Analytic Study On Android-Based
Analytic Study On Android-Based
Burkhard Stiller
ifi
University of Zurich
Department of Informatics (IFI)
Binzmuhlestrasse 14, CH-8050 Zurich, Switzerland
Master Basic Module
Communication Systems Group (CSG)
Department of Informatics (IFI)
University of Zurich
Binzmuhlestrasse 14, CH-8050 Zurich, Switzerland
URL: [Link]
Abstract
i
Acknowledgments
I would like to express special thanks to my supervisors Sina Rafati and Prof. Dr.
Burkhard Stiller, the head of the Communication Systems Group at the University of
Zurich, for making this report possible.
ii
Contents
Abstract i
Acknowledgments ii
Contents iii
1 Introduction 1
3.2 SpaceMint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
iii
iv CONTENTS
4 Future Work 31
4.1 QuarkChain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Bibliography 33
List of Figures 35
Chapter 1
Introduction
A cryptocurrency wallet is a software program that stores private and public keys and
interacts with various blockchain to enable users to send and receive digital currency and
monitor their balance. A wallet can contain multiple public and private key pairs. If you
want to use Bitcoin or any other cryptocurrency, you will need to have a digital wallet.
Every piece of cryptocurrency has a private key. With the private key, it is possible to
write in the public ledger, effectively spending the associated cryptocurrency[6]. As of
January 2018, there are over thirteen hundred cryptocurrencies; the first and best known
is bitcoin[7].
When choosing a wallet, the owner must keep in mind who is supposed to have access to
(a copy of) the private keys and thus has potentially access to the cryptocurrency. Just
like with a bank, the user needs to trust the provider to keep the cryptocurrency safe.
Trust was misplaced in the case of the Mt. Gox exchange, who ’lost’ most of their clients’
bitcoins. Downloading a cryptocurrency wallet from a wallet provider to a computer or
phone does not automatically mean that the owner is the only one who has a copy of
the private keys. For example, with Coinbase[8], it is possible to install a wallet on a
phone and to also have access to the same wallet through their website. The software can
also have known or unknown vulnerabilities[9]. For receiving cryptocurrency, access to
the receiving wallet is not needed. The sending party only needs to know the destination
address. Anyone can send cryptocurrency to an address. Only the one who has the private
key of the corresponding address can use it[10].
It’s advisable to keep just small amounts of currency for everyday use online, on your
computer or mobile. The majority of your crypto-coins should be stored in a highly
secure environment. Choose a cold or offline storage options or an USB for backup. This
ensures that your wallet can be recovered even if your computer fails or is lost or stolen.
It is important to have a backup for security reasons, no matter what wallet you are using,
to avoid the loss of digital assets. There are many examples, people lose their wallets but
if they don’t have backup they lose the digital funds. A backup of a wallet can come in
different forms like:
• A (encrypted) file like [Link] or [Link] which contains all the private keys.
1
2 CHAPTER 1. INTRODUCTION
• A mnemonic sentence from which the root key can be generated, from which all
the private keys can be recreated. Preferably these words could be remembered or
written down and stored on other physical locations.
When the private keys and the backup are lost then that cryptocurrency is lost forever.
When using a webwallet, the private keys are managed by the provider. When owning
cryptocurrency, those trusted with managing the private keys should be carefully selected.
An (encrypted) copy of the wallet should be kept in a trusted place. Preferably off-
line. Some people ’write’ their mnemonic sentence or private key on metal, because it is
robust[11].
1. Do you need a wallet for everyday purchases or just buying and holding digital
currency?
3. Do you require access to your digital wallet from anywhere or only from home?
There is a need to ponder over these questions, make a list of requirements and then
choose a most suitable wallet. The type of wallet you should use really depends on your
level of activity and level of security with which you want to handle your cryptocurrency.
It also depends on how frequently you use your funds and how much you want to store
on any particular wallet.
There are difference types of cryptocurrency wallets available in the market to manage
the digital assets[12].
Desktop: wallets are downloaded and installed on a PC or laptop. They are only acces-
sible from the single computer in which they are downloaded. You can easily download
it, and it offers pretty good security; however, the downfall is you could only use it on
your desktop. If the PC gets a victim of virus, hacker may easily access your private and
public keys.
1.1. TYPES OF CRYPTOCURRENCY WALLETS: 3
Mobile Wallets: wallets run on an app on your phone and are useful because they
can be used anywhere including retail stores. Mobile wallets are usually much smaller
and simpler than desktop. They can be used anywhere around the world, some of them
are quite secure, some of them have multi signature access, a lot of them have backup
features. You never keep cryptocurrency on your phone, what you have is actually the
keys, a mnemonic stores your private key and that key unlock your phone to see your
digital assets.
Hardware/Cold Storage Wallets: These wallets differ from the software wallets in
that they store a user’s private key on a hardware device like a USB. Although hardware
wallets make transactions online, they are stored offline which delivers increased security.
It offers security and you can access it like your physical wallet.
Paper: wallets are easy to use and provide a very high level of security. While the term
paper wallet can simply refer to a physical copy or printout to your public and private
keys, it can also refer to a piece of software that it used to securely generate a pair of keys
which are then printed.
Hot vs. cold wallets: Hot wallets are connected to the internet while cold wallets are
not. With a hot wallet cryptocurrency can be spent at any time. A cold wallet has to be
’connected’ to the internet first. As long as something is connected to the internet, it is
vulnerable to an attack. The short version is that software wallets (where the device is
turned on or the wallet software is running) are considered hot wallets. A (not connected)
hardware wallet is considered a cold wallet.
Deep Cold Storage: is the process of storing cryptocurrencies in cold wallets that were
never connected to the Internet or any kind of network. Additionally, the private keys
associated with this system are generated offline.
Deterministic wallet: with a deterministic wallet a single key can be used to generate
an entire tree of key pairs. This single key serves as the ”root” of the tree. The generated
mnemonic sentence or word seed is simply a more human-readable way of expressing the
key used as the root, as it can be algorithmically converted into the root private key. That
single root key is not replacing all other private keys, but rather is being used to generate
them. All the addresses still have different private keys, but they can all be restored by
that single root key. A mnemonic sentence is considered secure. It creates a 512-bit seed
from any given mnemonic.
4 CHAPTER 1. INTRODUCTION
The main focus of this study is to compare and analyze android based cryptocurrency
wallets in order to propose a set of requirements for a new wallet based Proof of Space.
Following cryptocurrency wallets will be analyzed for studying the theoretical and prac-
tical aspects in order to propose new requirements:
1. Ethereum Wallet
2. CoinBlesk
3. Bazo BC
4. Other popular android based-wallets
Ethereum is a decentralized platform that runs smart contracts, applications run exactly
as programmed without any possibility of downtime, censorship, fraud or third-party
interference. These apps run on a custom built blockchain, an enormously powerful shared
global infrastructure that can move value around and represent the ownership of property.
This enables developers to create markets, store registries of debts or promises, move funds
in accordance with instructions given long in the past (like a will or a futures contract)
and many other things that have not been invented yet, all without a middleman or
counterparty risk. The Ethereum Wallet is a gateway to decentralized applications on
the Ethereum blockchain. It allows you to hold and secure ether and other crypto-assets
built on Ethereum, as well as write, deploy and use smart contracts[13].
Ethereum team recommends using official clients, like Mist or Geth. They both are
desktop wallets.
• Mist Ethereum Wallet: GUI, Official, Full Node, App, Supports ETH, Generic
Token Interface, Generic Contract Interface
5
6 CHAPTER 2. ANDROID BASED WALLETS
• There is another secure wallet, called Parity (Rust implementation - GUI + CLI). It
is developed using the sophisticated and cutting-edge Rust programming language.
The official Ethereum Wallet, sometimes also called the Ethereum Mist Wallet, is a feature
that is built into the Ethereum platform. Designed by the team behind Ethereum, the
Wallet is integrated into the Mist web browser. This browser is an application that,
while still under development, can be used to connect to the main Ethereum network
and interact with other Ethereum applications. The Ethereum Wallet is free to download
and use, although it will cost you some time and space on your hard drive to download
the blockchain. You will most likely need to pay transaction fees in order to send ether
over the network, although there is a built in flexibility feature to give you some control
over fees in relation to transaction priority. You will have to understand and agree with
the security and legal warnings before using the official Mist Ethereum desktop wallet as
shown in the following figure.
Ethereum is a young project, and many elements of the Ethereum platform are still under
development. A lot of the existing infrastructure that enables users to interact with
Ethereum is designed primarily for developers and those with a fairly advanced technical
skillset. Fortunately, however, the official Ethereum Wallet does come with a simple
graphical user interface (GUI) and it’s not too difficult to get it up and running.
2.1. ETHEREUM WALLET 7
Pros Cons
Easy to purchase ether with US dollars or Documentation is not easily accessible,
bitcoin, or directly through the it’s not easy to understand how it works.
application.
Because the developers behind Ethereum Sometime slow or freezing when contracts
created this wallet, it’s widely considered have a high update rate. (The DAO
to be one of the most secure wallets for during first weeks is a good example)
storing ether.
Holds ether and other digital assets To install the wallet, users need to
issued on the Ethereum platform. download the entire Ethereum
blockchain, which can take a long time
and requires significant storage space.
Complete control over your passwords, Non-mobile computer only (Windows,
private keys and funds without relying on Linux, Mac). Only available as a desktop
any third-party software. client.
However, regardless of the tool you use to create an account/wallet; you should always
safely store all of the necessary information in multiple places. Multiple places mean
multiple physical locations. If your house burns down, that computer and piece of paper
are both gone. For example: on your computer, on a USB at your house and a safety
deposit box, and written on a piece of paper at your office[14].
8 CHAPTER 2. ANDROID BASED WALLETS
As the main focus is Android-based Ethereum wallet. The following primary features will
be considered to study the popular Android Wallets:
We will look into the features of following popular android based cryptocurrency wallets.
• Enjin Wallet
• Coinbase
• [Link]
The Enjin Smart Wallet is claimed to be a world’s most secure cryptocurrency wallet
available for Android — supporting BTC, ETH, LTC, ENJ and all ERC-20 tokens by
default. It features a Smart UI that evolves on the fly to suit your specific needs, and
employs innovative security measures to turn your smart phone into a hardware-like secure
wallet. The Enjin Wallet never holds or has any access to your funds—you remain in total
control of your private keys. You can always restore your wallet or funds on any device
with your recovery 12 word passphrase[15].
2.2. ENJIN WALLET 9
Security Innovations
• Enjin Secure Keyboard: Designed to prevent any form of data sniffing or keyloggers,
featuring an option to randomize keys for the ultimate level of input protection.
• Rule of Two Encryption: Two independent layers of cryptography protect the key-
store and confidential data. Hardware 256 AES encryption is employed on the lower
level and software encryption is utilised at the application layer.
• Memory encryption: Data is held in encrypted memory and any important values
are deleted from system memory.
• Screenshot & video blocking: Secure window layout at the OS level stops any screen
recording attempts.
• Smart UI: Seamless and blazing-fast user interface evolves on the fly to suit your
specific needs.
• A wallet for any coin you own: Supports Bitcoin (BTC), Ethereum (ETH), Litecoin
(LTC), Enjin Coin (ENJ) and all ERC-20 tokens. Other Altcoins will be supported
soon.
• Detailed transaction info: View all the important details for all your transactions
instantly.
• Custom fees and limits: Transaction fees are calculated dynamically, for optimal
sending. Alternatively, you can set your own custom fees and limits.
10 CHAPTER 2. ANDROID BASED WALLETS
Additional Features
• Multi-Currency values
• QR Scanner
Trust Wallet is a secure mobile Ethereum wallet that supports Ethereum and ERC20,
ERC223 tokens. It provides a fully security audited system to send, receive and store
digital assets. With Trust Wallet you have complete control over your private keys that are
only stored on your device. Trust Browser is a full-fledged Web3 browser that allows you
to interact with decentralized applications (DApp) directly from the app. Meticulously
crafted tool that provides a seamless, simple and secure connection between you, Ethereum
network, and any decentralized application (DApp). Integrated interface that is fully
optimized for mobile so you can enjoy the content designed specifically for your device.[16]
• Participate in any ERC20 or ERC223 based ICO or airdrop. Configure gas price,
gas limit and data/message in a simple and easy-to-understand way
• Gain a peace of mind with military grade security. Trust Wallet was fully audited
by a leading security firm that ensured safety and integrity of the application
• Take the full advantage of Ethereum platform. Send, receive, store and track
Ethereum (ETH), Ethereum Classic (ETC), Callisto (CLO) and over 30,000 sup-
ported ERC20 tokens, including EOS, OmiseGO, Qtum, Kyber Network, EOS, Bat,
TenXPay and Augur
• Maintain control of your digital assets by storing your private keys on your own
device. With Trust Wallets server-free infrastructure only you can access your funds
2.3. TRUST - ETHEREUM & ERC20 WALLET 11
• Protect your crypto funds by enabling additional level of security - pin and biomet-
rics. With that feature turned on, even if a mobile device is unlocked, the app will
require separate authentication in order to access the funds
• Backup and restore your wallet from a highly encrypted file in less than 30 seconds
• Access any cold storage wallet - Trezor, Ledger, KeepKey etc. - with Trust’s ”watch”
function without exposing your private key in a ”view-only” mode. Monitor perfor-
mance of your digital assets while keeping keys in a safe and secure location
• See how much your tokens and coins are worth! Monitor real-time value of your
digital portfolio and individual assets in your native currency
• Enjoy the simplicity of intuitive interface that was created specifically for a mobile
device. You won’t see your app crashing or lagging because our UI was built using
native Android components and technologies
Trust - Ethereum Wallet for Android has been designed from the ground up to provide the
best possible cryptocurrency experience on your Android device with following features:
Wallet: send and request ether, ERC20 and ERC223 tokens
Watch: add an address and get notified when it is active
DApp Browser: use decentralized applications to instantly buy, sell Ethereum and
ERC20 and ERC223 tokens, collect digital assets such as cryptokitties and more
Push notifications: get notified of when transactions happen on your address
Transactions: see detailed information about transactions, full history, price of your
portfolio
12 CHAPTER 2. ANDROID BASED WALLETS
Send & Receive: easily send and receive assets via QR code or copy/paste
Security: set a passcode to protect the app to add another level of encryption
Additional Features
- DApp browser - explore ”browser” tab to learn more and buy your first Cryptokitty
- Watch arbitrary address without the private key/keystore
- Lock screen with 6-digit pin
- Pending transactions show in transaction list
- Slicker UI on transaction list
- Collectables
- Bookmarks for dApp browser
- Mnemonic phrase
Blockchain Wallet strive to make using bitcoin and ether as simple and seamless as possi-
ble. Securely store your funds, exchange BTC, ETH & BCH, and instantly transact with
anyone in the world. Access your existing wallet on your Android device or create a new
one. It’s free and takes just a few seconds[17].
Main Features:
Ease of use
- Send and receive bitcoin, ether, and Bitcoin Cash instantly with anyone in the world
- Seamlessly exchange between bitcoin, ether, and Bitcoin Cash
Peace of mind
- You are the only one who has access to your funds
2.5. COINBASE - BUY BITCOIN & MORE. SECURE WALLET. 13
What’s New
Notification Touch-Up - Rather than choosing to flood your phone with SMS messages
when you buy or receive bitcoin, you can now opt to get push notifications instead.
Coinbase is a private company based in San Francisco that provides web and mobile
digital currency services. Coinbase offers to buy and securely store bitcoin, bitcoin cash,
ethereum, and litecoin, offering the most complete services for btc, eth, and ltc on both
web and mobile. It makes easy to securely buy, use, and store digital currency[18].
Highlights of Coinbase
• Buy and sell digital currency: You can easily buy and sell digital currency like
bitcoin, bitcoin cash, ether, and litecoin directly from your Coinbase account without
having to leave the app.
• Connect bank account: You can easily deposit or withdraw money, and buy or sell
bitcoin with your linked bank account.
• Connect credit and debit cards: You can instantly buy bitcoin, bitcoin cash, ether,
and litecoin with your linked credit cards in 32 countries.
• Connect PayPal: You can instantly sell bitcoin, bitcoin cash, ether, and litecoin
with your linked PayPal account in US.
14 CHAPTER 2. ANDROID BASED WALLETS
• Merchant services - accepted by over 38,000 businesses such as Dell, Expedia, and
Overstock.
• Web and mobile - You can open your bitcoin, bitcoin cash, ethereum, and litecoin
wallet and fully manage it on both web and mobile, and access your bitcoin, bitcoin
cash, ether, and litecoin any time.
Coinbase Bitcoin Wallet for Android has been designed from the ground up to to provide
the best possible digital currency experience on your Android device with following fea-
tures:
• Wallet: send and request bitcoin, bitcoin cash, ether, and litecoin instantly by name,
email, or digital currency address
• Buy & sell: instantly convert your local currency into or out of bitcoin, bitcoin cash,
ether, and litecoin
• Price charts: Track real time and historical bitcoin, bitcoin cash, ether, and litecoin
price with price charts functionality.
• Price alerts: Get notified of changes in bitcoin, bitcoin cash, ether, and litecoin price
on the go with our new price alerts functionality.
• Send & request: easily send and request money from any of your Google contacts,
or send and request via NFC, QR code
• Security: set a passcode to protect the app and remotely disable your phone’s access
if lost or stolen
2.6. [Link] WALLET 15
[Link] is the easiest way to send money, buy load, pay bills and shop online. It was
founded in 2014 by Silicon Valley entrepreneurs Ron Hose and Runar Petursson, Coins
is Southeast Asia’s leading mobile blockchain-enabled platform that enables anyone, in-
cluding those without bank accounts, to easily access financial services directly from their
phone. Using Coins, customers have access to a mobile wallet and services such as re-
mittances, air-time, bill payments, and online shopping at over 100,000 merchants who
accept digital currency. Operating in the Philippines and Thailand, Coins’ mission is to
increase financial inclusion by delivering financial services directly to people through their
mobile phones. It offers following features to customers[19]
Loading
-Load your beepTM card with [Link]
-It’s instant, available 24/7, and has no fees!
Buy and Sell Ethereum
-Best Ethereum wallet in the Philippines
-Instantly buy, sell, send and receive Ethereum
Buy Load
- Get a 10% rebate instantly when you load any Smart, Talk n Text, Globe, TM, or Sun
prepaid phone
-Choose from 70+ load promos for all major Philippines providers
-Buy international load for prepaid phones in 150 countries
-Save your favorite numbers to easily load next time
Pay Bills
- Pay Meralco, Smart, Sun, PLDT, Globe, and 80+ other billers all in one place
- Get a 5 PHP rebate every time you pay a unique bill
16 CHAPTER 2. ANDROID BASED WALLETS
- Get an extra 100 PHP for every 5 unique bill payments you make each week
This differs from various popular cryptocurrencies such as Bitcoin and Ethereum which
2.7. A PROGRESSIVE WEB APP (PWA)-BASED MOBILE WALLET FOR BAZO17
Figure 2.8: A Progressive Web App (PWA)-based Mobile Wallet for Bazo
are both open to the public. As part of the initial development efforts for Bazo, a full
client application was created. With this application it is possible to issue transactions.
However, in order to participate in the Bazo network, peers have to obtain a complete
copy of the Blockchain.
Although the architecture for Coinblesk[22] is substantially different from the approach
with Bazo, parts of the user interface are reused for the Bazo Wallet.
• Requesting funds from other users. This is achieved by sending transaction data
between users over multiple ways, such as NFC, BTLE, QR Code and Links.
• Linking account details to the Bazo Block Explorer, thus directing the user to it for
further details.
• Operations with the currency are possible in a trustless way using the application.
• All operations requiring the users private key should be safe and run completely in
the browser.
18 CHAPTER 2. ANDROID BASED WALLETS
• It should not be necessary to send the key over a network or expose it in any other
way.
Most of the features described above match with the functionality of [Link],
a web-based wallet for the Ethereum cryptocurrency, except for the ways of transferring
transaction data.
Design
Due to Progressive Web Applications having native elements, PWAs can be a solution
for providing a unified experience for multiple operating systems, targeting both mobile
and desktop devices. All operations need to be made in the browser. Since no backend
application should be leveraged, the Web app needs to be able to sign transactions in the
browser. All further communication with the Bazo network is done over web interfaces.
This led to the design of a RESTful web interface for the Bazo light client with following
operations:
Querying account state: This endpoint should return all necessary information about
the account’s state such as balance, the transaction counter and information if the account
has root access.
Preparing transactions: By supplying fee, transaction value, target and source address
to this endpoint, the API will prepare the transaction hash and return it to the client to
calculate the signature.
In order to explore further possibilities on how to extend the browser support for native
APIs a Proof of Concept was designed. The PoC is targeted to the Android platform,
since NFC support is still fairly limited on iOS devices at the time of the design. This
means that with Core NFC, a technology by Apple, only communication with passive
NFC Tags is supported. Since the support for WebNFC is limited to Android devices,
the functionality for writing and reading the transaction data is visible only to the users
that have activated advanced options.
NFC Bridge
Due to limited browser support for Native APIs such as webNFC, a prototype was dis-
cussed and implemented. The prototype involved a native Android application that should
enable the web application to forward transaction information to NFC capable devices
using the Android Beam technology.
Payer control with the Bazo currency has a mixed image. The user has the control to
create transactions at terms he prefers, for example, the user can set the fee he is willing
to spend on the transaction. However, the clearance of the transaction highly depends on
the network.
2.8. COINBLESK 4.0 19
Security, as in the definition, should be given for all transactions signed by the user.
From a technical point of view, the Wallet can be considered secure, as that it is not
possible to steal a private key or manipulate transactions which would result in the loss
of funds for the user.
Universality is not a strength of the Bazo currency. Since the Wallet is not compatible
with other payment systems or applications, only users in the system can exchange funds.
Since Bazo is a newly created cryptocurrency, there is no user base and users would have
to be convinced to join the system.
Phishing Another risk is introduced with the unified data model of transaction data,
since this points to the URL of the Bazo Wallet. One could trick a user into using a web
application that looks like the Bazo Wallet, but has the single purpose of stealing the
private key. This is a serious risk in cases where the user does not realize that the URL
does not belong to the actual Wallet.
The first version of CoinBlesk 1.0 ran in a client-server architecture, where the client
was mostly a thin RESTful service consumer and the server was responsible for all com-
munication with the Bitcoin network. Since the server could spend the money without
the client’s permission various legal issues arose from this approach.
CoinBlesk 2.0 addressed the above issues and introduced a new concept working with
multisig Bitcoin addresses which brought more responsibilities to the client. Both versions
of CoinBlesk worked only in combination with NFC. Furthermore, clients need to trust
the server with both versions.
integrate transparently with the system. The proposed design keeps its compliance with
Swiss banking laws and offers a better protection to clients without a negative impact on
usability.
Major disadvantages were found related to transaction fees in the 3.0 version of CoinBlesk
which are highlighted below.
Transaction Fees The user has to pay a transaction fee for each payment made with
Coinblesk. This cost can be a significant, especially for smaller purchases: a minimal
transaction between two Coinblesk user currently costs at least USD 1.52.
Security When transactions are made between Coinblesk users, the resulting unspent
transaction outputs (UTXO) can be immediately spent again. Due to the currently miss-
ing malleability fixes in the bitcoin protocol, this makes those chained transactions unsafe.
Fixed transaction fees Currently Coinblesk uses a fixed hard-coded fee for transactions.
However, the required fee for a fast block inclusion is dynamic and can change at any time.
Requesting this fee from an external service would be the better option.
Outdated Codebase Coinblesk has seen many iterations over the last years. This has
left the codebase in a sub-optimal state. There are outdated library dependencies and
unused or untested code paths. Additionally, some unit tests are nondeterministic as they
rely on a given execution order. Also development setup and deployment are non-trivial,
as a specific application server is needed.
CoinBlesk version 4.0 addresses the issues mentioned above by providing the following
features.
Micro-payment channels:
2.8. COINBLESK 4.0 21
CoinBlesk introduces micropayment channel to decrease the costs and processing time.
In the initial step of creating a micropayment channel, the sending entity transfers some
funds to an address that both the sender and receiver control. These types of addresses are
known as MultiSig addresses. A n-of-m MultiSig address needs n out of m signatures to be
spendable. In the case of a micropayment channel, a 2-of-2 address is used, meaning that
neither the sender nor the receiver can spend the money on their own. However, there must
be some mechanism that allows him to get that money back eventually. Otherwise the
money might be lost forever, should the receiver disappear. It would also be possible for
the receiver to extort money from the sender by threatening to not sign any transactions
from the newly created address.
There are several ways to avoid this scenario. One solution is to use a refund transaction
as the process is shown in following figure.
Initially, a funding transaction T1 is created by the sender (1), which he keeps secret. He
then creates a refund transaction which connects to the funding transaction and sends
all coins in the 2-of-2 MultiSig address back to himself (2). This refund transaction
additionally has a time lock, which prevents a broadcast before some time in the future.
This is possible by using the nLockTime field in a transaction. The refund transaction
is then sent to the receiver (3), who signs it and sends it back to the sender (4). Now the
sender owns a transaction which gives him the guarantee that he will eventually get back
his money, should the receiver stop collaborating. In the worst case he has to wait until
the lock time is reached. Knowing this, he can then safely broadcast T1 to the network,
locking some moeny in the MultiSig address (5) and completing the setup.
Key Exchange: A user sends his public key to the server, which will then respond
with his own user specific public key. This is equivalent to the old system and acts as a
registration process. The key exchange has to be done once per user.
Time locked Address: After the initial key exchange, the user creates a new bitcoin
address. This address is a 2-of-2 MultiSig address that requires both signatures from
the exchanged keys. It is also defined by a user-chosen lock-time, a timestamp set in the
future, after which the client is able to spend funds in the address without the involvement
of the server. This lock-time gives the user the guarantee that he will eventually be able
to retrieve his funds in case of an uncooperative server.
22 CHAPTER 2. ANDROID BASED WALLETS
Funding of Address: In order to make any payments, the user must load some funds
into one of his time-locked addresses. The method of funding is left to the user. He
can use any wallet or bitcoin exchange provider or be funded by a different Coinblesk
user. After a funding transaction was made, he must wait for at least one block for the
transaction to be confirmed.
Virtual Payment to Coinblesk User: A user that has received micropayments can
use his virtual balance to directly transfer funds to other Coinblesk users. This is a very
cheap and efficient way to transfer coins, as it is a simple database change and does not
involve any bitcoin related operations.
Server Operations:
Closing of Channels The server can close a payment channel at any time. This is done
by broadcasting the latest saved channel transaction to the network and locking the user’s
account until the transaction is mined in a block.
Increasing/Decreasing Pot Size The server administrator might choose to increase
the pot size for more liquidity in the system. Likewise, coins can be taken out from the
pot if they are needed elsewhere.
Trust Coinblesk 4.0 adds some required trust back to the system. When a user sends
some funds over a micropayment channel, he trusts the server to forward that money to
the receiver at some point in the future. Likewise, the receiver trusts the server to receive
a payout of his virtual balance from the server. Trust between Coinblesk users is not
required.
Improvements in bitcoin 4.0 regarding protocol
Following section describes the improvement in protocol and communication.
After the release of Bitcoin, alternatives to its PoW mining mechanism were researched
and PoSpace was studied in the context of cryptocurrencies. Proofs of space are seen
as a fairer and greener alternative due to the general-purpose nature of storage and the
lower energy cost required by storage. Several theoretical and practical implementations
of PoSpace have been released and discussed, such as SpaceMint and Burstcoin.
PoSpace has been used in the Burstcoin cryptocurrency founded in August 2014. Burst-
coin claims to have a green algorithm that favors smaller miners by design, making trans-
action costs cheaper and the network more decentralized[25]. The goal of depending on
smaller miners was most typified by the original Android app to mine Burstcoin. How-
ever, by December 2017, the estimated network size approached 157,000 terabytes and the
average mining payoff was 21 burst per week per terabyte, so participants with disk space
measured in gigabytes are no longer likely to receive significant payback from mining. It’s
an open source project.
23
24 CHAPTER 3. REQUIREMENTS FOR NEW WALLET
High security
- Random Seed Generation
- PIN Protection
Main Features:
They don’t use proof of capacity as means of mining, they use distributed storage?
3.2 SpaceMint
In Spacemint, once a miner has dedicated and initialized some space, participating in the
mining process is very cheap. A new block is added to the chain every fixed period of time,
and in every period a miner just has to make a small number of lookups to the stored
space to check if she ”wins”, and thus can efficiently add the next block to the chain and
3.3. CHIA WALLET 25
get the mining reward. In this paper, we detail the construction of Spacemint, analyze its
security and game-theoretic properties, and study its performance. Our prototype shows
that it takes approximately 25 seconds to prove over a terabyte of space, and it takes a
fraction of a second to verify the proof[27].
Ram Cohen invented torrenting. Now he’s building a cryptocurrency called Chia that
doesn’t waste electricity like Bitcoin, and top investors are lining up. Chia has just raised
a $3.395 million seed round led by AngelList’s Naval Ravikant and joined by Andreessen
Horowitz, Greylock and more. The money will help the startup build out its Chia coin
and blockchain powered by proofs of space and time instead of Bitcoin’s energy-sucking
proofs of work, which it plans to launch in Q1 2019[28].
Requirements are criteria that are necessary to meet project objectives. Typically, they
outline how the product or solution will address the needs of the product and/or its users.
Requirements documents can be high-level, as it’s likely the product will change and
evolve as new information and learnings become available.
The purpose of the project is to develop a state of the art cryptocurrency wallet based
on proof of space. It will enhance the security for managing cryptocurrency coins with
a highly secure and easy to use wallet. It will streamline the current business process
for trading existing cryptocurrency coins along with supporting the new emerging coins
based on proof of space by introducing new features. The newly developed will be an
initial version of product. The underlying infrastructure will be different as compared
to Coinblesk or other available wallets based on Proof of Work. However, the existing
features can also be used from the previous versions of CoinBlesk or open source projects.
A highly secure and elegant user interface is the main object of the project. It should be
compliant technically with the PoSpace, newly developed APIs and protocols.
Requesting & Sending funds from other users. This is achieved by sending transaction
data between users over multiple ways, such as NFC, BTLE and QR Code. It should
allow to send funds to users on the same network as well as sending funds to users on
other networks instantly in-app. You should easily buy and sell digital currency directly
from your wallet account without having to leave the app with an intention to provide a
seamless customer experience.
Shop Online Pay online to all merchants who are accepting cryptocurrency.
Watch only addresses A watch-only address is a public bitcoin addresse you’ve im-
ported into your wallet. This is a cool, useful feature if you want to monitor activity
26 CHAPTER 3. REQUIREMENTS FOR NEW WALLET
at a particular bitcoin address. You can import any existing coin address (e.g. 1PRx-
CErnys1jWEBnbG3Ad1e2s3uQzpasGX) into your wallet as a watch-only address, which
will incorporate all of its incoming and outgoing transactions into your live transaction
feed.
Linking account details to the Block Explorer, directing the user to it for further
details.
Currency conversion There should be a feature to display the latest conversion rates
for different cryptocurrencies. Application should allow to seamlessly exchange between
bitcoin, ether, and other popular currencies.
Client-side encryption and decryption Client side encryption means only you have
access to your wallet. Server should not store your coins. The wallet can be encrypted on
android device with your personal password. The private password acts as a decryption
key to both lock and unlock the wallet —it shouldn’t be accessed without the password.
QR code support There should a QR code support to easily transfer funds and share
public keys with other users as it was developed in the CoinBlesk application.
Multi language Support Both English and German language should be supported in
the initial version of wallet.
CoinBlesk Salient Features This newly developed cryptocurrency wallet should contain
the Coinblesk competitive features e.g. Near Field Communication, Bluetooth LE, Micro-
payment channel, Time locked Addresses, Refund Transactions etc.
Dynamic Fees work to detect changes in network volume and will raise or lower trans-
action fees accordingly. This means that the same transaction may require a higher fee
during a period of network congestion, or a lower fee if sent during a period of decreased
activity. Alternatively, you can set your own custom fees and limits.
Funds Management check balance, full history, price of your portfolio, and other trans-
action details. Monitor real-time value of your digital portfolio and individual assets in
your native currency.
Paper Wallet It should allow to import the paper wallet. There can also be an option
to print your private keys in a paper wallet by sending a file through Email.
Notification Touch-Up - Rather than choosing to flood your phone with messages when
you buy or receive bitcoin, you should be able to opt to get push notifications instead.
3.5. ADVANCED FEATURES 27
Mnemonic Sentence In case your device gets lost, you can secure your wallet and coins
with just 12 words written on paper. The master phrase can restore your wallet and funds
on any other device.
• Connect credit and debit cards: You should be able to instantly buy bitcoin,
bitcoin cash, ether, and litecoin with your linked credit cards
• Price charts & alerts: Track real time and historical cryptocurrency prices with
price charts functionality. There can be a functionality to get notification of changes
in cryptocurrency price on the go with the new price alerts.
• There can be an option to access any cold storage wallet for example Trezor, Ledger
etc. - with a function without exposing your private key in a view-only mode. It
would also be helpful to monitor performance of digital assets while keeping keys in
a safe and secure location.
All operations requiring the users private key should be safe and run completely in the
app with security. It should not be necessary to send the key over a network or expose it
in any other way. MultiSig has already been introduced in the Bitcoin Core, it adds more
trust and security in the system for end users in micropayment channels. It will enhance
the security to spend cryptocoins. High security of application is primary objective. It
should provide peace of mind that a user is the only one who has access to his funds. A
user controls his funds without involvement of central authority.
• Level 2: Protect your crypto funds by enabling additional level of security - 6-digit
pin and biometrics. With that feature turned on, even if a mobile device is unlocked,
the app will require separate authentication in order to access the funds.
28 CHAPTER 3. REQUIREMENTS FOR NEW WALLET
• Level 3: Block all the TOR requests. This option blocks IP addresses coming from
the Tor network from accessing your account. Tor is an anonymizing tool that
is often used by hackers, although many privacy enthusiasts also use Tor for non-
malicious purposes.
• Memory encryption: Data should be held in encrypted memory and any important
values must be deleted from the system memory.
• Application should offer a feature for a simplified backup and recovery with a 12-
word backup phrase or using a highly encrypted file.
• Screenshot & video blocking: Secure window layout should be developed at the OS
level to stop any screen recording attempts.
• An online security center or support to help protect the funds from unauthorized
access with an emergency response.
• There should be a simple and intuitive interface using the latest UI elements for
android device.
• There should not be any app crashing or lagging in the application. It is recom-
mended to build the UI using native Android components and technologies.
• In order to make sure the transparency and enhance trust, source code should be
kept open source.
• Smart UI: Seamless and blazing-fast user interface evolves on the fly to suit the
customer specific needs.
3.7. RELIABILITY & QUALITY REQUIREMENTS 29
• Users can focus on objects and read necessary text. App installs and runs without
crashing. App maintains high performance. There should be maximum test cover-
age for the written code to make sure the high quality and smooth experience for
customers.
Features Enjin Trust - Blockchain Coinbase [Link] CoinBlesk BurstCoin MBM Wallet
Wallet Ethereum Wallet
Requesting & 3 3 3 3 3 3 3 3
Sending funds
Watch only ad- 7 7 3 7 7 7 3 3
dresses
QR Support 3 3 3 3 3 3 3 3
Shop Online 3 7 7 3 3 3 7 3
Game Credits 3 7 7 7 3 7 7 3
Micropayment 7 7 7 7 7 3 3 3
Channel
Dynamic Fees 3 7 3 7 7 7 3 3
Connect credit 7 7 3 3 3 7 3 3
and debit cards
Rule of Two En- 3 7 7 7 7 7 7 3
cryption
Memory encryp- 3 7 7 7 7 7 7 3
tion
Advanced Two- 3 7 3 3 3 7 7 3
Factor Authenti-
cation
Smart & Sleek 3 3 3 7 3 7 7 3
UI
Omnichannel in- 7 7 7 7 7 7 7 3
tegration
Secure Key- 3 7 7 7 7 7 7 3
board
Screenshot & 3 7 7 7 7 7 7 3
video blocking
Price charts 7 7 7 3 7 7 7 3
Open Source 7 3 3 7 7 3 3 3
Segregated Wit- 7 7 7 7 7 7 7 3
ness
This table highlights a comparison of android wallets studied in this report with a newly
proposed wallet.
Chapter 4
Future Work
There is need to explore and find the potential of latest tools and technologies in future
work. A few examples are discussed in this section.
4.1 QuarkChain
More complex widgets can be created by combining many simpler ones. The Flutter frame-
work contains two sets of widgets which conform to specific design languages. Material
31
32 CHAPTER 4. FUTURE WORK
Design widgets implement Google’s design language of the same name, and Cupertino
widgets imitate Apple’s iOS design[31].
There are also other competitors in the market like ReactNative, Xamrin. It is claimed
that Flutter provides support for android and iphone without any bridge or third party
APIs to access native components. A further study is required to understand the full
potential of Flutter framework for using native components and leverage the framework
for developing a single codebase.
[4] [Link]
bitcoin-based-payment-approach-and-app.
[5] A Progressive Web App (PWA)-based Mobile Wallet for Bazo, [Link]
[Link]/CSG/staff/bocek/extern/theses/[Link]
[7] What is cryptocurrency, how does it work and why do we use it?, [Link]
[Link]/technology/0/cryptocurrency/
33
34 BIBLIOGRAPHY
[21] A Progressive Web App (PWA)-based Mobile Wallet for Bazo, [Link]
[Link]/CSG/staff/bocek/extern/theses/[Link]
2.7 [Link] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
35