Raylac Wallet Code Review

CertiKCode version: not recorded (see the report)

CertiK reviewed Raylac (Raylac Wallet Code Review) on 31 Jan 2025: 9 findings, 0 critical; 7 marked fixed, 2 open.

No open critical findings
Open the reportOpen Raylac’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium001
Low206
LowCode Quality improvementsOpen

During the code review, it was identified the following areas for improvement in code quality. These are some examples: 1. Use of multiple libraries with overlapping functionalities. The code uses the `bip39` and `viem` libraries for generating and managing wallets. 2. Multiple calls to the `sleep` function. Excessive use of sleep functions can cause unnecessary delays, impact performance, and introduce race conditions. - `packages/app/src/hooks/useCreateAccount.ts:37` 3. Redundant conditions. Logical redundancies, such as checking an already boolean variable, can lead to unnecessary processing and reduced code readability. - `packages/app/src/hooks/useImportMnemonic.ts:50`. The `imported` variable is already a boolean. 4. Improper error handling. Inconsistent or missing error handling can lead to unhandled exceptions, unexpected crashes, and potential security risks. - `packages/app/src/hooks/useImportMnemonic.ts:42`

LowMnemonic and Private Key are copied to clipboardOpen

The application allows the mnemonic phrase and private key to be copied to the clipboard. The clipboard is a shared system resource that can be accessed by other applications running on the device. This means that any malicious application or malware with clipboard access can potentially read and extract the sensitive data, leading to unauthorized access to the user's wallet. The feature is implemented in the `packages/app/src/lib/utils.ts` file and called from these files: - `packages/app/src/components/AddressDetailsSheet/PrivateKeyAddressDetailsSheet.tsx` - `packages/app/src/components/ShowMnemonicSheet/ShowMnemonicSheet.tsx` - `packages/app/src/screens/SaveBackupPhrase/SaveBackupPhrase.tsx` There are more files out of scope that call the `copyToClipboard` function.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Raylac’s security record

Raylac
Audits1 audit by 1 firmLast audit Jan 2025, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open Raylac’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us