Wallet Logo

Sallet One

🔍 Last analysed 7th August 2022 .  

As part of our Methodology, we ask:

Can the product be built from the source provided?

 
If the answer is "no", we mark it as "Failed to build from source provided!".

Published code doesn’t help much if the app fails to compile.

We try to compile the published source code using the published build instructions into a binary. If that fails, we might try to work around issues but if we consistently fail to build the app, we give it this verdict and open an issue in the issue tracker of the provider to hopefully verify their app later.

The product cannot be independently verified. If the provider puts your funds at risk on purpose or by accident, you will probably not know about the issue before people start losing money. If the provider is more criminally inclined he might have collected all the backups of all the wallets, ready to be emptied at the press of a button. The product might have a formidable track record but out of distress or change in management turns out to be evil from some point on, with nobody outside ever knowing before it is too late.

Help spread awareness for build reproducibility

Please help us spread the word discussing build reproducibility with Sallet One  via their Twitter!

Do your own research!

Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.

If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.

The Analysis 

This hardware wallet requires a companion app: SalletOne Live   downloadable via Google Play or the Apple store.

The user manual describes the procedure once a user unboxes his Sallet One device.

  1. Password setting
  2. Mnemonic phrase generation
  3. Confirmation of mnemonic backup
  4. Mnemonic words import
  5. Password
  6. Home page is the wallet address
  7. QR code for receiving
  8. The device can generate any number of addresses for multiple currencies
  9. The device can scan the QR code from the app
  10. The transaction details are confirmed and confirmed through the device itself.

Private keys can be created offline - ✔️

From the Terms of Use

“Cold wallet” refers to a wallet product that stores private keys of digital assets and never connects to the Internet. Sallet one cold wallet is a hardware wallet, which is used to generate mnemonic words randomly, and private keys of different currencies are generated from the mnemonic words. In the end, the private key generates the public key, and finally the public key generates the asset address to realize the safe storage of digital assets.

Private keys are not shared - ✔️

From the SalletOne User Service Protocol

Article 31 The Users shall be responsible for the proper safekeeping of their mobile devices, as well as their information such as Wallet passwords, private keys, mnemonics and Keystore. The Company is not responsible for the safe-keeping of such devices or information of the Users. All risks, responsibilities, losses and expenses caused by the Users’ loss of their mobile devices, their active or passive disclosure or forgetting of their Wallet passwords, private keys, mnemonic words, Keystore, or attacks or fraud by others shall be borne exclusively by the Users.

Device displays receive address for confirmation - ✔️

Yes. This is documented in the user manual.

Interface - ✔️

The 4 inch display touchscreen makes it convenient to use the device. Device communication with companion app is through QR code.

Code and Reproducibility

We were able to locate Sallet One’s GitHub repository but it lacks build instructions. Together with the lack of actual product pictures or videos, the code being only two commits, the companion apps not having many users/ratings and the rather lacking documentation we have little hope for this product to be very interesting but for now simply consider it as not verifiable.

(dg, lw)