This past week there was a hack of wallets (mostly related to Solana blockchain), resulting in the theft of millions of dollars worth of tokens. The root cause was that many users had been using the "Slope" wallet, which had a design flaw in its security that was eventually exploited. Slope is a closed-source wallet, so the source code for this software was never reviewed externally and the flaw was not discovered. Thus people using Slope thought they "held their own keys", but ultimately they didn't.
You are little better off using a closed-source wallet app than you are leaving funds on a custodial exchange. And even if there is source code published for your wallet app, what good does that do you? If the app you downloaded and installed doesn't match the source code, then having an "open source" wallet even means pretty much nothing!
The only surefire way to know that the software download matches the source code is to build it yourself and compare. Almost nobody does that. But there are two projects that aim to show proof that a software build available to the public can be reproduced from the software project's corresponding source code repo.
This post is simply to bring awareness to these two projects and to list the surprisingly very few software releases which are (currently) found to be reproducible.
"BitcoinBinary.org is a repository of Reproducible Build Proofs for Bitcoin Projects"
Reproducible: [13 brands]
- BITBOX02
- BITCOIN CORE (and BITCOIN-CORE)
- BLOCKSTREAM GREEN (and BLOCKSTREAM-GREEN)
- COLDCARD (and COLDCARD-MK3)
- ELECTRUM
- LND
- MYCELIUM (and MYCELIUM-ANDROID)
- SIMPLE BITCOIN WALLET (and SIMPLE-BITCOIN-WALLET)
- SPARROW (and SPARROW WALLET)
- TREZOR 1 (and TREZOR T)
- WASABI (and WASABI WALLET)
- ZAP (and ZAP-ANDROID)
To improve the security of Bitcoin wallets by examining products for transparency and potential attacks
Play Store:Play Store:
Reproducible: [9 apps]
- Bitcoin Wallet (Shildbach)
- Mycelium Bitcoin Wallet
- Electrum Bitcoin Wallet
- SBW: Simple Bitcoin Wallet
- Green: Bitcoin Wallet
- Unstoppable Wallet
- AirGap Vault- Tezos, Cosmos, Ethereum, Bitcoin
- Zap: Bitcoin Lightning Wallet
- ABCore [obsolete]
Unreproducible: [19 apps]
Others not included (e.g., custodial, no source, not enough users, etc.): [Hundreds]
App Store:App Store:
Reproducible: [0 apps]
Unreproducible: [16 apps]
Others not included (e.g., custodial, no source, not enough users, etc.): [Hundreds]
Hardware Wallet:Hardware Wallet:
Reproducible: [4 devices]
- Trezor One
- KeepKey
- Trezor Model T
- Foundation Passport
Unreproducible: [11 devices]
Others not included (e.g., custodial, no source, not enough users, etc.): [Dozens]
Just having a reproducible build doesn’t mean that it’s secure. That’s one of the things I don’t like about walletscrutiny. Their methodology for determining what to put a green label on and what to put a red label on is misleading at best.
There is a lot more to wallet security and trying to boil it all down to reproducible builds is actively harmful to the ecosystem.
Also iOS apps aren’t binary-reproducible, so there’s a whole thing…
Trusting Apple seems like a pretty bad idea anyway.
Reproducible builds at least guarantee the source makes the binary that is distributed.
Does walletscrutiny say something more than "we can build these and get the same hash as the one being distributed?"
the problem is that you can't get the hash of an ios app on your phone.
deleted by author
deleted by author
I disagree that Wallet Security is harmful to the ecosystem.
But to get further, there is the tragedy of the commons. Security audits on the code would help with that. Security audits are labor expensive. Who will pay for these security audits to vet the open source code on these wallets?
It's the tragedy of the commons. Security audits on the code would help with that. Security audits are labor expensive. Who will pay for these security audits to vet the open source code on these wallets?
Wallet Scrutiny created a Twitter thread recently. The Tweet that kicked off the thread is:
https://twitter.com/WalletScrutiny/status/1555707192367513601
https://nitter.it/WalletScrutiny/status/1555707192367513601
And this Tweet by the founder of Wallet Scrutiny, in response to Fiatjaf's Tweet which also happened to be on SN today:
https://twitter.com/LeoWandersleb/status/1555982693120315393
https://nitter.it/LeoWandersleb/status/1555982693120315393
There are a couple other posts, here on SN, where these two projects were shared:
BitcoinBinary.org - A repository of Reproducible Build Proofs for Bitcoin Projects
#17501
https://bitcoinbinary.org
Is your Bitcoin wallet secure?
#5436
https://walletscrutiny.com
Also see this post:
Wallet Scrutiny
#131993
deleted by author