Raylac Wallet Code Review

The mobile applications do not require users to enter a password/PIN/Biometric when opening the application. Additionally, the Android application does not require authentication to access the private key.

A custom keyboard is a keyboard app developed by a third-party company or developer other than the device's manufacturer. These keyboards offer users the flexibility to enhance functionality and use different themes. The mobile applications do not disable custom keyboards when entering wallet mnemonics. Users can install custom keyboards that replace the system's default keyboard in any app. These custom keyboards can log and exfiltrate the data users enter.

The Android application is designed to create a cryptographic key from the Keystore. This key is intended for encrypting the wallet's mnemonic and private key to ensure secure storage within the application's shared preferences. However, the Keystore entries currently lack sufficient protection, as several security flags are not enabled: - `isTrustedUserPresenceRequired` - `isUserAuthenticationRequired` - `isUserAuthenticationRequirementEnforcedBySecureHardware` - `isUserConfirmationRequired` These flags are for ensuring that the keystore entries are protected against unauthorized access.

The application does not have a mechanism to prevent users from taking screenshots of the displayed wallet secrets, nor does it display a warning to remind users of the risks associated with taking screenshots. Obtaining the mnemonic or private key could potentially allow an attacker to gain full control of the wallet.

On mobile devices, a screenshot of the current activity is typically taken when an application moves to the background and displayed for aesthetic purposes when the app returns to the foreground. This feature can pose a security risk, as sensitive data may be exposed if the user backgrounds the application while sensitive information is displayed. Additionally, a malicious application running on the device and capable of continuously capturing the screen could also expose sensitive data.

Sensitive information leaking in memory happens when an application handles confidential data improperly, causing it to remain exposed in the system's memory. This can happen if an application or service fails to securely clear this sensitive information after use, or if the information is stored insecurely within memory. This could allow attackers to directly read the memory contents if they gain access to the device. The source code implements mechanisms to reset states such as the `clearState` function and `useEffect`, but they are not applied in all cases. For example: - packages/app/src/screens/ImportAccount/PrivateKeyAddressDetailsSheet.tsx:82 - packages/app/src/screens/SaveBackupPhrase/SaveBackupPhrase.tsx It is recommended to review the entire codebase.

The application stores the sensitive information with the SecureStore module from `expo-secure-store`. Specifically, it is used the `setItem` and `setItemAsync` functions which receive the parameter `requireAuthentication`. This option is responsible for enabling the usage of the user authentication methods available on the device while accessing data stored in SecureStore. - Android: Equivalent to setUserAuthenticationRequired(true) (requires API 23). - iOS: Equivalent to biometryCurrentSet. Complete functionality is unlocked only with a freshly generated key - this would not work in tandem with the keychainService value used for the others non-authenticated operations. The value of `requireAuthentication` is based on the result of `Device.isDevice` from the `expo-device` package. - `packages/app/src/lib/key.ts:14` ```javascript `const REQUIRE_AUTHENTICATION = Device.isDevice;` ``` Since this is a significant security option for protecting the private key and mnemonic of the wallet, it is recommended to always set it to `true`.