
Blockchain Plus Wallet v2
Latest release: 1.1.1 ( 23rd April 2021 ) đ Last analysed 2nd July 2021 . Obfuscated Not functioning anymoreDo your own research!
Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.
If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.
The Analysis ¶
This app claims to be a server-less and self-custodial Bitcoin wallet. We were asked about funds disappearing on our Wallet Support chat and had a look:
There is no website.
The app is in the category âgames/casinoâ.
The app has no way of creating a new wallet but straight asks for an âintroduction
or restore codeâ which probably is something in the original
Blockchain.com Wallet: Buy BTC
and entering it leaks it to the provider of this âwalletâ.
It turns out this wallet is not only weird with tons of negative feedback, itâs also closed source and upon closer inspection the binary is obfuscated:
For example itâs really hard to guess what happens in this class:
public class b extends a {
/* renamed from: c reason: collision with root package name */
static boolean f305c = false;
/* renamed from: a reason: collision with root package name */
private final h f306a;
/* renamed from: b reason: collision with root package name */
private final c f307b;
public static class a<D> extends m<D> implements a.AbstractC0019a<D> {
private final int j;
private final Bundle k;
private final a.h.b.a<D> l;
private h m;
private C0018b<D> n;
private a.h.b.a<D> o;
/* access modifiers changed from: package-private */
public a.h.b.a<D> a(boolean z) {
if (b.f305c) {
Log.v("LoaderManager", " Destroying: " + this);
}
this.l.a();
throw null;
}
With this many red flag this app is not only not verifiable but also better avoided.
Verdict Explained
The binary contains active obfuscation!
As part of our Methodology, we ask:
Is the decompiled binary legible? If not, we tag it Obfuscated!When compiling source code to binary, usually a lot of meta information is retained. A variable storing a masterseed would usually still be called masterseed
, so an auditor could inspect what happens to the masterseed. Does it get sent to some server? But obfuscation would rename it for example to _t12
, making it harder to find what the product is doing with the masterseed.
In benign cases, code symbols are replaced by short strings to make the binary smaller but for the sake of transparency this should not be done for non-reproducible Bitcoin wallets. (Reproducible wallets could obfuscate the binary for size improvements as the reproducibility would assure the link between code and binary.)
Especially in the public source cases, obfuscation is a red flag. If the code is public, why obfuscate it?
As obfuscation is such a red flag when looking for transparency, we do also sometimes inspect the binaries of closed source apps.
As looking for code obfuscation is a more involved task, we do not inspect many apps but if we see other red flags, we might test this to then put the product into this red-flag category.
But we also ask:
Is the product still supported by the still existing provider? If not, we tag it Defunct!Discontinued products or worse, products of providers that are not active anymore, are problematic, especially if they were not formerly reproducible and well audited to be self-custodial following open standards. If the provider hasnât answered inquiries for a year but their server is still running or similar circumstances might get this verdict, too.
Share on
Twitter Facebook LinkedInOr embed a widget in your website
<iframe
src="https://walletscrutiny.com/widget/#appId=android/com.blockchainproplus.bpw&theme=auto&style=short" name="_ts"
style="min-width:180px;border:0;border-radius:10px;max-width:280px;min-height:30px;">
</iframe>
and
<iframe
src="https://walletscrutiny.com/widget/#appId=android/com.blockchainproplus.bpw&theme=auto&style=long"
style="max-width:100%;width:342px;border:0;border-radius:10px;min-height:290px;">
</iframe>