Trust
Security
Custody is a sentence, not a checkbox. Here is the whole sentence: keys are generated in hardware, never leave the device, and every release you install can be rebuilt from source by anyone.
01The threat model we design against
A wallet is only meaningfully secure against something specific. We design against four attackers, in this order.
Attacker 01
The malicious dapp
A site that asks for a signature that does something other than what it says. Countered by decoding and simulating every payload before confirm unlocks.
Attacker 02
The thief with your phone
Physical access without your biometrics or PIN. Countered by enclave-backed keys, rate-limited unlock and full-database encryption.
Attacker 03
Us
A malicious or coerced release from Xendra itself. Countered by reproducible builds, published hashes and an open signing path.
Attacker 04
The network
A hostile RPC endpoint feeding false balances or fees. Countered by cross-checks, and by letting you use your own node.
02Where keys live
On first run, entropy is drawn from the platform CSPRNG and mixed with hardware randomness where the device exposes it. From that seed the app derives a BIP-39 phrase and, from it, seven keyspaces: secp256k1 for Bitcoin, Litecoin and every EVM chain; ed25519 for Solana, TON and Aptos; and Tron on its own path.
The seed is sealed by a key that lives in the Secure Enclave on iOS, StrongBox or the TEE on Android, and the platform keychain with a hardware token where available on desktop. That sealing key cannot be exported. Signing requests move into the enclave and only signatures come back out.
| Layer | Mechanism | Notes |
|---|---|---|
| Seed at rest | AES-256-GCM, key sealed in hardware | Unwrapped only for the duration of one signature |
| Unlock | Biometrics or PIN, 6 attempts | Exponential backoff, optional wipe after 10 failures |
| Database | SQLCipher, per-install key | Balances, labels and contacts are encrypted too |
| Memory | Locked pages, zeroed after use | Secrets are never placed in a garbage-collected string |
| Screens | Screenshot and recording blocked | Applies to phrase, shard and signing views |
03What happens before confirm unlocks
Most losses are not broken cryptography. They are a person pressing confirm on something they could not read. So the confirmation screen is the product.
- Decode. EVM calldata is resolved against a verified ABI, Solana instructions against known programs, Aptos payloads against Move resource types. Unknown selectors are labelled unknown rather than guessed.
- Simulate. The transaction is run against current state on an isolated node. The screen shows the balance changes that would actually result, per asset and per account.
- Compare. The simulated outcome is checked against what the site claimed. A mismatch turns the sheet red and requires a second deliberate tap.
- Screen. Recipients are checked against sanctions data, known drainer contracts, dusting patterns and addresses that mimic yours in the first and last four characters.
- Bound. Unlimited token allowances are rewritten to the exact amount needed, unless you explicitly override.
Worst-case first
Quotes show the minimum you receive, not the optimistic figure. If a route can only guarantee a worse number, that worse number is the one printed in bold.
04Recovery you can reason about
There are three supported ways back into a wallet, and you may combine them.
- The phrase. Twelve or twenty-four words, optionally with a BIP-39 passphrase that creates a separate hidden wallet.
- Xendra Keys shards. A 2-of-3 Shamir split of the seed. Give one shard to a trusted person, keep one at home, keep one in a safe. Any two reconstruct the wallet; any one alone reveals nothing.
- A hardware signer. The seed never exists on the phone at all. See hardware signers.
There is no account-recovery flow, no support override and no admin key, because each of those would be a way for someone else to take your funds.
05Releases you can verify
Every release is built in public CI from a tagged commit, and the build is deterministic: the same source produces the same binary bit for bit. We publish the SHA-256 of each artefact and a detached signature; a community mirror rebuilds independently and publishes its own hashes.
$ shasum -a 256 Xendra-4.8.2.apk
9f2c0b5e4a71d8c3f6ab54e0c9d217b8ee43f1a0d6c58b7291f4e0a3c5d18b6f
$ gpg --verify Xendra-4.8.2.apk.asc
Good signature from "Xendra Release Signing <release@xendra.xyz>"If the hashes differ
Do not install the build. Tell us at contact@xendra.xyz and post the hash you got publicly. A mismatch is either a broken mirror or a compromised release, and both need daylight immediately.
06Infrastructure and process
- Two-person review on every commit, and a separate signer for every release tag.
- Release keys held on hardware tokens, split across jurisdictions, rotated annually.
- Dependencies pinned by hash, updated on a schedule, scanned continuously for advisories.
- No third-party analytics, ad SDKs or dynamic code loading in any shipped build.
- Staff access to production requires hardware keys and is logged and reviewed monthly.
- Annual restore drills, and a public post-mortem for any incident that touches user funds.
07What we cannot protect you from
An honest security page has this section.
- A recovery phrase you typed into a website, a chat, or a phone call.
- A device already compromised at the operating-system level.
- Coercion. If someone is standing over you, software will not save you. A passphrase-protected hidden wallet is a partial answer.
- A smart contract that is legitimate today and rugged tomorrow.
- A blockchain that forks, halts or reorganises.
- You, sending to the right-looking wrong address. We check the first and last four characters and warn on lookalikes, but the last confirmation is yours.
08Reporting something
Send anything security-relevant to contact@xendra.xyz, encrypted to the PGP key published on the bounty page. We acknowledge within 24 hours, triage within 72, and pay up to €150,000 for a key-extraction or remote-signing bug.
We do not sue researchers acting in good faith within the published scope, and we do not ask for silence beyond the disclosure window.
Start holding your own keys.
iOS, Android, desktop and a browser extension — the same vault on all of them. Free, and it stays free.