Wallet Logo

HyperPay :Wallet Crypto & Card

Latest release: 5.0.14 ( 29th October 2022 ) 🔍 Last analysed 25th May 2021 . Obfuscated
4.8 ★★★★★
2781 ratings
100 thousand
25th October 2018

Jump to verdict 

Help spread awareness for build reproducibility

Please help us spread the word discussing build reproducibility with HyperPay :Wallet Crypto & Card  via their Twitter!

Do your own research!

Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.

If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.

The Analysis 

Update 2022-01-10: The app is back online.

Update 2021-05-25: This app is not available on Google Play anymore. As our last analysis below shows, the app was shady. On Facebook you can still find some scam allegations.

Is HyperPay Wallet Safe?
Yes, of course. HyperPay wallet supports both on-chain & off-chain and both are absolutely safe.

Ok?

Our security system for off-chain wallet is robust with 24/7 abnormal data monitoring, orchestrated code quality and vulnerability scanning in CI/CD cycle system. Our security team is safeguarding your assets 24/7.

That sounds like a custodial offering if a security team is safeguarding your assets.

Our on-chain wallet is protected by routine coding check and vetting. You control your own Mnemonic and private key. We provide you with the safest infrastructure, you shoulld take care of your own Mnemonic and private key.
Attention: you will lose your wallet assets and never find them back if you forget your mnemonic words. Be sure to write them on the paper and keep in a safe place.

This is a rather explicit claim of being non-custodial.

We find no way to verify the claims made and moreover notice in their Audit report these items:

Open-source intelligence collection -> Collection of personnel and organization structure -> Passed

We read this as the team not being on public record which also means that should they disappear, you won’t know who did it. They have a team page though. It’s Jacob, Gary, Sebastian and Nick. No last names.

Open-source intelligence collection -> GitHub source code leakage detection -> Passed

We read this as this wallet absolutely not being open source. Public audits are not welcome here.

Mobile App audit -> Disable code decompilation -> Passed

We take this as a confirmation that the app is obfuscated and thus file it as not verifiable.

(lw)

Verdict Explained

The binary contains active obfuscation!

As part of our Methodology, we ask:

Obfuscated!

Is the decompiled binary legible?

If the answer is "no", we mark it as "Obfuscated".

When compiling source code to binary, usually a lot of meta information is retained. A variable storing a masterseed would usually still be called masterseed, so an auditor could inspect what happens to the masterseed. Does it get sent to some server? But obfuscation would rename it for example to _t12, making it harder to find what the product is doing with the masterseed.

In benign cases, code symbols are replaced by short strings to make the binary smaller but for the sake of transparency this should not be done for non-reproducible Bitcoin wallets. (Reproducible wallets could obfuscate the binary for size improvements as the reproducibility would assure the link between code and binary.)

Especially in the public source cases, obfuscation is a red flag. If the code is public, why obfuscate it?

As obfuscation is such a red flag when looking for transparency, we do also sometimes inspect the binaries of closed source apps.

As looking for code obfuscation is a more involved task, we do not inspect many apps but if we see other red flags, we might test this to then put the product into this red-flag category.

The product cannot be independently verified. If the provider puts your funds at risk on purpose or by accident, you will probably not know about the issue before people start losing money. If the provider is more criminally inclined he might have collected all the backups of all the wallets, ready to be emptied at the press of a button. The product might have a formidable track record but out of distress or change in management turns out to be evil from some point on, with nobody outside ever knowing before it is too late.