
TokenPocket Wallet Crypto DeFi
Latest release: 1.5.2 ( 30th June 2022 ) š Last analysed 9th January 2022 . ObfuscatedHelp spread awareness for build reproducibility
Please help us spread the word discussing build reproducibility with TokenPocket Wallet Crypto DeFi via their Twitter!
Do your own research!
Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.
If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.
The Analysis ¶
From the description:
You can store, send and receive your Bitcoin (BTC), Ethereum (ETH), EOS, TRON (TRX), IOST, Cosmos and Biance (BNB) easily.
so itās a BTC wallet and according to the following also self-custodial and open source:
Features of the Multi-Crypto Wallet
- An open-sourced decentralized wallet, keep your cryptocurrencies safe
⢠It is an open-sourced and non-custodial decentralized wallet that stores your private keys on usersā device, you can store, send and receive all your tokens within the wallet.
And indeed, on their website we can find a link to their repository on GitHub.
A quick look at the code though reveals several issues:
- Minification is a sort of obfuscation and they minify.
- The
applicationId
is not vip.mytokenpocket. - The repository was last active two years ago while the app on Google Play was last updated two weeks ago.
- The description sounds very different to the Play Store description:
Only supports SWTC Blockchain for now, we will support Ethereum Blockchain and so on in the future.
So for now we have to file it as āobfuscatedā and recommend to be careful as some things donāt add up. At least the āopen sourceā claim is probably false. In any case the app is not verifiable as is.
(lw)
Verdict Explained
The binary contains active obfuscation!
As part of our Methodology, we ask:
Is the decompiled binary legible? If not, we tag it Obfuscated!When compiling source code to binary, usually a lot of meta information is retained. A variable storing a masterseed would usually still be called masterseed
, so an auditor could inspect what happens to the masterseed. Does it get sent to some server? But obfuscation would rename it for example to _t12
, making it harder to find what the product is doing with the masterseed.
In benign cases, code symbols are replaced by short strings to make the binary smaller but for the sake of transparency this should not be done for non-reproducible Bitcoin wallets. (Reproducible wallets could obfuscate the binary for size improvements as the reproducibility would assure the link between code and binary.)
Especially in the public source cases, obfuscation is a red flag. If the code is public, why obfuscate it?
As obfuscation is such a red flag when looking for transparency, we do also sometimes inspect the binaries of closed source apps.
As looking for code obfuscation is a more involved task, we do not inspect many apps but if we see other red flags, we might test this to then put the product into this red-flag category.
Share on
Twitter Facebook LinkedInOr embed a widget in your website
<iframe
src="https://walletscrutiny.com/widget/#appId=android/vip.mytokenpocket&theme=auto&style=short" name="_ts"
style="min-width:180px;border:0;border-radius:10px;max-width:280px;min-height:30px;">
</iframe>
and
<iframe
src="https://walletscrutiny.com/widget/#appId=android/vip.mytokenpocket&theme=auto&style=long"
style="max-width:100%;width:342px;border:0;border-radius:10px;min-height:290px;">
</iframe>