Satoshi's Closet security record
As of 3 Nov 2026, Satoshi's Closet has 1 audit report on Trustblock, by CertiK, dated 21 Nov 2022. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Satoshiscloset Wallet | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
Findings10
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 5 | 0 | 5 |
LowApplication uses v1 signature scheme (Janus AttacSatoshiscloset Wallet · CertiK · 21 Nov 2022Fixed
The application is signed with v1 signature scheme, making it vulnerable to Janus vulnerability on Android <7.0 The Janus vulnerability stems from the possibility to add extra bytes to APK files and to DEX files. On the one hand, an APK file is a zip archive, which can contain arbitrary bytes at the start, before its zip entries (actually more generally, between its zip entries). The JAR signature scheme only takes into account the zip entries. It ignores any extra bytes when computing or verifying the application’s signature. On the other hand, a DEX file can contain arbitrary bytes at the end, after the regular sections of strings, classes, method definitions, etc. A file can, therefore, be a valid APK file and a valid DEX file at the same time. References: - https://www.xda-developers.com/janus-vulnerability-android-apps/ - https://medium.com/mobis3c/exploiting-apps-vulnerable-to-janus-cve-2017-13156-8d52c983b4e0
Open the reportLowCustom Keyboards Allowed for Sensitive InputsSatoshiscloset Wallet · CertiK · 21 Nov 2022Fixed
The WLT mobile application does not disable custom keyboards when entering wallet mnemonics. Since a long time ago, users have been able to install custom keyboards that can be used in any app, replacing the system's default keyboard. Custom keyboards can, and very frequently do, log and exfiltrate the data users enter. The following screenshot shows the input of the mnemonic using the third party keyboard SwiftKey. 
Open the reportLowMnemonic Display Allow ScreenshotsSatoshiscloset Wallet · CertiK · 21 Nov 2022Fixed
The mnemonic phrase is a list of words that can be used to recover a wallet account. The application does not have a mechanism in place to stop a user from taking a screenshot of the displayed wallet secrets. This finding has been rated as low risk because the applications displays a warning to remind the user of the risk of taking a screenshot. 
Open the reportLowNo Root or Jailbreak DetectionSatoshiscloset Wallet · CertiK · 21 Nov 2022Fixed
No root or jailbreak detection is implemented in the application.
Open the reportLowScreenshot BackgroundingSatoshiscloset Wallet · CertiK · 21 Nov 2022Fixed
On mobile devices, a screenshot of the current activity is taken when an application goes into the background and displayed for aesthetic purposes when the app returns to the foreground. This feature may pose a security risk. Sensitive data may be exposed if the user background the application while sensitive data is displayed. A malicious application that is running on the device and able to continuously capture the screen may also expose data. 
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="satoshis-closet"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us