Skip to content

Android demo 0.1.2

Latest

Choose a tag to compare

@millw14 millw14 released this 03 Aug 16:38
· 69 commits to main since this release

This is the one that starts. 0.1.0 and 0.1.1 abort on launch on every Android 14+ device — delete them.

What was actually wrong

Self-inflicted, in two steps.

expo-screen-capture was added to stop the recovery phrase being screenshotted.
Inspecting the resulting APK showed it had pulled in
android.permission.DETECT_SCREEN_CAPTURE. That looked like an unexplained
permission for a wallet, so it was blocked.

It is not optional. ScreenCaptureModule.kt registers a screen-capture callback
inside OnCreate on Android 14+, with no permission check, at module creation —
whether or not the app ever asks to block screenshots. Without the permission
Android throws a SecurityException, which surfaces as an uncaught JS exception
before the runtime is ready and aborts the process:

Abort message: 'terminating due to uncaught exception … JavascriptException:
[runtime not ready]: Error: Exception in HostFunction: Permission Denial:
registerScreenCaptureObserver … requires android.permission.DETECT_SCREEN_CAPTURE

DETECT_SCREEN_CAPTURE is protection level normal — no prompt, no dialog,
no access to any content. It only lets the OS tell the app that a screenshot
happened, which for a wallet is a feature. It is now allowed. Verified present
in this APK's manifest.

The two earlier releases blamed a TextDecoder polyfill. That was a real latent
hazard and the fix is kept, but it was never this crash.

Still a demo

Every number it shows is generated on the phone, and it refuses to sign a
permission wall. Your recovery phrase is real and stays in the phone's keystore.

Permissions: INTERNET, ACCESS_NETWORK_STATE, USE_BIOMETRIC,
USE_FINGERPRINT, DETECT_SCREEN_CAPTURE. allowBackup=false. Signed with APK
Signature Scheme v2.