The problem Safest Sofar solves

n response to the recent security breach of app.safe.global where North Korean hackers compromised a developer's laptop and exposed AWS credentials, this project offers a comprehensive security solution for Gnosis Safe wallets. The implementation runs a complete Gnosis Safe infrastructure stack on a Raspberry Pi 5, creating a self-contained, air-gapped transaction signing environment that operates independently from vulnerable web interfaces.

The security cornerstone is the integrated Zymbit HSM6 (Hardware Security Module), which provides military-grade key protection. This dedicated hardware stores all private signing keys in a physically isolated, tamper-resistant environment with features including:

Physical tamper detection that can automatically wipe keys if breached
Encrypted key storage with dedicated secure processing
Hardware-based random number generation for cryptographic operations
Secure authentication mechanisms before allowing signature creation

User Interaction and Data Flow

First they acquire the hardware, a pi500, the HSM6, the GPIO headers and assembled their own hardware wallet.. The opperating system is stored on a SD card that is later soulbound to the computer and the HSM.

The project architecture and development process

The system architecture features multiple security layers, beginning with a locally hosted version of the Gnosis Safe software that eliminates dependency on potentially compromised web services. This allows users to create, sign, and broadcast transactions directly from the Raspberry Pi without exposing sensitive operations to internet-connected services.

Product Integrations

Gnosis Eternal Safe, Zymbit HSM (zymbit.com)

Key differentiators and uniqueness of the project

This is a first of it's kind product, it's a dedicated runner for dapps, this allows security at a level not generally attainable.

Trade-offs and shortcuts while building

We're in hardware, physical hardware, so the complexity has been emmense, plus all things must be compiled on the smaller hardware for security reasons.