Send and receive XCH, hold tokens and NFTs, and trade with anyone using offers. When you visit a Chia site — a marketplace, a swap, a game — Loroco asks you before signing anything.
Loroco exposes a Goby-compatible provider and the full Sage WalletConnect2 method surface. The signing key never leaves a WASM engine — the JS shell is the only thing dApps talk to.
The master secret key lives in the sage-wasm engine's memory. JS only ever sees public material. Nothing is persisted to chrome.storage in plaintext.
Every mutating or signing call pops an approval dialog. There is no "remember this site" for spending — the user re-consents to each transaction.
window.loroco speaks chia_*, chip0002_* and snake_case. An opt-in window.chia mirror covers legacy Goby detection.
Full balance, token, NFT and offer surfaces — reads served straight from a local coin-store, writes routed through the Sage engine.
Make, take and cancel offers against dexie & TibetSwap. Royalty assertions and offer decoding are summarised before you sign.
Talks to coinset.org by default, or a local loroco-local-sync sidecar for real P2P peer sync over mTLS.
Home, Send, Receive and Activity — a per-fingerprint wallet that syncs XCH, CATs and NFTs in the background.
Home · balances
Send XCH / CAT
Receive · QR + address
Activity · historyWhen a dApp asks Loroco to do something that moves coins, the popup decodes the request and shows you the real effect — what you offer, what you receive, the network fee — with the origin requesting it. Nothing is blind-signed; you re-consent to every transaction.
createOffer · approval dialog
The four-layer trust ladder (page → content → service worker → WASM), the seven security invariants, and the concrete anti-patterns the codebase guards against.
Every method on window.loroco — read vs. mutating, its params and result, alias namespaces, and CHIP-0002 error codes.
Repo shape, first-time setup, the daily command table, and how to integrate Loroco from a dApp page.
The adversarial-dApp Playwright suite — 17 attack vectors, what each defends, and how to add your own.