In an essay dated October 31, Ethereum co‑founder Vitalik Buterin disclosed that he is using a command‑line interface (CLI) to manage certain Ethereum tasks instead of web‑based interfaces. The essay notes two distinct tools: an AI‑written utility for updating IPFS content hashes on the Ethereum Name Service (ENS) and a wallet application named kohaku‑cli for executing payments through privacy protocols.
Why a Local Application?
Buterin argues that a locally stored application reduces reliance on repeatedly delivered web code. By keeping a chosen revision of the software, users can control when, or if, they accept updated code and its associated dependencies. This approach shifts the decision about software updates from the server to the user.
Risks Highlighted by the Wallet Documentation
The kohaku‑cli documentation warns that the CLI is unaudited, under active development, and was written with AI assistance. Users are advised not to operate on Ethereum mainnet unless they fully understand the software and the potential for total loss of funds.
Technical Details of the Tool
The wallet supports public Ethereum accounts and private balances on protocols such as Tornado Cash, Railgun, and Privacy Pools V1. Installation requires Node.js 22 or later, with dependencies installed via npm install, a build step, and a local launcher. The project’s manifest pins specific versions of dependencies, including the viem library and several Kohaku packages, and references a fixed Git commit for kohaku‑artifacts.
Transaction Flow and Signature Handling
For ordinary public transfers, the CLI can simulate a transaction without broadcasting it. In contrast, the “unshield” command for Railgun can generate a signed UserOperation that remains ready for later submission through a bundler. The documentation also notes that non‑interactive scripts can submit transactions automatically if appropriate flags are used.
Security and Privacy Considerations
The tool stores an encrypted seed on disk and uses password‑protected files for automation on POSIX systems. While Tor is employed for certain non‑RPC traffic, Ethereum RPC calls continue over standard network connections, meaning that running the CLI locally does not guarantee full network privacy.
Implications
Buterin’s experiment illustrates a concrete method for users to retain control over the code that processes their transactions, emphasizing the importance of software provenance, dependency verification, and careful handling of signing keys.
