WalletScrutiny.com Verification Report for Version 3.1.0

[xrviv]

Reproducibility Verification Results for ShapeShift Android v3.1.0

Overview

Hello ShapeShift team! 👋

We're reaching out from the WalletScrutiny project, where we verify the reproducibility of cryptocurrency wallet applications. We recently attempted to reproduce your Android app (v3.1.0) and wanted to share our findings.

Verification Attempt

We attempted to build the app from source using:

• Repository: https://github.com/shapeshift/mobile-app
• Commit: 5836f656f240ce1494a2c9625365c18ae3d47bec
• Build environment: Docker with Node.js 18 and Android SDK
• APK comparison tools: apktool v2.7.0, diffoscope, and diff

Results

Unfortunately, we found significant differences between the Play Store APKs and our locally built versions:

1. Size discrepancies:

   • base.apk: Official=19,799,693 bytes, Built=8,660,696 bytes (56% smaller)
   • split_config.en.apk: Official=45,465 bytes, Built=34,803 bytes (23% smaller)

2. Content differences:

   • Missing dexopt directory in assets
   • Binary differences in index.android.bundle (core JavaScript code)
   • Differences in app icons and splash screen images
   • Binary differences in libexpo-modules-core.so native library
   • Differences in resources.arsc files

These differences go beyond the expected metadata and signing variations that normally occur during the Google Play publishing process.

Expo Build Process

We noticed in Issue 104 that you're now using Expo for builds. We'd love to understand more about your specific build process to help achieve reproducibility.

Why This Matters

Reproducible builds are crucial for security and trust in cryptocurrency applications. They allow users and third parties to verify that the app they download contains exactly the code that's publicly available, with no unexpected additions.

Thank you for your time and consideration!

Detailed Report

For a complete analysis including hash comparisons and specific differences, please see our full verification report.

[NeOMakinG]

Hey again @xrviv

We recently updated our project, kicked a lot of unneeded dependency to use Expo ones, and our build system completely changed, we are now using Expo EAS to build our app, our flow is kind of described in the readme but:

On merge on main, it triggers a build on the expo dashboard, I'm kind of sure you can follow https://docs.expo.dev/guides/local-app-production/ to build locally (maybe you already did this to notice the changes)

That said, the actual version of the repo is the 3.2.0 which isn't published yet on stores (we are currently testing those internally before publishing them in production)

If you need more informations, don't hesitate!