Wallet and investment apps protect sensitive client-side flows by separating three things and defending each one: where keys are held, where a transaction is built and shown to the user, and where your backend authorises it. Otukan protects the first two on the phone and gives the third trustworthy evidence. It hardens code and storage around local key material, detects hooking that rewrites a transfer after the user checks it, shields recovery phrase screens and proves to your servers that requests come from your genuine app. Custody design, protocol safety and market risk sit with other controls. Android and iOS scope is stated per control.
Asset boundaries in a wallet app
Every wallet or trading app has the same three boundaries, even when the architectures differ. Knowing which one an attack crosses tells you which control must stop it.
| Boundary | What lives there | Typical attack | Otukan control |
|---|---|---|---|
| Key custody | Private keys, seed phrases, session keys, API tokens | Extraction from storage, memory or screen | Secrets protection, runtime checks, screen capture protection |
| Transaction preparation | Destination, amount, fees, order details shown for approval | Instrumentation that rewrites the transaction after review | Hooking detection, integrity checks |
| Backend authorisation | Withdrawal approval, order execution, limits | Scripts and cloned clients calling your APIs | Attestation, device binding |
Self-custody and custodial models
In a self-custody wallet the phone holds the keys, so the first boundary carries the most weight. In a custodial exchange or brokerage app, keys sit with your service and the third boundary becomes decisive, because whoever convinces your backend controls the funds. Many products mix the two. Otukan sets its controls to match your model rather than a generic checklist. For key handling in detail, see secrets and key protection.
Threat model: hooking, screen capture and modified clients
Hooking
Instrumentation frameworks let an attacker change what a running app does without changing its file on disk. In a wallet, the classic target is the moment between display and signature: the user approves one address and the hooked function signs another. Otukan detects these frameworks and the hooks they place, stops signing or submission in that session and tells your backend. For how detection works, see hooking detection.
Screen capture
A recovery phrase shown on screen is a key in plain sight. Malicious apps, screen recording and mirroring can all copy it. Android allows an app to mark a screen as secure, which blocks screenshots and screen recording of it. iOS offers apps no supported way to block screenshots, so Otukan detects recording and mirroring, hides the phrase while capture is active and reacts to screenshots. The two platforms get different controls because they offer different tools.
Modified clients
A repackaged wallet looks like yours, carries your name and quietly sends keys or funds elsewhere. Integrity checks inside the app notice a foreign signing certificate or altered code. More importantly, a modified copy fails attestation, so your servers refuse it. Play Integrity and App Attest each supply that proof on their own terms. For the server side, see app attestation.
What app protection covers, and what it leaves to others
Clear limits make a stronger security case, not a weaker one. Otukan protects the mobile client and the evidence it sends. It does not decide custody arrangements, and it does not replace audits of contracts or protocols. It also makes no statement about asset value or investment returns.
- App protection (Otukan). Hardened code, protected local key material, detection of hooking, debugging, emulation, root and jailbreak, capture protection on sensitive screens, and attestation for your backend.
- Custody and key management (your architecture). Where keys are generated, stored, backed up and recovered, and who can sign.
- Protocol and contract security (your engineering and auditors). The correctness of on-chain logic and the networks you connect to.
- Investment and market outcomes (your business). Prices, liquidity and returns, which no security control addresses.
That split gives your risk review, your auditors and your users a precise answer to “which control owns this risk”.
Otukan’s full set of application controls is listed on mobile app security. A wallet already live in the stores can get a free App Exposure Check of its public build.