The parts of the ONIQ wallet that decide whether your money is yours: key generation, derivation, signing, and how secrets are stored on the device.
Published so the claim "your keys never leave your phone" can be checked rather than believed. Everything here runs on the device; none of it talks to our servers.
| File | Answers |
|---|---|
wallet_crypto.dart |
Where the seed comes from, how the key and address are derived |
vault.dart |
How secrets are encrypted with a key derived from your passcode |
pin_store.dart |
How the passcode is stored and verified |
tron_signer.dart |
Where transactions are signed |
wallet_store.dart |
Where secrets are written, and where they are not |
biometrics.dart |
Face ID / fingerprint unlock |
device_integrity.dart |
Root and jailbreak detection |
screen_secure.dart |
Screenshot blocking on seed-phrase screens |
Roughly 1,500 lines. The rest of the app — interface, networking, the gasless engine — is closed, and the reasoning for that is below.
The seed is generated from the OS cryptographic RNG. Random.secure(), 128 bits of
entropy, standard BIP39 twelve words.
One detail worth pointing out, because it is easy to miss: the entropy function is our
own rather than the library's default. The bip39 package generates bytes with
nextInt(255), which never produces 0xFF — one value in 256 is unreachable, and the
entropy is fractionally below the 128 bits the standard calls for. _secureEntropy uses
the full 0–255 range.
Derivation is standard. m/44'/195'/0'/0/0, where 195 is TRON's registered coin
type. Address = Base58Check over 0x41 + last 20 bytes of keccak256 of the uncompressed
public key.
The practical consequence: a seed phrase created in ONIQ opens the same wallet in TronLink, Trust, or a hardware wallet. You are not locked into this app.
Signing happens on the device. tron_signer.dart never transmits a private key.
The server builds an unsigned transaction; the phone signs it and returns only the
signature.
Secrets are encrypted at rest with a key derived from your passcode. Argon2id, run in a background isolate so it can be slow enough to be worth something. The encrypted blob lives in the platform's secure storage — Keychain on iOS, EncryptedSharedPreferences on Android.
The server never receives a seed or a private key. There is no code path here that sends one anywhere. That is checkable by reading, which is the point of publishing it.
Not a reproducible build. Nothing here proves the app you installed was built from this code. That would require the whole project to be open and the build to be byte-for-byte repeatable. This is a good-faith disclosure of the part that matters most, not a cryptographic guarantee.
Not the whole app. The gasless engine — energy rental, provider integration, fee calculation — is the product, and it stays closed. It also holds no user secrets, so opening it would add nothing to the question this repository exists to answer.
Not a drop-in library. These files are extracted from a running app and depend on its
structure. Read them; don't expect pub get to work.
Comments were stripped for readability. The behaviour is unchanged.
Found something wrong? Open an issue. Security reports that shouldn't be public: contact on the site.
Oniq Technologies LTD, United Kingdom.