Matomo

Xaman wallet security assurance and improvements | Cossack Labs
Case studies
Xaman wallet security assurance and improvements

Xaman wallet security assurance and improvements

SEP - OCT 2021 | JAN - APR 2023 Finance Digital wallet
Xaman wallet security assurance and improvements

Xaman wallet audit results

The executive summary of the Xaman (formerly Xumm) security assessment is available here.

See Xaman public report

Overview

XRPL Labs asked Cossack Labs' team to conduct a security audit of the Xaman mobile wallet in August 2021. Back in 2021, it was known as Xumm. The objective of the security assessment was to strengthen the cryptographic security aspects of Xaman and the surrounding ecosystem, focusing on the protection of the private keys within the self-custodial wallet itself and the integrity of transactions it authorises.

Xaman is a self-custodial mobile cryptocurrency wallet for the XRPL blockchain. It allows users to manage their issued tokens, send/request payments and to interact with XRP Ledger (XRPL) via xApps. Xaman offers hardware wallets, known as Xaman cards, which perform cryptographic operations on the card's isolated chipset. Since 2022, Xaman has the "pro" subscription which offers additional features such as push notifications, user profiles, and on/off-ramp capabilities (exchanging XRP tokens to Euros) for users in the Netherlands and the UK.

Industry

  • FSA / Fintech
  • DeFi
  • Cryptocurrency

Technology stack

  • React Native (iOS, Android)

Regulations

  • Typical fintech security requirements
  • Encryption Export Regulations

Challenges

[01]

Encrypting user data and private keys

Ensure that the protection of sensitive information such as secret numbers, mnemonics, and private keys is addressing all possible risks. Merely storing data in the Keychain or Keystore is insufficient. To enhance security, keys should be encrypted using hardware-backed encryption (Secure Enclave/Hardware-backed Keystore) and tied to biometric authentication.

[02]

Protecting against large-scale exploits

To mitigate the risk of widespread exploits and financial fraud, a number of factors need to be taken into account, such as implementing proper session management, securely handling transactions, and incorporating measures to prevent network attacks (replay, MitM, TLS strip, etc).

[03]

Educating the user to make better choices

In a self-custodial wallet, the weakest link is often the user. By understanding how to protect their secrets, enabling biometric authentication, and identifying phishing attempts, users can make informed decisions that reduce the likelihood of losing their funds.

Technology requirements

Technology requirements

Prevent transaction fraud

The main goal of the Xaman application is to safely interact with the XRP Ledger. It is crucial to use transport encryption to secure communication with the blockchain network and mitigate replay attacks, ensuring that only authenticated users have access and reducing the possibility of transaction fraud.

React Native application security

Security of the Xaman application encompasses three platforms: React Native core, iOS, Android, and their respective backend components. Each platform has specific requirements, features, and vulnerabilities that need to be addressed.

Security that supports UX

The security measures implemented in Xaman should also consider user experience (UX). As Xaman is designed for end users, the security controls should balance usability and security. It is essential to create a secure environment without making the application overly complicated for the users.

Our approach

Bespoke and innovative security solutions

Our primary focus is on providing customised solutions that cater to the risks and requirements of specific wallet applications. This is achieved by leveraging our expertise in cryptography and security engineering, along with an understanding of the challenges faced within the cryptocurrency ecosystem.

Knowledge of cryptography, hardware and mobile wallets combined

By combining our skills in cryptography with a deep understanding of hardware wallets and mobile operating systems, we identify any potential cryptographic weaknesses that could be exploited. We then offer recommendations for improving the cryptographic code to ensure optimal security while maintaining a seamless user experience.

Proactive security controls

We recognize that applications are constantly evolving things. As part of our approach, we proactively suggest security enhancements that anticipate and prevent potential vulnerabilities as the application continues to evolve.
Our approach

Solution

1. Determining the security assessment scope

We performed risk and threat modelling and formulated the most high-risk threats: critical exploits, secure storage of private keys, and potential transaction fraud.
Given the self-custodial nature of Xaman, the OWASP MASVS v1.5 served as the security baseline. We excluded certain requirements (such as the V8 Resilience Requirements), which were out of scope. At the same time, we added relevant requirements from the OWASP ASVS v4.0.2 (such as security HTTP headers during network communication). As a result, the assessment had a baseline of 65 security requirements.
Splitting the assessment into sections: design issues, cryptographic layer, application security, platform security, code quality, infrastructure, supply chain issues.

2. Triaging discovered issues

We found no critical issues, some high-priority bugs and risky design decisions, and recommended several improvements.
Security issues were categorised as broken, missing, or in need of enhancements. We evaluated their impact as high, medium, or low. This classification enabled the development team to prioritise security issues effectively and understand the consequences of accepting risks.

3. Highlighting application security and platform trust issues

Mobile applications should incorporate numerous small security controls:
  • blurring the application screen to hide sensitive data when app is in the background;
  • restricting access for 3rd party keyboards;
  • configuring web views and deep links properly;
  • cleaning up sensitive data in case of suspicious user activity.
Xaman uses two types of local storage: secret storage in a Keychain/Keystore and an encrypted database for the user data (profile, accounts, settings, etc.). We assessed the storage structure and encryption logic and recommended binding encryption to the specific application installation to prevent data stealing.

4. Migrating to modern state of the art cryptography

We raised concerns regarding cryptographic procedures, highlighting issues with implementation and questionable design choices. Although these concerns may not have resulted in immediate vulnerabilities, their accumulation is a ticking time bomb.
Following the assessment feedback, the XRPL Labs team, together with Cossack Labs team, re-designed and re-implemented the entire cryptographic layer, responsible for application-level encryption and sensitive data storage, introducing the "v2" encryption scheme.
This substantial update to the encryption layer effectively fixed 82% of the weaknesses identified in the original cryptography section.

5. Nurturing xApps community

xApps are web applications, built to facilitate interaction with the decentralized XRP Ledger. xApps enhance functionality of the wallet, and allow users to interact with specific ledger features in a more user friendly way. Many xApps improve the user experience, but can potentially open security risks.
To ensure a trustworthy xApps community we recommended implementing additional measures: periodically inspecting xApps, educating users about potential threats, explaining which xApp behaviours could be suspicious, allowing users to flag xApps they don't trust, and so on.

6. Improving security posture and processes

With the primary objectives of enhancing Xaman app security in mind, our recommendations were centred around establishing robust defences for future application development.
Implementing such protections could significantly “raise the bar” for attackers and reduce the likelihood of incidents beyond the direct control of application developers.
For instance, secure development operations can be improved by configuring linters and source code analysers, implementing the dependency management process, and thoroughly enumerating and comparing application permissions.
The development team created a security roadmap to further improve the security of the Xaman app.
Xaman satisfied 43% of security requirements after the assessment, and 89% after verification of fixes.
Xaman satisfied 43% of security requirements after the assessment, and 89% after verification of fixes.

Results and outcomes

We would like to emphasise the security-focused engineering efforts undertaken by the XRPL Labs team. Although the Xaman (formerly Xumm) application already had pragmatic security controls, its overall security posture experienced significant enhancement after implementation of post-assessment recommendations.

The Xaman team has resolved all "high" flaws and bugs. Moreover, they implemented "medium" and "low" improvements to establish a defense-in-depth approach, laying a strong foundation for future application development and mitigation of potential threats.

As a result of these fixes, we observe significant improvements in handling application security corner cases, managing third-party dependencies and applying platform-specific security controls and settings.

The security posture of the Xaman application has significantly improved. Following the audit, it fulfilled 43% of the security requirements based on the OWASP MASVS v1.5. After fixing the discovered issues, the security score increased to 89%.

This security assessment served as the foundation for long-term product security engagement, which is beyond the scope of this case study.

Up next

Got a challenge that's still standing?

Let’s start a conversation.

Start a conversation

Get whitepaper

Application form

Our team will review your resume and provide feedback
within 5 business days

Thank you!

We’ve received your request and will respond soon.

Your resume has been sent!

Our team will review your resume and provide feedback
within 5 business days