[Do Not Merge]: New WDK Starter RN App by NirmalPatidar · Pull Request #38 · tetherto/wdk-starter-react-native

NirmalPatidar · 2026-07-22T13:25:05Z

Summary

Completes the onboarding flow end to end against a real WDK wallet —
not mocked — from Welcome through wallet creation/import, app password
setup, and cloud backup. Every screen was built by extracting the exact
markup/CSS from the design prototype rather than approximating it.

What's included

WDK integration (Steps 1–5)

Native build pipeline verified working (packages compiled in, worklet
runtime initialized)
Real wallet data: balances, receive address, native BTC send
Real wallet lifecycle: create, import, unlock, lock
See docs/WDK_INTEGRATION.md for the full step-by-step and the version
pins that matter (wdk-react-native-core must stay on 1.0.0-beta.10
— see that doc for why)

Onboarding screens (prototype-matched)

Welcome
Recovery phrase reveal (12/24-word toggle)
Recovery phrase import (12/24 words, with paste-distribution across the
word grid)
App password creation
Cloud backup offer → provider choice → success

Security

Real app password, required to unlock — not just device biometrics
Envelope-encrypted password vault (@tetherto/wdk-utils, hardware-backed
vault key) — see docs/SECURITY.md for the stated tradeoff vs. a
one-way verifier
Lock/unlock verified working on both iOS and Android, including
fixes for three platform-specific bugs (iOS's inactive transition
state, wallet-creation's transient locked-looking state, Google
Sign-In's native-Activity false-backgrounding signal)

Cloud backup

Person chooses either iCloud or Google Drive, on either
platform (not platform-gated)
Encrypted with the person's own app password, not a fixed passphrase
Full external setup (Apple Developer Portal + Google Cloud Console,
including the iOS Google OAuth client this required beyond the
reference implementation) documented in docs/CLOUD_BACKUP.md

Responsive design system

All onboarding screens verified on iPhone, iPad, and Android — scaling
anchored to the prototype's own canvas size, not fixed pixel values

Documentation

README.md — replaces a stale template README that didn't describe
this project
docs/ENVIRONMENT.md, docs/ARCHITECTURE.md, docs/PROJECT_STRUCTURE.md,
docs/WDK_INTEGRATION.md, docs/SECURITY.md, docs/CLOUD_BACKUP.md,
docs/TROUBLESHOOTING.md
CONTRIBUTING.md, .env.example

Testing done

Fresh install → onboarding → create wallet → real balance/address on
wallet home
Import flow with both 12- and 24-word phrases, including pasting a full
phrase
Background/foreground lock-unlock cycle on both iOS and Android
Cloud backup upload via both iCloud and Google Drive, on both platforms
iOS-specific: delete-and-reinstall scenario (Keychain survives
uninstall — self-healing fix verified)

Known limitations (not in scope for this PR)

Cloud backup restore (download + decrypt) isn't wired to a screen
yet — downloadBackup() exists and is ready
Main wallet dashboard / send / receive / activity screens haven't had
the same prototype-matching pass as onboarding
No BIP39 wordlist validation on the import screen (relies on WDK's own
mnemonic validation)

How to test this PR

See README.md → Quick Start, and docs/ENVIRONMENT.md for required
toolchain versions (npm ≥ 11 and JDK 17 specifically — mismatches here
cause confusing native crashes, not clean errors). Cloud backup requires
your own Apple/Google developer setup — see docs/CLOUD_BACKUP.md.

- expo-router file-based routing under src/app - all 18 screens with working navigation - v2 light theme + dark-ready theme system - reusable component library - domain/data/session seams for WDK (mock repository) - auto-lock, edge-to-edge config

- RepositoriesProvider DI boundary (mock now, WDK-ready) - QueryClient + typed query hooks + centralized keys - loading/error/retry states on all data screens - screens no longer import concrete repositories

- add WdkAppProvider at root with minimal Bitcoin wdkConfigs - import generated worklet bundle - log useWdkApp lifecycle (INITIALIZING -> NO_WALLET confirmed) - no screen/behaviour change; still on mock repository

- Replace mock data with live WDK hooks (balances, account, send) - Wire wallet create/import/unlock via useWalletManager - Add session/lock handling: WdkSessionGate + AutoLockOnBackground - Fix locked-vs-no-wallet detection (lock() reports NO_WALLET, not LOCKED; disambiguate via persisted wallets list) Verified on device: create → real balance/address → lock → unlock.

…which is encrypted first with the help of wdk-utils and then we are storing it to secure storage

…both platform

… icon on wallet and receive screen

…ve acccounts get listed in accounts screen

socket-security · 2026-07-30T06:14:53Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Quality	Maintenance
	@buildonspark/spark-frost-bare-addon@0.0.12
	@tetherto/wdk-pricing-coingecko-http@1.0.0-beta.1
	expo-router@6.0.12 ⏵ 55.0.17		⁺¹	⁺¹
	expo-status-bar@3.0.8 ⏵ 55.0.6			⁺¹
	expo-splash-screen@31.0.10 ⏵ 55.0.23	⁺¹
	expo-system-ui@6.0.7 ⏵ 55.0.20	⁺¹	⁺¹
	babel-preset-expo@54.0.4 ⏵ 55.0.24	⁺¹		⁺¹
	@react-navigation/native@7.1.18 ⏵ 7.3.13			⁺¹
	react-native-bare-kit@0.10.2 ⏵ 0.14.5	⁺¹		^-2
	@tetherto/wdk-wallet-spark@1.0.0-beta.22
	@ledgerhq/ledger-bitcoin@0.3.1
	@tetherto/wdk-wallet-evm-7702-gasless@1.0.0-beta.2
	expo-constants@18.0.9 ⏵ 55.0.17	⁺¹	⁺¹	⁺¹
	@tetherto/wdk-wallet-btc@1.0.0-beta.11
	expo-linking@8.0.8 ⏵ 55.0.16	⁺¹	⁺¹
	expo-clipboard@8.0.7 ⏵ 55.0.15		⁺¹
	expo@54.0.13 ⏵ 55.0.28		⁺¹	⁺¹
	@expo/config-plugins@54.0.2 ⏵ 55.0.11			⁺¹
	expo-build-properties@1.0.9 ⏵ 55.0.16		⁺¹	⁺¹
	@tetherto/wdk-utils@1.0.0-beta.10
	@tetherto/wdk@1.0.0-beta.14
	react-native-safe-area-context@5.6.1 ⏵ 5.6.2
	@tetherto/wdk-react-native-core@1.0.0-beta.14
	@types/react@19.1.17 ⏵ 19.2.17	⁺¹		^-2
	prettier-config-standard@7.0.0
	react-native-get-random-values@1.11.0 ⏵ 2.0.0	⁺¹	⁺¹
	react-native-gesture-handler@2.28.0 ⏵ 2.30.1	⁺¹	⁺¹
	lucide-react-native@1.26.0
	babel-plugin-module-resolver@5.0.3
	@react-native-google-signin/google-signin@16.1.2
	expo-navigation-bar@55.0.15
	utf-8-validate@5.0.10 ⏵ 6.0.6	⁺¹	⁺¹
	react-native-worklets@0.5.1 ⏵ 0.7.4		⁺¹	⁺¹
See 18 more rows in the dashboard

View full report

socket-security · 2026-07-30T06:14:54Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@expo/cli` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/expo@55.0.28` → `npm/@expo/cli@55.0.34` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@expo/cli@55.0.34`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@protobufjs/float` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@tetherto/wdk-wallet-spark@1.0.0-beta.22` → `npm/@protobufjs/float@1.0.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@protobufjs/float@1.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@react-native/debugger-frontend` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/expo@55.0.28` → `npm/@react-native/debugger-frontend@0.83.10` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native/debugger-frontend@0.83.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@react-native/debugger-frontend` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/react-native@0.83.6` → `npm/@react-native/debugger-frontend@0.83.6` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native/debugger-frontend@0.83.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning CVE: GHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning (HIGH) Affected versions: >= 0.31.1 < 0.33.0; >= 1.15.2 < 1.18.0 Patched version: 1.18.0 From: package-lock.json → `npm/@tetherto/wdk-pricing-coingecko-http@1.0.0-beta.1` → `npm/axios@1.16.0` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/axios@1.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `node-forge` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/expo@55.0.28` → `npm/node-forge@1.4.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-forge@1.4.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `react-native` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/react-native@0.83.6` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/react-native@0.83.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `yargs` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/react-native@0.83.6` → `npm/@tetherto/wdk-wallet-spark@1.0.0-beta.22` → `npm/expo@55.0.28` → `npm/babel-preset-expo@55.0.24` → `npm/yargs@17.7.3` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/yargs@17.7.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm `@expo/log-box` Eval Type: eval Location: Package overview From: package-lock.json → `npm/expo-router@55.0.17` → `npm/expo@55.0.28` → `npm/@expo/log-box@55.0.13` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@expo/log-box@55.0.13`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm `@expo/require-utils` in module node:child_process Module: node:child_process Location: Package overview From: package-lock.json → `npm/expo-splash-screen@55.0.23` → `npm/expo@55.0.28` → `npm/@expo/require-utils@55.0.6` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@expo/require-utils@55.0.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm `@lightsparkdev/core` Eval Type: Function Location: Package overview From: package-lock.json → `npm/@tetherto/wdk-wallet-spark@1.0.0-beta.22` → `npm/@lightsparkdev/core@1.5.2` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@lightsparkdev/core@1.5.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm `@protobufjs/codegen` Eval Type: Function Location: Package overview From: package-lock.json → `npm/@tetherto/wdk-wallet-spark@1.0.0-beta.22` → `npm/@protobufjs/codegen@2.0.5` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@protobufjs/codegen@2.0.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm `@react-native/debugger-frontend` Eval Type: eval Location: Package overview From: package-lock.json → `npm/expo@55.0.28` → `npm/@react-native/debugger-frontend@0.83.10` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native/debugger-frontend@0.83.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm `@react-native/debugger-frontend` Eval Type: execScript Location: Package overview From: package-lock.json → `npm/expo@55.0.28` → `npm/@react-native/debugger-frontend@0.83.10` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native/debugger-frontend@0.83.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm `@react-native/debugger-frontend` Eval Type: setTimeout Location: Package overview From: package-lock.json → `npm/expo@55.0.28` → `npm/@react-native/debugger-frontend@0.83.10` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native/debugger-frontend@0.83.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm `@react-native/debugger-frontend` Eval Type: Function Location: Package overview From: package-lock.json → `npm/expo@55.0.28` → `npm/@react-native/debugger-frontend@0.83.10` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native/debugger-frontend@0.83.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm `@react-native/dev-middleware` in module child_process Module: child_process Location: Package overview From: package-lock.json → `npm/expo@55.0.28` → `npm/@react-native/dev-middleware@0.83.10` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native/dev-middleware@0.83.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm `bare-repl` Eval Type: eval Location: Package overview From: package-lock.json → `npm/bare-node-runtime@1.5.0` → `npm/@tetherto/wdk-wallet-evm-7702-gasless@1.0.0-beta.2` → `npm/bare-repl@6.1.1` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/bare-repl@6.1.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm `lodash.camelcase` Eval Type: Function Location: Package overview From: package-lock.json → `npm/@tetherto/wdk-wallet-spark@1.0.0-beta.22` → `npm/lodash.camelcase@4.3.0` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/lodash.camelcase@4.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm `lodash.memoize` Eval Type: Function Location: Package overview From: package-lock.json → `npm/@ledgerhq/ledger-bitcoin@0.3.1` → `npm/@tetherto/wdk-wallet-btc@1.0.0-beta.11` → `npm/lodash.memoize@4.1.2` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/lodash.memoize@4.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Install-time scripts: npm `protobufjs` during postinstall Install script: postinstall Source: `node scripts/postinstall` From: package-lock.json → `npm/@tetherto/wdk-wallet-spark@1.0.0-beta.22` → `npm/protobufjs@7.6.5` ℹ Read more on: This package \| This alert \| What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/protobufjs@7.6.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Deprecated by its maintainer: npm `text-encoding` with reason "no longer maintained" Reason: no longer maintained From: package-lock.json → `npm/react-native-qrcode-svg@6.3.21` → `npm/text-encoding@0.7.0` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/text-encoding@0.7.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

jonathunne · 2026-07-30T15:08:19Z

+          "CloudKit"
+        ],
+        "com.apple.developer.icloud-container-identifiers": [
+          "iCloud.io.tether.wdkshowcase"


CloudKit container here is iCloud.io.tether.wdkshowcase, but docs / .env.example use iCloud.io.tether.wdkstarterreactnative. Please align these.

jonathunne · 2026-07-30T15:08:19Z

+ *
+ * ⚠️ Arbitrum and Polygon below point at REAL MAINNET — genuine funds and
+ * real Pimlico gas-sponsorship costs apply there. Only Ethereum (Sepolia)
+ * is a safe-to-experiment-freely testnet in this configuration.


Testnets and mainnets are easy to confuse here: ethereum is Sepolia in .env/explorers/indexer but labeled “Ethereum” in the UI; BTC uses network: 'bitcoin' (mainnet bc1… addresses) with a testnet Blockbook default and testnet explorers; Arb/Polygon are real mainnet. Please make network identity explicit end-to-end (config + labels + provider + explorers) so forks can tell testnet from real funds.

jonathunne · 2026-07-30T15:08:19Z

+      package: '@tetherto/wdk-wallet-btc'
+    },
+    spark: {
+      package: '@tetherto/wdk-wallet-spark'


Spark is in the worklet but not in runtime config/UI. Docs say Bitcoin needs it — wdk-wallet-btc doesn’t, and the bundle builds without it. Drop it or document why it stays.

jonathunne

Overall looks really fantastic! Aside from the comments I left in-line, I wanted to flag a few places where it looks like we can trim out some dead code. These were picked up by. a clanker, so verify carefully!

The docs already admit src/data/ is obsolete (an earlier mock/WDK seam from before screens talked to WDK directly). It’s still in the tree?
src/data/** — no screen under src/app/ imports @/data; RepositoriesProvider is never mounted.
AccountsHydrator — not mounted, and it calls hydrate() on a store that no longer has it (accounts were deliberately made in-memory-only after the iOS Keychain-survives-uninstall bug).
src/state/session.ts — unused; real session routing is useWdkSession / WdkSessionGate. ARCHITECTURE.md still lists it with the live stores - please fix that when deleting.
TokenIcon — exported but unused; every screen uses AssetIcon. Two icon components is one too many for a starter surface.

… Receive/Accounts/Activity fixes

Nirmal Patidar added 30 commits July 7, 2026 19:13

Merge branch 'feature/project-setup' into develop

e2c0714

refactor: DI repositories provider + TanStack Query data layer

59e9ef8

- RepositoriesProvider DI boundary (mock now, WDK-ready) - QueryClient + typed query hooks + centralized keys - loading/error/retry states on all data screens - screens no longer import concrete repositories

Merge branch 'feature/Implement-Repository-Query-Provider' into develop

eb85c76

Updated gitignore

1b67c0d

feat(wdk): initialize WdkAppProvider + worklet runtime

35e3f6a

- add WdkAppProvider at root with minimal Bitcoin wdkConfigs - import generated worklet bundle - log useWdkApp lifecycle (INITIALIZING -> NO_WALLET confirmed) - no screen/behaviour change; still on mock repository

Created Welcome Screen UI

8c73fe9

Merge branch 'feature/Add-WDK-SDK-Stack' into develop

9a49e65

Integrated Recovery Phrase Hidden Screen with 12 and 24 words option

5c13c7e

Integrated Recovery Phrase Revealed Screen with 12 and 24 words option

5226582

Merge branch 'feature/Recovery-Phrase-Screen' into develop

597bcfe

Integrated Password setup and Unlock screen, This is an app passowrd …

ad73f69

…which is encrypted first with the help of wdk-utils and then we are storing it to secure storage

Merge branch 'feature/create-password-screen' into develop

b6aefe8

Created backup your wallet screen

e18280b

Integrated cloud backup flow with icloud and google drive options on …

2dae9da

…both platform

Merge branch 'feature/cloud-backup-flow' into develop

1dd3302

Integrated Import Wallet Flow

ec03f15

Merge branch 'feature/import-wallet-flow' into develop

83f54d0

added readme and other required documents

bc8d0aa

updated .env.example file

6f64e80

Home Screen Wallet Tab UI Completed with real api and functionality

919791f

Integrated Receive Screen

535ae9b

Implemented multiple account functionality, showing chains and tokens…

0be6e62

… icon on wallet and receive screen

Merge branch 'feature/home-screen' into develop

b6da314

Implemented Send - Amount Screen

20f1064

Implemented send-confimration and send-success screen with live services

dd54b69

Fixed automatically account listing on import of wallet- now all acti…

8b28309

…ve acccounts get listed in accounts screen

Merge branch 'feature/home-screen' into develop

2ed8859

Implemented Activity Tab

79faf0c

Merge branch 'feature/home-screen' into develop

4292963

jonathunne reviewed Jul 30, 2026

View reviewed changes

jonathunne requested changes Jul 30, 2026

View reviewed changes

Nirmal Patidar added 2 commits July 31, 2026 17:49

Address PR review feedback: disabled-state styling, network labeling,…

49a5f8f

… Receive/Accounts/Activity fixes

Merge branch 'fix/pr-review-changes' into develop

60cfdac

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Do Not Merge]: New WDK Starter RN App - #38

[Do Not Merge]: New WDK Starter RN App#38
NirmalPatidar wants to merge 33 commits into
tetherto:mainfrom
NirmalPatidar:develop

NirmalPatidar commented Jul 22, 2026

Uh oh!

socket-security Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

jonathunne Jul 30, 2026 •

edited

Loading

Uh oh!

jonathunne Jul 30, 2026 •

edited

Loading

Uh oh!

jonathunne Jul 30, 2026 •

edited

Loading

Uh oh!

jonathunne left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

NirmalPatidar commented Jul 22, 2026

Summary

What's included

WDK integration (Steps 1–5)

Onboarding screens (prototype-matched)

Security

Cloud backup

Responsive design system

Documentation

Testing done

Known limitations (not in scope for this PR)

How to test this PR

Uh oh!

socket-security Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jonathunne Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jonathunne Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jonathunne Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jonathunne left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

socket-security Bot commented Jul 30, 2026 •

edited

Loading

socket-security Bot commented Jul 30, 2026 •

edited

Loading

jonathunne Jul 30, 2026 •

edited

Loading

jonathunne Jul 30, 2026 •

edited

Loading

jonathunne Jul 30, 2026 •

edited

Loading