XRPL.to
dApp audits

D'CENT Wallet

by IoTrust Co., Ltd. · Android 9.2.1 · measured 2026-09-16

Signs any hash after a PIN
Social backup: the vendor can recover the seed

The App Wallet's screen is a website, and its signer approves whatever hash that website sends it once a PIN is entered. Hardware users with a screen are insulated; a hardware recovery phrase imported into the App Wallet is not. The opt-in social backup sends the recovery phrase to Wepin, the vendor's own service, which holds the key that opens it.

Rating and build

Rating

62/ 100Moderate
  • Custody15/20
  • Vault & key storage15/20
  • Seed handling & signing10/15
  • Isolation7/15
  • Transport & network8/15
  • Code integrity5/8
  • Privacy2/7

The build that was read

Version
Android 9.2.1 (versionCode 1638, com.kr.iotrust.dcent.wallet)
Current
Google Play listed 10.0.0 (updated 27 Aug 2026) at the time of writing; that build is not covered by this audit
Verified
Google Play build; v3 signature and Play source-stamp verified
Measured
2026-09-16
Chains
Multi-chain, including the XRP Ledger and Xahau
Custody
Self-custody by default, with a hardware option. The opt-in Wepin social mode uploads the whole recovery phrase to Wepin, a service IoTrust itself operates, encrypted to a key held on that side: the vendor can recover the seed.
Signing
The App Wallet screen is a remote web page. Its software signer approves any hash it is sent after a PIN, with no native display of the transaction.

Rating history

3
DateRatingRubricWhat it rested on
2026-09-0874 / 100Goodv1, six dimensions
First static pass. It credited an origin-allowlisted dApp browser, scored a four-digit PIN floor, and read the cleartext endpoints as a mainnet node; all three readings were later corrected.
Custody 18/20 · Vault & KDF 19/25 · Seed 15/15 · Transport & hardening 10/20 · Integrity 9/10 · Privacy 3/10
2026-09-0871 / 100Moderate-3v2, Isolation added
Same findings, new rubric: an explicit Isolation dimension (how well the seed and signing are walled off from hostile code), funded by trimming Vault, Transport, Integrity and Privacy.
Custody 16/20 · Vault 16/20 · Seed 13/15 · Isolation 11/15 · Transport 6/15 · Integrity 7/8 · Privacy 2/7
2026-09-1662 / 100Moderate-9v2
Full re-verification from the code path that runs: a remote wallet page bridged to a blind hash signer with no origin check (Seed 13→10, Isolation 11→7); the dApp browser exposes the same signer and the engine is remote and unsigned (Integrity 7→5); no user-secret key derivation on the vault (Vault 16→15); the social mode lets the vendor recover the seed (Custody 16→15). Transport rose 6→8: cleartext confined to a test network, the developer trust path scoped.
Custody 15/20 · Vault 15/20 · Seed 10/15 · Isolation 7/15 · Transport 8/15 · Integrity 5/8 · Privacy 2/7

An interim estimate near 69 on 16 September was superseded within hours by the full re-verification and was never recorded as the rating.

Findings

14

3 high, 4 medium, 5 low, plus what holds up.

  1. High
    The software signer has no display of its own
    The signing command takes an opaque hash. The only prompt is a PIN keypad that is given no destination, amount or token, so a PIN proves a person was present, not what they agreed to.
  2. High
    The bridge checks no origin
    Messages from the wallet page are parsed and dispatched to five targets, the software signer among them, with no check on where the page came from and no allow-list.
  3. High
    The in-app dApp browser opens the same signer to any site
    A wildcard origin allow-list, mixed content allowed, a URL safety check that returns true for any non-empty string, and the bridge switched on for every page it loads. Talking a person into opening a link there is enough to ask the signer for a signature; nothing has to be broken into.
  4. Medium
    Social backup sends the recovery phrase to the vendor's own Wepin service
    The whole phrase is encrypted under a fresh key that is itself wrapped to a public key fetched from Wepin, then uploaded; the PIN is hashed and uploaded under the same key, not used to lock the phrase. The app never holds the private half and contains no key-splitting logic, so whoever holds that key can recover the seed. Wepin's terms name its operator as IoTrust Co., Ltd., the company behind D'CENT. Opt-in and disclosed.
  5. Medium
    The provider engine is fetched at run time and never verified
    Injected into every dApp page from assets.dcentwallet.com, downloaded as plain text with no signature or hash check; the list of extra scripts to load comes from the same host.
  6. Medium
    The bridge also reaches device commands
    Through the native target a bridged page can read the clipboard, open the camera QR scanner, start speech recognition through the microphone, and read or change app settings.
  7. Medium
    No certificate pinning
    The wallet page and the engine are trusted on the phone’s certificate store alone; anyone who can present a certificate the device accepts can sit in the middle.
  8. Low
    Cleartext HTTP is enabled for the whole app
    usesCleartextTraffic is on with no network-security configuration. The shipped plain-HTTP endpoints belong to a test network; a hand-added custom node could be http:// too.
  9. Low
    A developer certificate-trust path ships in production
    A patched WebView client can accept an untrusted certificate, scoped to developer mode plus a toggle, a developer root fetched from D’CENT, and the dev server or private addresses.
  10. Low
    The inner seed layer is keyed to an install id with a zero IV
    Its key derives from an id the app generates and stores itself, not a user secret; the PIN only gates the prompt. The real protection is the Keystore wrapping around it.
  11. Low
    The main WebView allows file access and universal access from file URLs
    Settings a wallet WebView normally disables. Not exercised by this analysis; a hardening gap, not a demonstrated vector.
  12. Low
    Three analytics kits and the advertising permissions
    AppsFlyer, Firebase Analytics and Amplitude, with Sentry and Pushwoosh; the advertising id and all AdServices permissions; the microphone permission is live.
  13. Note
    Development settings shipped to users
    The production wallet-create call is labelled dcent-wallet-test, and the build carries dev, beta and live provider keys and a localhost wallet address gated behind developer mode.
  14. Holds up
    What holds up
    The default-mode seed is Keystore-wrapped and never leaves the phone; Android backup is off; the PIN is six digits with lockouts; cloud backup uses argon2id then AES-256-GCM; screenshots are blocked; the hardware wallet signs on its own screen.
Read the full audit Every claim in it is reproducible from the same public build.

This rating is re-scored when the vendor fixes what the audit found, and the change is recorded above. Anything wrong here gets corrected: hello@xrpl.to or @xrplto.