Open Source
The mallow wallet app is open source under the MIT license, so you can verify how it handles your keys instead of taking our word for it.
The source for the app we distribute lives at github.com/mallow-labs/mallow-wallet, released under the MIT license.
Why it matters
A self-custody wallet asks for more trust than almost any other app on your phone. It holds the keys that control your funds, and a single bad code path can lose them irreversibly. Publishing the source changes what that trust is based on.
- Verify, don't trust. Every claim on the Security page is a claim about code. With the code public, you can read it, or pay someone to, instead of believing a marketing page.
- More eyes on the risky parts. Key derivation, signing gates, and secure storage are exactly the code that benefits from outside review. Security researchers can find problems without reverse-engineering a binary, and report them through the process in SECURITY.md.
- No lock-in. Your seed phrase already works in any BIP-39 wallet. The MIT license means the app itself is not a dependency on us either — the code survives us.
- Contributions welcome. Bugs, fixes, and features can come from anyone who uses the wallet, not only from people we employ.
What you can verify
These are the security properties the repository is meant to let you check for yourself. Each one is visible in the source, and the README points at the files to start from.
| Claim | Where it holds |
|---|---|
| Keys are generated on the device and never leave it | Recovery phrases and private keys go through a dedicated vault: an iOS Keychain item marked device-only, and on Android a per-secret AES-256-GCM key held non-exportably in the Keystore, with only ciphertext on disk. There is no key escrow, no server-side backup, and no code path that transmits key material. |
| Every transaction signature passes one gate | All signing funnels through a single entry point, so you can read the whole authorization story in one file rather than auditing each flow. Note what it does not do by default: step-up authentication per transaction is opt-in, and off until you enable it. |
| Nothing sensitive is logged | The crash reporter is configured not to turn debug output into telemetry, and a CI lint keeps key material out of it in the first place. |
| Transactions are simulated before you sign | EVM transfers run through eth_simulateV1, and signing is blocked unless the only asset movement is the one you asked for. It fails closed — if simulation is unreachable, the transfer errors rather than proceeding unchecked. |
| The backend cannot move your funds | It builds unsigned transactions and serves read data. Your device signs. A compromised backend could lie to you about balances, or hand you a transaction you did not want — which is what the simulation gate above exists to catch — and it can remotely block signing for a given chain and flow — but nothing it sends can weaken a gate or produce a signature. |
What open source does not prove
Being honest about the limits matters as much as the claims.
Builds are not reproducible. You cannot take the shipped binary and prove it was compiled from this source. We would rather say so than imply a guarantee we do not have. What the repository offers is auditable source, plus a definitive list of where we publish.
That list matters precisely because the code is public: anyone can fork this repository, point it at a backend they control, and ship the result. mallow wallet is not on the App Store or Google Play yet. Until it is, the only official builds are TestFlight on iOS and Google Play closed testing on Android, both by invitation from mallow. A build from anywhere else is not ours, whatever it is called and whatever logo it carries.
Forking and reuse
The MIT license lets you fork the app. Three things to know before you do:
- A fork can run against our backend. Ask us for an API key and the app talks to the same production API the official build uses. It is the quickest way to get a working fork, and it saves you from standing up services first. Request a key in our Discord or at [email protected]. The API docs cover how the key is sent and what it is rate limited to. The key changes nothing about custody: your device still holds the keys and still signs.
- Or run your own backend. The contract to implement is the OpenAPI spec vendored in the repository.
- You must rename and reskin. The MIT license covers the code. It does not cover the mallow name, wordmark, logo, or brand assets — see TRADEMARK.md. A wallet that looks like ours but is not ours is a phishing vector, which is why that line is drawn where it is.
Several Dart packages in the repository are written to stand alone and may be useful outside the app:
| Package | What it does |
|---|---|
ledger_solana | Solana app bindings for Ledger hardware wallets |
ledger_ethereum | Ethereum app bindings for Ledger hardware wallets |
ledger_tezos | Tezos app bindings for Ledger hardware wallets |
jupiter_aggregator | Typed client for Jupiter's Ultra, classic swap, and price APIs |
Get the code
- Repository: github.com/mallow-labs/mallow-wallet
- Build and contribute: CONTRIBUTING.md
- Report a vulnerability: SECURITY.md, or email [email protected]. Please do not open a public issue for a security problem.
- License: MIT, excluding the name, logo, and brand assets.
- More from us: github.com/mallow-labs