Wallet Logo

MFCoin wallet

latest release: v4.0.0 last analysed  3rd March 2021 Obfuscated  
4.4 ★★★★★
88 ratings
22nd March 2018

Jump to verdict 

Help spread awareness for build reproducibility

Please help us spread the word discussing build reproducibility with MFCoin wallet  via their Twitter!

Do your own research!

Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.

If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.

The Analysis 

  • Native support for bitcoin and most major altcoins
  • Your private keys never leave your device. Strong wallet encryption and cryptography guarantee that your funds will remain safe under your ultimate control.

So it claims to be a self-custodial Bitcoin wallet.

On their website there is a link to their GitHub and the Build Instructions. Those reveal that we are dealing here with a Coinomi Wallet :: Bitcoin Ethereum Altcoins Tokens clone.

Let’s see … they ask us to change the app name to “Coinomi” etc. That can’t be right. Let’s see if the latest version is available. On Google Play we find “v4.0.0” while the build instructions end at “1.6.2”. The repository does have a “v4.0.0” tag though. Let’s see …

$ git clone https://github.com/MFrcoin/android-wallet mfcoin
$ cd mfcoin/
$ git checkout v4.0.0 
$ docker run --rm -v$PWD:/mnt --workdir=/mnt -it walletscrutiny/android bash
root@4481bcaf30f3:/mnt# ./gradlew :wallet:assembleRelease
27 actionable tasks: 27 executed
root@4481bcaf30f3:/mnt# exit
$ unzip 'MFCoin wallet v4.0.0 (com.mfcoin.wallet.dev).apk' -d fromGPlay
$ for f in $( ls wallet/build/outputs/apk/release/*.apk ); do k=$(basename $f); unzip $f -d $k; done
$ for f in $( ls wallet/build/outputs/apk/release/*.apk ); do k=$(basename $f);echo $k $(diff --brief --recursive $k fromGPlay/ | wc -l); done
wallet-arm64-v8a-release-unsigned.apk 124
wallet-armeabi-v7a-release-unsigned.apk 125
wallet-universal-release-unsigned.apk 125
wallet-x86_64-release-unsigned.apk 124
wallet-x86-release-unsigned.apk 125

so all the 5 built files contents differ in over 120 files from the apk on Google Play.

To make matters worse, the project also uses minification which is a form of obfuscation:

$ cat wallet/build.gradle
android {
  buildTypes {
    release {
      minifyEnabled true

so this app is not verifiable.

Verdict Explained

The app's binary contains active obfuscation!

As part of our Methodology, we ask:

Is the decompiled app legible? If not, we tag it Obfuscated!  

When compiling source code to binary, usually a lot of meta information is retained. A variable storing a masterseed would usually still be called masterseed, so an auditor could inspect what happens to the masterseed. Does it get sent to some server? But obfuscation would rename it for example to _t12, making it harder to find what the app is doing with the masterseed.

In benign cases, code symbols are replaced by short strings to make the app smaller but for the sake of transparency this should not be done for non-reproducible Bitcoin wallets. (Reproducible wallets could obfuscate the app for size improvements as the reproducibility would assure the link between code and binary.)

Especially in the public source cases, obfuscation is a red flag. If the code is public, why obfuscate it?

As obfuscation is such a red flag when looking for transparency, we do also sometimes inspect the binaries of closed source apps.

As looking for code obfuscation is a more involved task, we do not inspect many apps but if we see other red flags, we might test this to then put the app into this red-flag category.

The app cannot be independently verified. If the provider puts your funds at risk on purpose or by accident, you will probably not know about the issue before people start losing money. If the provider is more criminally inclined he might have collected all the backups of all the wallets, ready to be emptied at the press of a button. The app might have a formidable track record but out of distress or change in management turns out to be evil from some point on, with nobody outside ever knowing before it is too late.