which are used by different web3 ecosystems. He is well known for his contributions via <a href="https://github.com/paulmillr/noble-curves">@noble/curves</a> and <a href="https://github.com/paulmillr/noble-hashes">@noble/hashes</a> packages which are directly/indirectly being used by the majority of the modern web3 protocols/toolings/platforms which includes even the forum you&rsquo;re currently reading this proposal on!
&nbsp;
<h1 id="importance">Importance</h1>
The Polkadot ecosystem currently lacks a well-maintained and audited sr25519 npm package in a pure JavaScript/TypeScript implementation. While the @noble/ed25519 package is already available and utilized by Polkadot-JS over @polkadot/wasm-crypto for handling BigInt operations, there is no equivalent for sr25519. This gap presents a challenge for developers who require a reliable and efficient way to work with sr25519 in native JS/TS within the Polkadot ecosystem, particularly when dealing with large numbers that exceed JavaScript's standard Number primitive. Filling this gap with a properly maintained package would enhance developer reach and flexibility across the ecosystem.
&nbsp;
<h1 id="impact">Impact</h1>
<h3 id="developertoolingbenefits">Developer Tooling Benefits:</h3>
<ul>
<li>Enhanced Simplicity: The @noble/curves package offers a straightforward solution for developers using JavaScript, TypeScript, React, and Next.js, making it easier to work with the native sr25519 package.</li>
<li>Advanced BigInt Handling: Developers gain the ability to handle BigInt operations more effectively, overcoming limitations posed by the @polkadot/wasm-crypto package, which relies on Rust libraries in a WebAssembly wrapper.</li>
<li>Increased Security: The adoption of alternative implementations like @noble/curves will help mitigate the risks associated with dependence on a single package in case of zero-day exploits, acting as an additional layer for ecosystem-wide security.</li>
</ul>
<h3 id="marketingbenefits">Marketing Benefits:</h3>
<ul>
<li>Reputational Boost: By integrating with a widely-used library, the Polkadot ecosystem can enhance its reputation within the broader developer community also <a href="https://paulmillr.com/noble/">getting featured by Paul</a> for sponsoring the development/auditing which puts out a good precedent for the ecosystem.</li>
<li>Increased Visibility: As many developers already use the @noble/curves package, this collaboration could attract more attention to the Polkadot community, particularly among developers who may not yet be familiar with Polkadot's capabilities.</li>
</ul>
<h2 id="edgetributorsubdaosrole">Edgetributor SubDAO&rsquo;s role</h2>
We came across the noble packages while preparing for our next project. We found that there is the ed25519 package which can be used with some patchy ways for our implementation. Then we came across the discussion on a <a href="https://github.com/paulmillr/noble-curves/issues/68">closed issue by ntn-x2</a> where Paul showed interest in the integration of the sr25519 curve, subject to sponsorship availability. So we followed up with him and he wanted to pursue this further. Considering the impact of Paul&rsquo;s work on the whole web3 space, we decided to voluntarily curate his proposal and take care of all the administrative work (as per his request). The entire amount corresponding to this proposal and the audit sponsorship proposal (yet to be proposed) will go to him and the auditing entity. In this whole process, Edgetributor SubDAO or Edgeware DAO or any Edgeware contributors are not getting financially benefited by any means.
&nbsp;
<h1 id="budgetandtimeline">Budget and Timeline</h1>
Budget distribution:
<ul>
<li>Part a (sign, verify, Point, pubkey) would take up to 1 working week, costing a maximum of 10000 USD for implementation. It could have been smaller, but it uses Merlin, which further utilizes Strobe.</li>
<li>Part b (hdkd, <del>musig,</del> vrf) would take up to 1 working week, thus the implementation would cost a maximum of <del>10000</del> 8000 USD. {Depending upon the viability, we might have a separate <a href="https://paulmillr.com/noble/#scure">@scure</a>/sr25519 package for the <del>musig and/or</del> vrf instead of including <del>them</del> it under @noble/curves/sr25519.}</li>
</ul>
Notable terms:
<ul>
<li>If the development finishes earlier than 2 work weeks, the corresponding unused funds will be returned.</li>
<li>Paul suggested the Cure53 auditing firm which doesn&rsquo;t need any upfront payment. He received the all-included quotation of 22500 EUR for a maximum total of 18 working days.</li>
<li>However, Cure53 is booked until January. So he is open to getting the auditing done through any other auditing firms. We are already discussing this with an auditing firm having an earlier availability. If anyone from the community knows of any auditing firms available within 1-2 months, feel free to suggest them in the comments.</li>
<li>For now, this proposal will be proposed for only the development of the @noble/curves/sr25519 package and another proposal can be proposed for the auditing after the development.</li>
<li>Paul requested payment through Github Sponsorships. For the same, we will buy 8-10 prepaid Visa/Mastercard cards using USDT which will incur 4-10% fees. We will share proof of the prepaid cards&rsquo; purchases and the unused fee buffer amount for the fiat conversion will be returned to the treasury.</li>
</ul>
Requested amount: <del>20000</del> 18000 USD
Fee buffer amount for fiat conversion(10%): <del>2000</del> 1800 USD {unused amount will be refunded to the treasury} Total: <del>22000</del> 19800 USDT
Multisig: 14XNJmoUzkvmh9cYoqG4axBRR4BWzWRbnFP79oiZgKu7V9bz
 Changelog:
Jeff Burdges suggested removing MuSig, considering its near-to-no adoption across the ecosystem. He also suggested supporting the <a href="https://github.com/w3f/schnorrkel/pull/110">upcoming OLAF protocol</a>, which can be done through a separate proposal as it is currently in the WIP phase. The proposal has been updated as per the new estimation by Paul Miller after removing the MuSig from the development scope. Huge thanks to Shawn Tabrizi for the feedback on <a href="https://x.com/TheKusamarian/status/1835423345879195884">the AAG presentation</a> and for advocating to take feedback from Jeff Burdges.

Development of @noble/curves/sr25519 package by Paul Miller and audit sponsorship (1/2)

Treasury

Propose and approve a spend of treasury funds.

## Dispatch Origin

Must be [`Config::SpendOrigin`] with the `Success` value being at least
`amount` of `asset_kind` in the native asset. The amount of `asset_kind` is converted
for assertion using the [`Config::BalanceConverter`].

## Details

Create an approved spend for transferring a specific `amount` of `asset_kind` to a
designated beneficiary. The spend must be claimed using the `payout` dispatchable within
the [`Config::PayoutPeriod`].

### Parameters
- `asset_kind`: An indicator of the specific asset class to be spent.
- `amount`: The amount to be transferred from the treasury to the `beneficiary`.
- `beneficiary`: The beneficiary of the spend.
- `valid_from`: The block number from which the spend can be claimed. It can refer to
  the past if the resulting spend has not yet expired according to the
  [`Config::PayoutPeriod`]. If `None`, the spend can be claimed immediately after
  approval.

## Events

Emits [`Event::AssetSpendApproved`] if successful.

- **Problem Statement:** Polkadot ecosystem lacks a well-maintained and audited sr25519 npm package in JavaScript/TypeScript, hindering developers working with large numbers.
- **Significance:** Filling this gap with the @noble/curves/sr25519 package would enhance developer reach and flexibility within the Polkadot ecosystem.
- **Proposed Solution:** Develop the @noble/curves/sr25519 package for efficient BigInt handling, security, and simplicity in working with sr25519 in JavaScript/TypeScript.
- **Expected Outcomes:** Enhanced developer tooling, increased security, reputational boost for Polkadot ecosystem, and increased visibility among developers.

#1165 Development of @noble/curves/sr25519 package by Paul Miller and audit sponsorship (1/2)

No Active Proposals