Developers
Open source
The parts that touch your keys are readable by anyone, because a wallet you cannot inspect is a wallet you are trusting on faith.
01What we publish
| Component | Licence | Contains |
|---|---|---|
| xendra/core | Apache-2.0 | Derivation, signing, sharding, decoding for all seven chains |
| xendra/wallet | GPL-3.0 | The mobile and desktop applications |
| xendra/extension | GPL-3.0 | Browser extension and connector |
| @xendra/sdk | Apache-2.0 | Integration SDK for dapps |
| xendra/build | MIT | Reproducible build container and release tooling |
The brand assets are not covered by these licences. See the brand rules.
02Notable dependencies
- libsecp256k1 — MIT. Bitcoin, Litecoin, EVM and Tron signing.
- ed25519-dalek — BSD-3-Clause. Solana, TON and Aptos signing.
- SQLCipher — BSD-style. Encrypted local database.
- ring — ISC and OpenSSL. AEAD and hashing primitives.
- DM Sans and IBM Plex Mono — SIL Open Font License 1.1.
The complete dependency tree, with versions and hashes, ships inside the app under Settings › About › Licences and in THIRD-PARTY.md in each repository.
03Contributing
Pull requests are welcome. Anything touching derivation, signing or sharding needs two reviewers and a test that fails without the change. We ask contributors to sign a developer certificate of origin, not a copyright assignment; your work stays yours.
Security issues do not go in a pull request. Send them to the bounty programme first so a fix can ship before the details are public.