Wallet Logo

TokenPocket Wallet Crypto DeFi

Latest release: 1.5.2 ( 30th June 2022 ) šŸ” Last analysed 9th January 2022 . Obfuscated
4.3 ā˜…ā˜…ā˜…ā˜…ā˜…
16862 ratings
1 million
29th June 2018

Jump to verdict 

Help spread awareness for build reproducibility

Please help us spread the word discussing build reproducibility with TokenPocket Wallet Crypto DeFi  via their Twitter!

Do your own research!

Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.

If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.

The Analysis 

From the description:

You can store, send and receive your Bitcoin (BTC), Ethereum (ETH), EOS, TRON (TRX), IOST, Cosmos and Biance (BNB) easily.

so itā€™s a BTC wallet and according to the following also self-custodial and open source:

Features of the Multi-Crypto Wallet

  1. An open-sourced decentralized wallet, keep your cryptocurrencies safe
    ā€¢ It is an open-sourced and non-custodial decentralized wallet that stores your private keys on usersā€™ device, you can store, send and receive all your tokens within the wallet.

And indeed, on their website we can find a link to their repository on GitHub.

A quick look at the code though reveals several issues:

  • Minification is a sort of obfuscation and they minify.
  • The applicationId is not vip.mytokenpocket.
  • The repository was last active two years ago while the app on Google Play was last updated two weeks ago.
  • The description sounds very different to the Play Store description:

Only supports SWTC Blockchain for now, we will support Ethereum Blockchain and so on in the future.

So for now we have to file it as ā€œobfuscatedā€ and recommend to be careful as some things donā€™t add up. At least the ā€œopen sourceā€ claim is probably false. In any case the app is not verifiable as is.

(lw)

Verdict Explained

The binary contains active obfuscation!

As part of our Methodology, we ask:

Is the decompiled binary legible? If not, we tag it Obfuscated!

When compiling source code to binary, usually a lot of meta information is retained. A variable storing a masterseed would usually still be called masterseed, so an auditor could inspect what happens to the masterseed. Does it get sent to some server? But obfuscation would rename it for example to _t12, making it harder to find what the product is doing with the masterseed.

In benign cases, code symbols are replaced by short strings to make the binary smaller but for the sake of transparency this should not be done for non-reproducible Bitcoin wallets. (Reproducible wallets could obfuscate the binary for size improvements as the reproducibility would assure the link between code and binary.)

Especially in the public source cases, obfuscation is a red flag. If the code is public, why obfuscate it?

As obfuscation is such a red flag when looking for transparency, we do also sometimes inspect the binaries of closed source apps.

As looking for code obfuscation is a more involved task, we do not inspect many apps but if we see other red flags, we might test this to then put the product into this red-flag category.

The product cannot be independently verified. If the provider puts your funds at risk on purpose or by accident, you will probably not know about the issue before people start losing money. If the provider is more criminally inclined he might have collected all the backups of all the wallets, ready to be emptied at the press of a button. The product might have a formidable track record but out of distress or change in management turns out to be evil from some point on, with nobody outside ever knowing before it is too late.