Help spread awareness for build reproducibility
Please help us spread the word, asking Sallet One to support reproducible builds via their Twitter!
Do your own research!
Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.
If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.
The Analysis ¶
This hardware wallet requires a companion app: SalletOne Live Few Users downloadable via Google Play or the Apple store.
The user manual describes the procedure once a user unboxes his Sallet One device.
- Password setting
- Mnemonic phrase generation
- Confirmation of mnemonic backup
- Mnemonic words import
- Password
- Home page is the wallet address
- QR code for receiving
- The device can generate any number of addresses for multiple currencies
- The device can scan the QR code from the app
- The transaction details are confirmed and confirmed through the device itself.
Private keys can be created offline - ✔️
From the Terms of Use
“Cold wallet” refers to a wallet product that stores private keys of digital assets and never connects to the Internet. Sallet one cold wallet is a hardware wallet, which is used to generate mnemonic words randomly, and private keys of different currencies are generated from the mnemonic words. In the end, the private key generates the public key, and finally the public key generates the asset address to realize the safe storage of digital assets.
Private keys are not shared - ✔️
From the SalletOne User Service Protocol
Article 31 The Users shall be responsible for the proper safekeeping of their mobile devices, as well as their information such as Wallet passwords, private keys, mnemonics and Keystore. The Company is not responsible for the safe-keeping of such devices or information of the Users. All risks, responsibilities, losses and expenses caused by the Users’ loss of their mobile devices, their active or passive disclosure or forgetting of their Wallet passwords, private keys, mnemonic words, Keystore, or attacks or fraud by others shall be borne exclusively by the Users.
Device displays receive address for confirmation - ✔️
Yes. This is documented in the user manual.
Interface - ✔️
The 4 inch display touchscreen makes it convenient to use the device. Device communication with companion app is through QR code.
Code and Reproducibility
We were able to locate Sallet One’s GitHub repository but it lacks build instructions. Together with the lack of actual product pictures or videos, the code being only two commits, the companion apps not having many users/ratings and the rather lacking documentation we have little hope for this product to be very interesting but for now simply consider it as not verifiable.
Verdict Explained
We could not verify that the provided code matches the binary!
As part of our Methodology, we ask:
Is the published binary matching the published source code? If not, we tag it Unreproducible!Published code doesn’t help much if it is not what the published binary was built from. That is why we try to reproduce the binary. We
- obtain the binary from the provider
- compile the published source code using the published build instructions into a binary
- compare the two binaries
- we might spend some time working around issues that are easy to work around
If this fails, we might search if other revisions match or if we can deduct the source of the mismatch but generally consider it on the provider to provide the correct source code and build instructions to reproduce the build, so we usually open a ticket in their code repository.
In any case, the result is a discrepancy between the binary we can create and the binary we can find for download and any discrepancy might leak your backup to the server on purpose or by accident.
As we cannot verify that the source provided is the source the binary was compiled from, this category is only slightly better than closed source but for now we have hope projects come around and fix verifiability issues.
Share on
Twitter Facebook LinkedInOr embed a widget in your website
<iframe
src="https://walletscrutiny.com/widget/#appId=hardware/sallet.one&theme=auto&style=short" name="_ts"
style="min-width:180px;border:0;border-radius:10px;max-width:280px;min-height:30px;">
</iframe>
and
<iframe
src="https://walletscrutiny.com/widget/#appId=hardware/sallet.one&theme=auto&style=long"
style="max-width:100%;width:342px;border:0;border-radius:10px;min-height:290px;">
</iframe>