BoldWallet - Moses Yebei

The Problem

BoldWallet is a Bitcoin wallet using threshold signatures (TSS) that eliminates seed phrases, but the codebase has structural issues that increase maintenance risk and introduce security vulnerabilities. The repository contains 351 files with identifiable import cycles, oversized files, and a committed private key that must be rotated.

What This Does

BoldWallet implements a seedless Bitcoin wallet using Threshold Signatures (2-of-2 or 2-of-3) across mobile devices. Key files and their responsibilities:

BBMTLib/tss/mpc.go - 27 functions, defines SessionState, ClearSessionLog, SessionLog, stringJoin, getStatus; called from 6 files, makes outbound network calls
BBMTLib/tss/btc.go - 26 functions, defines fee APIs, network settings; called from 4 files, makes network calls
BBMTLib/tss/psbt.go - 9 functions, defines MpcSignPSBT, validateSignedPSBT, truncateHex; called from 2 files
BBMTLib/tss/nostrtransport/client.go - 6 functions, defines Nostr communication; called from 11 files
App.tsx - React entry point, connects 26 modules with instability 0.87
services/LocalCache.ts - 15 dependents, participates in circular import with utils.js

The execution flow starts at main in BBMTLib/scripts/main.go:24, which reaches 110 functions. Send in BBMTLib/tss/cmd/nostr-keygen/main.go:281 reaches 26 functions and makes outbound network calls via http.Post. Paths from entry to external effects: main -> loadAndDecryptKeyshare [filesystem via os.ReadFile]; Send [network via http.Post]; estimateFee -> EstimateFees -> FetchUTXOs [network via http.Get].

How It Is Wired

The internal call graph has 470 resolved call edges. Most connected functions: Logln called from 35 places, Logf from 27, Close from 23. The most distinct caller edges: runNostrMpcSignPSBTInternal -> Logf x53, MpcSendBTC -> Logf x50, MpcSignPSBT -> Logf x50.

Critical structural issues:

Import cycle: utils.js and services/LocalCache.ts mutually import each other (instability 0.03/0.06)
Hub modules: utils.js (32 importers), theme/index.ts (26 importers), services/LocalCache.ts (15 importers) - changes ripple widely
Oversized files: components/Styles.tsx, services/WalletService.ts, screens/PSBTModal.tsx (1960 lines each)
Deep nesting: screens/PSBTModal.tsx, components/KeyshareModal.tsx, components/TransportModeSelector.tsx (max indentation depth 8)
Duplicated code: 2000 repeated 6-line blocks across 70 files including BBMTLib/scripts/keygen.sh, keysign.sh, spend-bitcoin.sh

How To Use It

Setup: This is a React Native + Rails + Go project. Build the Android APK via Docker using the Dockerfile at the root; scripts are in docker/scripts/ with documentation in docker/README.md. iOS builds follow React-Native guidelines.

Configuration: No environment variables are documented in the repo structure. The committed android/app/debug.keystore contains a private key that must be reissued and purged from history.

Running it:

CLI entry: BBMTLib/scripts/main.go - the main Go entry point
Keygen: BBMTLib/tss/cmd/nostr-keygen/main.go
Keysign: BBMTLib/tss/cmd/nostr-keysign/main.go
Spend: BBMTLib/tss/cmd/bold-spend/main.go

Real-World Use

A user installs the app and pairs up to 3 devices. To send Bitcoin, the wallet creates a PSBT, which is then signed using threshold signatures across the paired devices via the Nostr or local WiFi protocol. The signed transaction is broadcast to Mempool.space (or a self-hosted instance). No seed phrase is ever generated; key material is split across devices using TSS.

Code Health & Issues

findings from static analysis (65 total: 24 high, 41 medium, 0 low):

CRITICAL - Rotate and purge the committed private key: android/app/debug.keystore - A published signing key cannot be unpublished; it lets anyone impersonate the service or decrypt captured traffic. Fix: reissue the key pair and purge from history.
HIGH - Pin third-party GitHub Actions to commit SHA: .github/workflows - codecov/codecov-action@v4 can be moved; fix: replace @vN with 40-char commit SHA.
HIGH - Remove continue-on-error from correctness-gating steps: .github/workflows/bbmtlib-test.yml line 66 - a failing test suite reports green check.
MEDIUM - Declare least-privilege GITHUB_TOKEN permissions in workflows
MEDIUM - Enable Dependabot or Renovate: 3 manifest(s), no update bot configured
MEDIUM - Gate pull requests on dependency vulnerability scan: no scan in CI
MEDIUM - Add pre-commit secret gate: no repo-level gate visible
MEDIUM - Move large binaries to Git LFS: ios/Tss.xcframework/ carries 6 blobs over 5MB (Tss 77.7MB, tss.aar 46.7MB)
MEDIUM - Set persist-credentials: false on checkout: .github/workflows/bbmtlib-test.yml
MEDIUM - Expand test suite: 1 test file against 84 source files (ratio 0.012)

Additionally, the measured analysis found 2 modules in circular dependencies, 3 hub modules with high blast radius, 18 oversized files, 27 files with deep nesting, and duplicated 6-line blocks across 70 scripts.

The Bottom Line

BoldWallet is a technically ambitious seedless Bitcoin wallet with a functional TSS implementation across mobile devices. The codebase is functional but has significant structural debt: a committed private key, import cycles, oversized and deeply nested files, and duplicated logic across 70 scripts. The CI pipeline has gates that can report success even when tests fail. This is suitable for technical teams who can address the critical key rotation and CI fixes, but requires commitment to refactor the circular dependencies and file size issues before it's maintainable for broader teams.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

351 files

TSX33
Go24
Shell21
C/C++ Header14
TypeScript11
Markdown10

ReactExpressRailsDocker

Architecture

Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.

graph TD g0["components 17 modules"] g1["screens 11 modules"] g2["(root) 10 modules"] g3["theme 5 modules"] g4["context 3 modules"] g5["types 3 modules"] g6["services 2 modules"] g1 -->|21| g0 g0 -->|14| g2 g0 -->|14| g3 g1 -->|12| g6 g1 -->|11| g3 g1 -->|11| g2 g2 -->|7| g1 g1 -->|4| g4 g0 -->|3| g6 g4 -->|3| g6 g4 -->|3| g2 g2 -->|2| g4

Module dependencies

The 10 most depended-upon modules of 53, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_utils["utils"] n1_theme_index["index"] n2_services_LocalCache["LocalCache"] n3_components_Styles["Styles"] n4_services_WalletService["WalletService"] n5_context_UserContext["UserContext"] n6_components_QRScanner["QRScanner"] n7_theme_types["types"] n8_components_Header["Header"] n9_components_QRCodeModal["QRCodeModal"] n8_components_Header --> n1_theme_index n8_components_Header --> n3_components_Styles n8_components_Header --> n0_utils n9_components_QRCodeModal --> n0_utils n9_components_QRCodeModal --> n1_theme_index n9_components_QRCodeModal --> n3_components_Styles n6_components_QRScanner --> n1_theme_index n6_components_QRScanner --> n0_utils n5_context_UserContext --> n2_services_LocalCache n5_context_UserContext --> n0_utils n2_services_LocalCache --> n0_utils n4_services_WalletService --> n0_utils n4_services_WalletService --> n2_services_LocalCache n1_theme_index --> n7_theme_types n0_utils --> n2_services_LocalCache classDef cyc stroke:#ef4444,stroke-width:2px; class n0_utils,n2_services_LocalCache cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical1

high2

medium7

low1

Rotate and purge the committed private keycritical

android/app/debug.keystore

A published signing or TLS private key cannot be unpublished, and it lets anyone impersonate the service or decrypt captured traffic.

Fix: Reissue the key pair, then purge the blob from history; deleting it in a later commit is not enough.

Pin third-party GitHub Actions to a commit SHAhigh

.github/workflows

codecov/codecov-action@v4

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Remove continue-on-error from steps that gate correctnesshigh

.github/workflows/bbmtlib-test.yml

line 66 on a correctness step

A failing test suite reports a green check, which is precisely the path this audit exists to close.

Fix: Delete continue-on-error, or move a genuinely advisory step into a separate non-required job.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/bbmtlib-test.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

3 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Add a pre-commit secret gatemedium

a secret-shaped file is tracked and no repo-level gate is visible

Without a gate the same class of leak recurs on the next commit, so a leak finding is the symptom and this is the cause.

Fix: Add a pre-commit hook scanning staged content, and enable push protection.

Move large binaries to Git LFS or out of the repositorymedium6 occurrences

ios/Tss.xcframework/ios-arm64_x86_64-simulator/Tss.framework/Tss

6 blobs over 5MB: Tss 77.7MB, Tss 77.4MB, tss.aar 46.7MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/bbmtlib-test.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Expand the test suite; it cannot cover this codebasemedium

1 test files against 84 source files (ratio 0.012)

A reviewer reads "has tests" and assumes a safety net that covers two files out of eighty-five, which is how untested paths ship behind a green badge.

Fix: Add tests for the highest fan-in modules first.

Set timeout-minutes on the workflow jobslow

.github/workflows/bbmtlib-test.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.