Skip to content

Conversation

@m4sterbunny
Copy link
Contributor

@m4sterbunny m4sterbunny commented Dec 29, 2025

Description

Simplification how the cryptography is presented
Proofs
Applies docs style

DOES NOT - touch images

Issue(s) fixed

Partial fix for 2483 #

Preview

Checklist

  • If this PR updates or adds documentation content that changes or adds technical meaning, it has received an approval from an engineer or DevRel from the relevant team.
  • If this PR updates or adds documentation content, it has received an approval from a technical writer.

External contributor checklist

  • I've read the contribution guidelines.
  • I've created a new issue (or assigned myself to an existing issue) describing what this PR addresses.

Note

Updates and streamlines the Embedded Wallets cryptography documentation and enables proper math rendering.

  • Introduces _sdk-key-model-table.mdx and embeds it in infrastructure/README.mdx
  • Significant rewrites to infrastructure/README, mpc-architecture.mdx, sss-architecture.mdx, nodes-and-dkg.mdx, and glossary.mdx to clarify terminology, flows, security assumptions, and protocols
  • Adds KaTeX stylesheet via CDN in docusaurus.config.js and bumps katex dependency (and lockfile) to support math notation
  • Minor sidebar/link text adjustments in ew-sidebar.js

Written by Cursor Bugbot for commit 13e7748. This will update automatically on new commits. Configure here.

@vercel
Copy link

vercel bot commented Dec 29, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (UTC)
metamask-docs Error Error Dec 30, 2025 0:21am

@socket-security
Copy link

socket-security bot commented Dec 29, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedkatex@​0.16.22 ⏵ 0.16.2793 -5100100 +194100

View full report

@socket-security
Copy link

socket-security bot commented Dec 29, 2025

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
Network access: npm katex in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package-lock.jsonnpm/[email protected]

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

The client then assembles these shares and reconstructs the users key in the front-end.
The client then assembles these shares and reconstructs the user's key in the frontend.

<!-- The phrase "reconstructs the user's key in the frontend" sounds incorrect and potentially misleading. In an MPC/TSS design, the private key should never be reconstructed client-side. Should this instead say something like: "The client combines the required shares as part of a threshold signing protocol, ensuring that the full private key is never reconstructed or exposed"? Also, can we clarify whether "frontend" refers to the dApp client or a Torus-controlled client environment? -->
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review comment accidentally committed to documentation

An HTML comment containing a developer review note was left in the documentation. The comment questions whether the preceding text about reconstructing the user's key in the frontend is accurate for an MPC/TSS design, and suggests alternative wording. While HTML comments are hidden from rendered output, this internal review note with suggested rewrites should not be in the committed documentation.

Fix in Cursor Fix in Web

label: "Compliance, Audits and Trust",
href: "https://trust.web3auth.io",
label: "Compliance, Audits and Trust",
href: "https://trust.web3auth.io", // needs proofing (landing page missing stop)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Internal review comment left in production code

An internal review note // needs proofing (landing page missing stop) was left in the sidebar configuration. This comment appears to be a TODO or review reminder that should have been addressed before committing, not left in the codebase.

Fix in Cursor Fix in Web

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

indeed -- this note need to become actionable item elsewhere, hence "do not merge" label on this PR

@@ -0,0 +1,14 @@
---
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR has "do not merge" label because vercel wont like meta in the single sourced mdx --> need to finalize this ahead of final review

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MPC is only supported in MPC Core Kit SDK, which is not documented here due to enterprise plan issues.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It has a different document, just for integration for particular customers.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I had run the issue down that far. So, to use this table and make clear for end users -- I would need to know if all the same platforms are supported my this "MPC Core Kit SDK" -- in which case, the platforms column is redundant and can go

This document provides an in-depth exploration of the technical architecture of the Multi-Party Computation (MPC)-based SDK, this includes the MPC Core Kit SDK.

The only difference between the SSS-based SDKs and MPC SDKs are that during usage/login MPC SDKs do not reconstruct user private keys.
<!-- This deserves link to the SDK: which of these docs pages covers the Core Kit SDK? Alt is this is enterprise grade option only, in which case consider importing ./_partials/_sdk-key-model-table.mdx-->
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

comments still in play, hence "do not merge" label on this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants