Open-source core
The application as a whole is not open source. Its non-custodial core is: Smartable Wallet Core, under the Apache License 2.0, so anyone can read it, run its tests and challenge it. Each Android release names the core version it carries — 2.2.0 (22) carries Core 1.0.0.
Source and releases: gitlab.com/getsmartable-app/core.
What is inside
Section titled “What is inside”| Area | What it does |
|---|---|
| A typed secret becomes a key | Unicode NFC, then PBKDF2-HMAC-SHA256 at 600,000 rounds; Argon2id with 64 MiB per guess for split-backup shares. |
| The recovery phrase, sealed | Each phrase under a random key of its own; the password, the PIN and biometric unlock only wrap that key. |
| Encrypted or not stored | Platform key store only, no plaintext fallback; an unreadable secret is reported, never deleted. |
| A key the app can use and cannot read | Android Keystore (StrongBox, then the TEE) or the iOS Secure Enclave, and which one is reported. |
| The app PIN | Six digits through a key-store key, then sealed by a second device key. |
| Biometric unlock | A key released once per use; the phone’s passcode never opens the wallet. |
| One lockout | One counter for wrong guesses, timed on the boot clock. |
| Split backup | SLIP-39 Shamir backup, 2-of-3 or 3-of-5; shares kept on the phone and in cloud accounts are sealed under a key derived from the wallet password, and a paper share leaves only a note on the phone, never its words. |
How these protect you day to day: How your keys are protected.
What is not in it
Section titled “What is not in it”The app’s screens, its blockchain integrations, transaction review and signing, the backend and its routing and fees, deployment configuration and release records.
Principles
Section titled “Principles”- Keys stay with their owner. No server-side signing, no recovery authority held by anyone else, no key kept by a backend.
- Fail closed. A key store that refuses is an error the person sees, never a quiet fallback to somewhere weaker.
- Report, do not reassure. What the hardware actually provides is read and stated.
- The clock is not trusted. Lockouts run on time since boot.
- Every rule has a test. SLIP-39 is held to SatoshiLabs’ published vectors and Unicode normalisation to the Unicode Consortium’s.
How its releases are checked
Section titled “How its releases are checked”Version 1.0.0 was built on GitHub Actions: flutter analyze and the full test suite on Linux and macOS, OSV-Scanner against every pinned package, then the tag, version and changelog checked against each other before a source archive was made with its SHA-256 and a signed provenance attestation. GitHub Actions is not running for the repository at present, so later versions are checked locally — flutter analyze and the full test suite on macOS — and published on GitLab with their archive and SHA256SUMS, without an attestation. The project has an OpenSSF Best Practices badge at the passing level.
To check a release, download its archive and SHA256SUMS:
sha256sum -c SHA256SUMS1.0.0 also carries its attestation bundle, which can be checked without a GitHub account:
gh attestation verify smartable-wallet-core-v1.0.0.tar.gz \ --bundle smartable-wallet-core-v1.0.0.tar.gz.intoto.jsonl \ --repo getsmartable-app/coreThe attestation proves where a source archive came from. It does not prove that an app binary was built from this source; no reproducible build is claimed.
Trademarks
Section titled “Trademarks”The Apache-2.0 licence covers the code. It does not cover the Smartable and Smartable Wallet names, the logo, the domains or the application identifiers.