Introduction
We express our gratitude to the Kabila team for the collaborative engagement that enabled the execution of this dApp Security Assessment.
Document | |
|---|---|
| Name | Wallet Code Review and Security Analysis Report for Kabila |
| Audited By | Bohdan Korzhynskyi |
| Approved By | Stephen Ajayi |
| Website | https://www.kabila.app/→ |
| Changelog | 28/07/2025 - Preliminary Report |
| Changelog | 06/08/2025 - Final Report |
| Methodology | https://hackenio.cc/dApp_methodology→ |
Document
- Name
- Wallet Code Review and Security Analysis Report for Kabila
- Audited By
- Bohdan Korzhynskyi
- Approved By
- Stephen Ajayi
- Website
- https://www.kabila.app/→
- Changelog
- 28/07/2025 - Preliminary Report
- Changelog
- 06/08/2025 - Final Report
- Methodology
- https://hackenio.cc/dApp_methodology→
Review Scope | |
|---|---|
| Repository | https://github.com/Kabila-Tech/kabila-wallet→ |
| InitIal Commit | 63c0794a7588fa30e2b73525944f5224782c386a |
| Final Commit | 45f7c50be97ccf3381065ca3d8d90bd78c99056d |
Review Scope
- InitIal Commit
- 63c0794a7588fa30e2b73525944f5224782c386a
- Final Commit
- 45f7c50be97ccf3381065ca3d8d90bd78c99056d
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
System Overview
Kabila Wallet is a non-custodial cryptocurrency wallet built specifically for the Hedera network. It enables users to securely manage HBAR tokens, fungible tokens, and non-fungible tokens (NFTs) using Hedera Token Service (HTS). The wallet is designed for security, transparency, and full user control over private keys, which are never stored on external servers or shared with Kabila.
Kabila Wallet is available across multiple platforms, including a Chrome browser extension, native iOS and Android apps, iPadOS, and macOS for M1-chip devices. It also supports WalletConnect, allowing integration with third-party decentralized applications (DApps) that run on Hedera. The interface is modern and intuitive, optimized for both novice and experienced users.
The wallet supports account creation, recovery via seed phrase or private key, and token management (send, receive, approve, and associate tokens). Users can purchase HBAR directly from within the wallet using credit card or bank transfer through the integrated C14 on-ramp, which may require KYC depending on the transaction size.
Kabila Wallet also offers full NFT management features, including a gallery view, safe peer-to-peer trading (Safe Trade), and batch minting or transfers — a unique capability not commonly available in Hedera wallets. It enables creators and collectors to interact with NFTs in a streamlined and secure environment.
Kabila Wallet uses AES-256 GCM encryption to securely store private keys locally on the user's device. It supports biometric authentication such as Face ID and traditional PIN codes on mobile platforms. Pre-sign alerts give users full transparency into transactions before authorization, helping prevent accidental or malicious operations. Additionally, the wallet includes a ReKey feature, allowing users to reset their private keys while maintaining access to their accounts.
Users can natively stake HBAR within the wallet to earn rewards. Transaction history is clearly displayed and can be exported in CSV format for analysis or accounting purposes. The wallet also supports token allowances and auto-associations, simplifying interactions with DApps that require token permissions.
Kabila Wallet is fully integrated with the broader Kabila ecosystem, including Kabila Tools, Launchpad, and NFT Market. It is the only wallet that supports advanced features like batch operations and retry mechanisms in coordination with Kabila’s creator platform. These integrations provide seamless access to minting, launching, and managing tokens and NFTs directly from the wallet.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-1193 | Incorrect domain validation using startsWith() | fixed | Medium | |
| F-2025-1193 | Use of non-cryptographically secure random number generator for password creation | fixed | Low | |
| F-2025-1195 | Key usage pattern may retain data temporarily in memory | fixed | Low | |
| F-2025-1194 | Static encryption key used for user profile encryption | fixed | Low | |
| F-2025-1193 | Use of non-cryptographically secure random number generator for password creation | fixed | Low | |
| F-2025-1194 | Insecure random identifier generation in /lib/utils.js | fixed | Observation | |
| F-2025-1193 | Incorrect handling of wildcard domains | fixed | Observation | |
| F-2025-1193 | Insufficient control of allowed URLs for dApp iframe | fixed | Observation |
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following endpoints from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/Kabila-Tech/kabila-wallet→ |
| Initial Commit | 63c0794a7588fa30e2b73525944f5224782c386a |
| Final Commit | 45f7c50be97ccf3381065ca3d8d90bd78c99056d |
Scope Details
- Initial Commit
- 63c0794a7588fa30e2b73525944f5224782c386a
- Final Commit
- 45f7c50be97ccf3381065ca3d8d90bd78c99056d