Vanity address
When you create a wallet, you can choose the first digits of its address. Setup makes wallets at random until one has an address that starts with your digits, and keeps that one. It is optional: Grind your vanity address, under "How should it unlock?".
What you can choose
Every Starknet address is a number below 2^251. Written as 64 hexadecimal digits, as Outis and the
explorers show it, its first digit is always 0 and its second is 0 to 7. So you choose the
digits after 0x0: the first from 0 to 7, the rest from 0 to 9 and a to f, as many as
you like, up to the whole address.
The digits are those of the wallet's first account on mainnet. Its other accounts, its agent accounts and its accounts on Sepolia each have an owner key of their own (key derivation), so their addresses are unrelated.
How it works
Each try is a whole new wallet:
- A new 16-byte seed, from the device's secure random source: the same source, and the same size, as any new wallet's.
- From the seed, the first mainnet account's owner key and address, exactly as key derivation describes.
- The address's digits after
0x0, compared with yours. A seed that doesn't match is thrown away.
The search runs on the device, in parallel on its cores (half of them on a phone), with Outis's own derivation compiled to WebAssembly. It shows the closest address found so far, and you can stop at any time and keep that one.
The seed it keeps is derived again by the wallet's own code before it is shown or used, and is kept only if both agree. From then on it is an ordinary wallet: its recovery phrase is shown and checked, it is opened by a passkey or a password, and a passkey wallet is backed up in the vault, as any other.
Why it is safe
The wallet kept is as random as any
Every try is an independent 128-bit draw, with nothing carried from one to the next. Picking one of them by a property of its address tells an attacker nothing: an address is public once it is used, and a chosen one says no more about its seed than any other address does. Finding the key behind it still means searching 2^128 seeds, or breaking the Stark curve, as for every wallet.
The address is a hash of the key
On Starknet an account is a smart contract, and its address is a Pedersen hash of a fixed prefix, the deployer (zero), a salt (zero), the account class and the hash of its constructor arguments, which hold the owner's public key. The hash runs one way: the address doesn't give the public key, let alone the private key. Matching digits is a search among hashes; it does nothing to the key.
Nothing leaves the device
No seed is sent anywhere, stored or logged while it runs. The seeds that don't match stay in the search's own memory and are overwritten by the next batch; only the closest so far reaches the page, until you continue.
Unlike Profanity
In 2022 a vanity address tool for Ethereum, Profanity, started its search from 32 random bits and stepped from one key to the next. Anyone could regenerate every key it had made, and wallets made with it were drained. Here every try is a fresh 128-bit draw: no counter, no sequence, and no one else's software or server.
The seed, not the salt
An account's salt can also be ground, with one key, and each try is cheaper. Outis doesn't: the salt is fixed at zero, so the recovery phrase alone finds the account. A ground salt would have to be kept and restored alongside the phrase.
Odds and time
The first digit is 1 in 8, and each digit after it 1 in 16, so k digits take 16^k / 2 wallets on average:
| Digits | One wallet in |
|---|---|
| 1 | 8 |
| 2 | 128 |
| 3 | 2,048 |
| 4 | 32,768 |
| 5 | 524,288 |
| 6 | 8,388,608 |
| 8 | 2,147,483,648 |
| 10 | 549,755,813,888 |
| 63, the whole address | about 3.6 × 10⁷⁵ |
The step measures the device's speed and says what that means in time. A search has no memory: however long it has run, the wait still ahead is the same on average, and one search in ten takes more than 2.3 times the average. So the step says when nine searches in ten are done, rather than a countdown.
What it doesn't do
- It doesn't prove who you are. Anyone can make an address that starts with the same digits, in seconds for five of them on a computer. Lookalike addresses are a known attack: a small payment from an address that starts and ends like one you know, in the hope you copy it from your history later. Check the end of an address too, or better, all of it.
- It doesn't change the wallet's security. A vanity address rests on the same seed and the same Stark curve as any Starknet account, no weaker and no stronger.
- It isn't recorded. The recovery phrase doesn't say that a wallet was ground. A wallet brought back with its phrase has the same address, and its new passkey the usual name.
The passkey made for the wallet is named after its address, "Outis 0x" and the address's first six
digits. A ground wallet's adds the last four, Outis 0x0deadb…37f4, so that two wallets ground for
the same digits are told apart in a password manager.
Checking it yourself
The recovery tool derives an account's address from its recovery phrase, offline. For the first mainnet account:
./outis-recovery --network SN_MAIN --index 0Its address is the one setup showed.