BEAM Campfire 1.3.1 (beta)

BEAM Campfire 1.3.1 — public beta. Small fixes on top of 1.3.0. Use it with funds you can afford to lose while it is in beta.

Fixed

• Send all, then another asset: "Send all" on BEAM followed by choosing bETH left the same number in the field, now as bETH. The amount is now emptied when the asset changes after Send all; a typed amount still follows the asset.
• Scan from Home: a payment link whose amount can't be read (for example "1,000") now says so on Send, as the Send field's own Scan already did, on desktop and phones. Nothing could be sent without an amount before either; now you're told why it is empty.
• Private node: after the wallet moves back to a public node because your private node didn't answer it in time, Home keeps saying exactly that ("isn't ready yet, tries again in a few minutes") instead of switching to "fell behind" at the node's next report.
• Welcome screen: the "Source code" link stays on one line in Chinese and Russian.

Audited before release; all automated tests pass.

Downloads

Platform	File
macOS (Apple Silicon)	BEAM-Campfire-1.3.1-macos-arm64.dmg — first launch: right-click → Open
Android (phones)	BEAM-Campfire-1.3.1-android-arm64.apk
Android (emulators)	BEAM-Campfire-1.3.1-android-x86_64.apk
Linux (x86_64)	BEAM-Campfire-1.3.1-linux-x86_64.tar.gz
Windows (x86_64)	BEAM-Campfire-1.3.1-windows-x86_64.zip

Check a download with SHA256SUMS.txt.

BEAM Campfire web wallet 0.2.18

The BEAM Campfire web wallet, version 0.2.18: the same signed build that https://pwa.buybeam.my/ and https://vsnation.github.io/beam-campfire-pwa/ serve.

Swap: "the pool is empty" when it isn't

Some pairs have a second pool holding almost nothing next to the real one. The swap asked that one, got no price, and said the pair was empty. Now each pool is asked on its own: one that can't give a price is skipped, and the swap uses the pool that has coins. It says "empty" only when every pool for the pair is.

Safer

• Claiming an old-contract airdrop code (one made before 0.2.16, whose claim shows the code to the network) needs a clear "I understand" first. Without it nothing is sent: the wallet's claim code itself refuses, not only the screen.
• A scanned payment link whose amount is written with a comma ("1,5") is refused instead of read as 1 or 15. Type the amount yourself.
• Paying a BEAM name: when a payment's outcome is unknown, the owner it was meant for stays the remembered one, and never replaces a different owner you paid before.
• Buy BEAM checks a deposit address only against its own rule for that network; a network name it doesn't know is refused, never matched against something else.
• The splash screen's words come from the signed release too: nothing stored in the browser is shown before the wallet has started.

Also

• A failed airdrop batch that never reached a block says so plainly.
• Fuddle, the word game, is in the code but hidden while it is paused.

Audited before release (no finding that can lose money; every point fixed), all unit tests and every browser suite pass.

Loader: sw-ea57ebf485421b18.js (unchanged). Verify: release.sig is an ECDSA P-256 signature of release.json under pwa/keys/release_public.jwk; release.json names the SHA-256 of manifest.json, which lists every file's size and SHA-256.

BEAM Campfire web wallet 0.2.17

The BEAM Campfire web wallet, version 0.2.17: the same signed build that https://pwa.buybeam.my/ and https://vsnation.github.io/beam-campfire-pwa/ serve.

Русский, 简体中文, 日本語

• Every screen of the web wallet in Russian, Simplified Chinese and Japanese: 3,851 texts in each language, including Swap, airdrop codes, BEAM names, dApps, Buy BEAM and every warning. Each text that moves money or guards a secret was translated back to English and checked.
• The wallet opens in your device's language; nothing is asked. To change it: Settings → Appearance → Language. Each language is named in its own script, so you find yours whatever is on screen.
• Never translated: the 12 recovery words (BEAM's word list is English), amounts (always with a dot: 0.5 BEAM), tickers, and the names of dApps and tokens.
• Chinese and Japanese read without stray spaces between sentences.

BEAM's colours come dark

Settings → Appearance → Colours → BEAM now turns the theme to Dark, as BEAM's own wallets look. Light stays one tap away (Theme → Light); going back to Campfire red returns to your device's light or dark, unless you picked a theme yourself.

Also

• The "Stop: unsigned code" warning screen uses only words from the signed release, in every language: nothing stored in the browser can change what it says.
• Changing the language never closes an open sheet (a payment being reviewed stays as it is).
• Deleting a wallet: typing DELETE works from a Chinese or Japanese keyboard too (full-width letters).

Audited before release (no finding that can lose money; every point fixed), all unit tests and every browser suite pass.

Loader: sw-ea57ebf485421b18.js. Verify: release.sig is an ECDSA P-256 signature of release.json under pwa/keys/release_public.jwk; release.json names the SHA-256 of manifest.json, which lists every file's size and SHA-256.

BEAM Campfire web wallet 0.2.16

The BEAM Campfire web wallet, version 0.2.16: the same signed build that https://pwa.buybeam.my/ and https://vsnation.github.io/beam-campfire-pwa/ serve.

Airdrop codes nobody can take from you (#17, #75; thank you @profinch)

New codes are made on the new airdrop contract (ac85d74b…, audited twice, live since 13 October):

• A code never goes on the network. A claim is a signature tied to the claimer's own address, so someone watching the network can no longer copy a pending claim and take the coins.
• Claims from an empty wallet. "Pay the claim fee for each code" (on by default, 0.022 BEAM per code) lets people who hold no BEAM claim. The claim screen says when a code pays its own fee.
• Checked before you share. After the batch is confirmed, the wallet looks up every code on the network; only then are the codes shown as ready to share. Each time you open them you see which are claimed, taken back or still claimable.
• Up to 100 codes per batch. Codes made earlier keep working on the old contract, and their batches can still be taken back.

Proven on mainnet from the web wallet with tiny amounts: create, check, a claim from a wallet holding 0 BEAM, a second claim refused, take back; every amount exactly what the approve sheet said.

Choose your BEAM node (like the Firo web wallet)

• Signal bars on Home open the node screen in one tap.
• Every public BEAM node is listed with its newest block and how fast it answered, checked when you open the screen (each check shows that node your IP address; said on the screen). "Use this one" switches now; the wallet still moves on by itself if that node stops answering.

BEAM's own colours

Settings → Appearance → Colours → BEAM now uses BEAM's brand palette (its wallets' navy and turquoise, from BEAM's media kit), light and dark, with received and sent payments in BEAM's colours. Every text keeps at least 4.5:1 contrast. Campfire red stays the default.

Also

• The app starts lighter: the airdrop's cryptography loads only when you use airdrops.
• The approve sheet could not have shown one kind of request (a call to a missing function); fixed before anything reached it.

Audited before release (no blocking finding; every suggestion fixed), all unit tests and every browser suite pass.

Loader: sw-ea57ebf485421b18.js. Verify: release.sig is an ECDSA P-256 signature of release.json under pwa/keys/release_public.jwk; release.json names the SHA-256 of manifest.json, which lists every file's size and SHA-256.

BEAM Campfire web wallet 0.2.15

The BEAM Campfire web wallet, version 0.2.15: the same signed build that https://pwa.buybeam.my/ and https://vsnation.github.io/beam-campfire-pwa/ serve.

Honest when BEAM's nodes are down. Since 13 October 09:54 UTC every BEAM node's certificate is refused by browsers (expired, incomplete or self-signed; reported as BeamMW/beam#2167), so no browser wallet can reach the network until BEAM renews them. Your coins are safe on the blockchain; the BEAM Campfire apps are not affected.

• 0.2.14 showed "Reconnecting to another node…" for as long as the outage lasted, then "Check your internet connection". Now, after a few seconds of trying, it says BEAM's nodes aren't answering: if other websites open, the problem is on BEAM's side, your coins are safe, and the wallet keeps trying by itself.
• A device that is really offline is told "You're offline" at once, and a wallet on its own node is no longer offered "use random nodes" just because the device is offline.
• "Paused" notes keep BEAM in capitals ("Swaps are paused: BEAM's nodes aren't answering").

Swap

• The ⇅ button sits on the seam between the two cards again (0.2.14's 25% / 50% / 75% / Max row had pushed it onto the "Available" line).
• A price list that comes back empty (it happens for a few seconds after sync) is asked for once more, and otherwise reads "BEAM's exchange sent no prices yet. Try again in a moment", never "Nothing can be bought".

Audited before release (no blocking finding; its five suggestions are all in), 1,196 unit tests and the affected browser suites pass, and the new messages were checked against the real outage.

Loader: sw-ea57ebf485421b18.js. Verify: release.sig is an ECDSA P-256 signature of release.json under pwa/keys/release_public.jwk; release.json names the SHA-256 of manifest.json, which lists every file's size and SHA-256.

BEAM Campfire 1.3.0 (beta)

BEAM Campfire 1.3.0 — public beta. Campfire converted from Firo to BEAM Privacy, with Ethereum beside BEAM. Tested on BEAM and Ethereum mainnet with small amounts; use it with funds you can afford to lose while it is in beta.

What's new in 1.3.0

• Русский, 简体中文, 日本語. Every BEAM screen of the app in Russian, Simplified Chinese and Japanese (3,146 messages each). It follows your device's language; to change it: Settings → Language. Recovery words, amounts (always with a dot: 0.5 BEAM), tickers and names are never translated. In Russian, thousands are grouped with a thin space (1 000.5 BEAM), so "1,000" can never be read as 1.
• Airdrop codes nobody can take from you (Airdrop v3). A claim never shows the code to the network, so nobody watching can copy a pending claim and take it. Codes can carry their own claim fee, so people with an empty wallet can claim. Before you share them, the app checks every code on the network. Up to 100 codes per batch; codes nobody claims can be taken back, with their prepaid fees. Codes from the old contract still work, after a clear warning that claiming them shows the code.
• BEAM's colours. Settings → Colours: BEAM (dark), BEAM light, or BEAM light or dark like your device, from BEAM's own wallets' palette. Campfire red stays the default.
• Paying a BEAM name is safer. The payment is built by BEAM's own vault for exactly the owner the app checked, and a name you paid before is never paid to a new owner without you saying so.
• Swap: 25% / 50% / 75% / Max under the amount; a thin second pool for the same pair no longer makes a pair read "empty".
• Voucher codes are kept out of screenshots and leave the clipboard a minute after copying (and when the app locks).
• Buy BEAM refuses a deposit address that isn't of the coin you pay with, and says "arrived" only for BEAM received at that buy's own address, with the amount received.
• Scan: each code goes to the right place; a payment link starts a fresh payment, and an amount written with a comma is refused rather than guessed.
• dApps: turning Tor on cuts an open dApp's servers at once.

Audited before release (every finding fixed and checked again; the last review found nothing that can lose money), all 2,600+ automated tests pass, the macOS build was started in English, Russian, Chinese and Japanese before release (the Linux and Windows builds ran the app's BEAM core live on mainnet), and Airdrop v3 was proven on mainnet from the app: two prepaid codes made and checked, one claimed from a wallet holding 0 BEAM, a second claim refused, the rest taken back.

Downloads

Platform	File
macOS (Apple Silicon)	BEAM-Campfire-1.3.0-macos-arm64.dmg — first launch: right-click → Open
Android (phones)	BEAM-Campfire-1.3.0-android-arm64.apk
Android (emulators)	BEAM-Campfire-1.3.0-android-x86_64.apk
Linux (x86_64)	BEAM-Campfire-1.3.0-linux-x86_64.tar.gz
Windows (x86_64)	BEAM-Campfire-1.3.0-windows-x86_64.zip

Check a download with SHA256SUMS.txt.

BEAM Campfire web wallet 0.2.14

The BEAM Campfire web wallet, version 0.2.14: the same signed build that https://pwa.buybeam.my/ and https://vsnation.github.io/beam-campfire-pwa/ serve.

Asked for by you. Most of this release comes from your issues; thank you, @dbadol.

• Swap: 25% / 50% / 75% / Max under the amount (#83). The button now says exactly what will be paid, and when the other asset only comes in large steps (bETH: about 0.0025 BEAM per smallest unit) a note says the amount was rounded to a step.
• Updates: a downloaded update you don't want can be deleted ("Delete this download", #78). The update sheet says that every place is asked and every copy is signature-checked (#77).
• The version in small print on Welcome, Unlock and first-run setup (#82).
• BEAM blue: an optional skin in Settings → Appearance; Campfire red stays the default. Every text meets 4.5:1 contrast in both (#80).
• Restore and Rescan always offer "Use a recovery file I downloaded" and say where the snapshot comes from: BEAM's own daily file, which pwa.buybeam.my only relays. If that address is ever gone, download BEAM's file and pick it, or let the wallet scan the chain (#79).
• Airdrop codes work like cash: the wallet now says so where codes are made and where they are claimed (#17, #75; a contract whose claims cannot be copied is in its own audit). A batch holds at most 29 codes, the live contract's limit.

Clearer when something goes wrong

• A payment whose coins were already spent from this wallet somewhere else (another browser or device with the same wallet) says so and points to Rescan, instead of "Failed to register transaction".
• When BEAM's nodes don't answer but the internet works, the wallet says the nodes are down, not your connection. (On 13 October BEAM's node certificates expired and every browser wallet was refused; the apps were not affected.)
• A browser that cannot keep to one tab is told the way out.

Safety

• Ethereum: "Forget this payment" appears only after a recent failing look, and never once a server has taken the payment's bytes again.
• Contract calls: one shader call per app at a time; a refusal is said plainly.
• Updating: "Update" and "Delete this download" tapped together can no longer leave no installed copy, and an update found while another is downloading is kept.

Audited before release: an Opus security audit of everything since 0.2.13, then a re-check of each fix. 1,192 unit tests and every browser suite pass.

Thanks to @profinch for #73 and #74: the engine has refused invoke data above an app's privilege since 0.2.11 (wasm patch 0112), because of that report.

Loader: sw-ea57ebf485421b18.js. Verify: release.sig is an ECDSA P-256 signature of release.json under pwa/keys/release_public.jwk; release.json names the SHA-256 of manifest.json, which lists every file's size and SHA-256.

BEAM Campfire web wallet 0.2.13

The BEAM Campfire web wallet, version 0.2.13: the same signed build that https://pwa.buybeam.my/ and https://vsnation.github.io/beam-campfire-pwa/ serve.

A security release. Six independent audits of 0.2.12, then two re-audits of the fixes and a final review: no remaining way found to lose coins through the wallet's code.

• One tab at a time. Two tabs of the same browser could overwrite each other's wallet data, and a wallet created in one tab could be deleted by the other. A second tab now says "BEAM Campfire is open in another tab" and offers "Use it here instead". Close other BEAM Campfire tabs before updating.
• Payments to .beam names are built by BEAM's own vault program from the owner key the wallet checked, so a lying node can no longer redirect them; an owner that changed since your last payment is shown before you pay. Proven on mainnet: deposit and claim.
• dApps can no longer get a hidden spending ceiling approved, rebuild a call with other code or another contract, or use hidden characters or look-alike names; a dApp installed from a file asks before it sees your balance.
• Ethereum: fee caps; "Replaced" and "Not sent" only with evidence; a payment in doubt pauses the next one so it cannot be paid twice; the swap price is checked with a second server.
• Bridge: coins waiting for you on BEAM are found and collectable whatever this device remembers; a reverted lock is final only after the delivery window.
• Device: airdrop codes of an imported wallet sealed with a slow key derivation; secrets leave the screen when the app goes to the background; copied keys are wiped from the clipboard; stronger passwords; no balances or payment details kept readable without the password; Delete lists coins still on their way.
• Updates and hosting: every update source asked, release dates shown; the loader can update from the public copies if pwa.buybeam.my is ever gone; HSTS; hosts serve only a release whose signature and every file verified (deploy/verify_and_switch.sh).

Loader: sw-d42833d8b7d93c9d.js. Verify: release.sig is an ECDSA P-256 signature of release.json under pwa/keys/release_public.jwk; release.json names the SHA-256 of manifest.json, which lists every file's size and SHA-256.

Web wallet 0.2.9: several wallets, notifications on your device, pools, your own token

The BEAM Campfire web wallet, version 0.2.9: the same signed build that https://pwa.buybeam.my/ and https://vsnation.github.io/beam-campfire-pwa/ serve.

New in 0.2.9: what the BEAM Campfire app does, now in the web wallet

• Several wallets on one device. Add, name, switch and remove wallets; each keeps its own data. Tap the wallet's name on Home to switch.
• Notifications, from your own device. Money in and out, failed payments, swaps and pools done, a private payment ready to spend, a name about to expire, a bridge move ready to collect. A banner while the app is open, a system notification and an app badge when it is not, and "While you were away" on Home when you come back. No server is involved: nothing about your wallet leaves the device. Settings → Notifications has a switch for each kind and "Show amounts". On iPhone they come while the app is open.
• Pools. Add liquidity, take it out, or create a pool on Beam DEX, from any token's page.
• Your own token. Create a token, mint more, burn it, and send airdrop codes from a file.
• A page per token, with its value, and tokens you hide stay hidden.
• BEAM names. Your names, renew, transfer, sell, buy, and claim money sent to a name.
• Payments. Notes, payment proofs (make and check), contacts, QR scanning, and your own addresses with labels.
• Coins. See each coin, split coins to pay several people at once, and receive at offline and max-privacy addresses.
• Pay with BTC, ZEC, LTC and other coins to get WBEAM.
• Move your names, notes and history to another wallet with BEAM's wallet data file (also read by BEAM's own wallets).

Also

• Home shows the total of BEAM and your tokens, and each token's value in BEAM.

Already installed? Settings → Check for updates → Update.

Host your own copy, or run it with no website: download beam-campfire-web-0.2.9.zip and follow README.md inside it.

Check a copy: release.json is signed (release.sig, ECDSA P-256; the public key is in lib/version.js). manifest.json lists the SHA-256 of every file, and release.json holds the SHA-256 of manifest.json. The loader sw-6bbd4c175f01375b.js is named after its own SHA-256. SHA256SUMS.txt covers the files attached here.

Web wallet 0.2.8: typing in Backup's password fixed

The BEAM Campfire web wallet, version 0.2.8: the same signed build that https://pwa.buybeam.my/ and https://vsnation.github.io/beam-campfire-pwa/ serve.

Fixed in 0.2.8: typing a password in Backup

• In Settings → Backup, the password for Export wallet.db (and for the new iCloud copy) took Paste but no typing. Every key now reaches the field.
• On phones the app no longer puts the cursor in a field by itself. On an iPhone that left the field without a keyboard, and a tap then offered only Paste. Now you tap the field and the keyboard opens.
• Every text field in the app (37 of them) was checked on an emulated iPhone: tapped, typed into, and the text arrived.

Already installed? Settings → Check for updates → Update.

Host your own copy, or run it with no website: download beam-campfire-web-0.2.8.zip and follow README.md inside it.

Check a copy: release.json is signed (release.sig, ECDSA P-256; the public key is in lib/version.js). manifest.json lists the SHA-256 of every file, and release.json holds the SHA-256 of manifest.json. The loader sw-68049e9ed43e537d.js is named after its own SHA-256. SHA256SUMS.txt covers the files attached here.