Zengo: Crypto & Bitcoin WalletGoogle Play
Our wallet review process
We examine wallets starting at the code level and continue all the way up to the finished app that lives on your device. Provided below is an outline of each of these steps along with security tips for you and general test results.
Application build test result
It is important to note, that even if we had exposed our code, there is no good way to verify that the downloaded mobile app was indeed created from it.
That is exactly what we are doing here. Let’s see if ZenGo answers to our tweet.
The original analysis
This app claims on Google Play:
Never worry about losing your private keys again
With ZenGo’s advanced cryptography, there is no private key. Instead, the responsibility of signing transactions is divided between us and our customers, so that neither party sees the other’s secret information. It also means that you never have to worry about managing private keys again. It makes ZenGo the simplest and safest crypto wallet.
which sounds scary. If you don’t have to worry about private keys, who does have them? If they lose them or go out of business, can you still use your money?
Also if they don’t use established standards, can you still spend your coins if their wallet stops working? They claim you can.
Stay in control
ZenGo does not have access to your funds. All transactions happen directly on the blockchain. With securely encrypted biometrics and our password-free security, only you control your funds.
Again, “only you control your funds” sounds good but with the rest of the comment it’s a bit confusing.
On their website we find more details:
Backing up your wallet is just as simple. An encrypted copy of your device share is stored on the ZenGo server, and the decryption code is stored separately in your personal iCloud (iOS) or Google (Android) account. Only with your 3D biometric face map can you access the encrypted share.
Does that mean that with a photo of you (and probably without) a google engineer can access your backup? That’s a bit scary.
So they claim it is non-custodial but do they share the source code? On that, they link to this blog post where they conclude:
As open-sourcing our code is a step we cannot take back, we prefer to take a cautious approach to it. We already released some portions of our code and intend to gradually release more and more of our software as open source as we gain more confidence in out process and more momentum within the community.
… but for audits, it doesn’t need to be “Open Source” in the sense of this quote. It can just be public code. For audits only.
Their decision to not be transparent earns them the verdict not verifiable.
Do your own research
In addition to reading our analysis, it is important to do your own checks. Before transferring any bitcoin to your wallet, look up reviews for the wallet you want to use. They should be easy to find. If they aren't, that itself is a reason to be extra careful.