HyperPay: BTC & ETH WalletLatest release: 5.0.1 ( 30th May 2022 ) 🔍 Last analysed 10th January 2022 . Obfuscated
Help spread awareness for build reproducibility
Please help us spread the word discussing build reproducibility with HyperPay: BTC & ETH Wallet via their Twitter!
Do your own research!
Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.
The Analysis ¶
(Analysis from Android review)
Update 2022-01-10: The app is back online.
Update 2021-05-25: This app is not available on Google Play anymore. As our last analysis below shows, the app was shady. On Facebook you can still find some scam allegations.
Is HyperPay Wallet Safe?
Yes, of course. HyperPay wallet supports both on-chain & off-chain and both are absolutely safe.
Our security system for off-chain wallet is robust with 24/7 abnormal data monitoring, orchestrated code quality and vulnerability scanning in CI/CD cycle system. Our security team is safeguarding your assets 24/7.
That sounds like a custodial offering if a security team is safeguarding your assets.
Our on-chain wallet is protected by routine coding check and vetting. You control your own Mnemonic and private key. We provide you with the safest infrastructure, you shoulld take care of your own Mnemonic and private key.
Attention: you will lose your wallet assets and never find them back if you forget your mnemonic words. Be sure to write them on the paper and keep in a safe place.
This is a rather explicit claim of being non-custodial.
We find no way to verify the claims made and moreover notice in their Audit report these items:
Open-source intelligence collection -> Collection of personnel and organization structure -> Passed
We read this as the team not being on public record which also means that should they disappear, you won’t know who did it. They have a team page though. It’s Jacob, Gary, Sebastian and Nick. No last names.
Open-source intelligence collection -> GitHub source code leakage detection -> Passed
We read this as this wallet absolutely not being open source. Public audits are not welcome here.
Mobile App audit -> Disable code decompilation -> Passed
We take this as a confirmation that the app is obfuscated and thus file it as not verifiable.
The binary contains active obfuscation!
As part of our Methodology, we ask:Is the decompiled binary legible? If not, we tag it Obfuscated!
When compiling source code to binary, usually a lot of meta information is retained. A variable storing a masterseed would usually still be called
masterseed, so an auditor could inspect what happens to the masterseed. Does it get sent to some server? But obfuscation would rename it for example to
_t12, making it harder to find what the product is doing with the masterseed.
In benign cases, code symbols are replaced by short strings to make the binary smaller but for the sake of transparency this should not be done for non-reproducible Bitcoin wallets. (Reproducible wallets could obfuscate the binary for size improvements as the reproducibility would assure the link between code and binary.)
Especially in the public source cases, obfuscation is a red flag. If the code is public, why obfuscate it?
As obfuscation is such a red flag when looking for transparency, we do also sometimes inspect the binaries of closed source apps.
As looking for code obfuscation is a more involved task, we do not inspect many apps but if we see other red flags, we might test this to then put the product into this red-flag category.
Share onTwitter Facebook LinkedIn
Or embed a widget in your website
<iframe src="https://walletscrutiny.com/widget/#appId=iphone/com.legendwd.hyperpay&theme=auto&style=short" name="_ts" style="min-width:180px;border:0;border-radius:10px;max-width:280px;min-height:30px;"> </iframe>
<iframe src="https://walletscrutiny.com/widget/#appId=iphone/com.legendwd.hyperpay&theme=auto&style=long" style="max-width:100%;width:342px;border:0;border-radius:10px;min-height:290px;"> </iframe>