Hardware wallet setup for Kausa admin

A hardware wallet stores your private keys on a separate chip that never touches your computer's memory. Even if your browser gets compromised, an attacker can't sign anything without physically pressing buttons on the device. For admin operations on Kausa, this matters.

What you need

• Ledger Nano S Plus (~€79) or Ledger Nano X (~€149). The S Plus is enough. The X adds Bluetooth for mobile signing.
• Phantom browser extension (Chrome, Firefox, Brave, or Edge).
• A pen and the recovery sheet from the Ledger box.

1. Unbox and initialize

1. Plug the Ledger into your computer via USB.
2. Follow the on-screen prompts to create a new device.
3. Set a PIN (4–8 digits). Pick something you can remember without writing it down.

2. Write down your recovery phrase

The Ledger shows 24 words, one at a time.

• Write each word on the recovery sheet by hand. Do not photograph it, do not type it anywhere, do not store it digitally.
• Keep the sheet somewhere safe and fire-resistant. A second copy in a different physical location is worth the effort.
• If anyone gets these 24 words, they own your wallet. Treat them like cash.

3. Install the Solana app

1. Download and open Ledger Live from ledger.com/ledger-live.
2. Go to My Ledger, search for Solana, click Install.
3. Open the Solana app on the Ledger. The screen should say "Application is ready".

4. Connect to Phantom

1. Open Phantom in your browser.
2. Click the menu (hamburger or avatar), then Add / Connect Hardware Wallet.
3. Select Ledger, click Continue.
4. A browser popup asks you to pick your Ledger USB device. Select it.
5. Phantom imports the Ledger's Solana address. You'll see a new account called "Ledger 1" (rename it if you like).

5. Configure as Kausa admin

1. Copy the public key of your Ledger account from Phantom.
2. Add it to the ADMIN_WALLETS environment variable on the Kausa server (comma-separated list).
3. Restart the Kausa server.
4. Open Kausa in your browser, connect Phantom, select the Ledger account.
5. When signing the SIWS message, the Ledger screen shows "Sign Message". Confirm on the device.
6. You should see the admin dashboard.

Signing transactions

Admin actions that need a signature (campaign verification, for example) prompt the Ledger for confirmation:

1. The Ledger screen shows a summary of what you're signing.
2. Press both buttons to approve. To reject, scroll to Reject and press.

The attacker would need to be holding your Ledger. That's the point.

Troubleshooting

Devnet vs mainnet

On devnet, a hardware wallet is recommended but not required. On mainnet, Kausa will require hardware-backed wallets for all admin operations. Getting used to this flow now saves you a scramble later.