Verify a decision

{"actor":"system:backfill","investigation_id":"14198b35-00d8-4e36-aa92-547b227094a9","kind":"publish","page_slug":"ywallet","published_at":"2026-10-13T05:40:05.058Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"YWallet","sections":[{"content":"The source repository (hhanh00/zwallet) is described as a 'Zcash and Ycash light shielded wallet', licensed under MIT, and owned by the individual account hhanh00; no other maintainers or contributors were listed on the repository page as captured. The README states that YWallet 'does no longer support Zcash since the Ironwood update', that Ycash remains supported, that the app will receive only security and protocol fixes ('it will not get more features'), and names a successor wallet, zkool2, by the same author. The author's stated reason is that it became too difficult to maintain feature parity between Ycash and Zcash. The documentation site's front page still describes YWallet as 'the most advanced and fastest Crypto Wallet for Zcash and Ycash' and names no maintainers or organization, so the marketing description appears out of date relative to the README. The real-world identity of the maintainer was not independently verified in this research.","heading":"Maintainers and project status","severity":"medium","sources":[{"credibility":2,"name":"hhanh00/zwallet GitHub repository","type":"official","url":"https://github.com/hhanh00/zwallet"},{"credibility":2,"name":"zwallet README (raw)","type":"official","url":"https://raw.githubusercontent.com/hhanh00/zwallet/main/README.md"},{"credibility":2,"name":"YWallet documentation site","type":"official","url":"https://ywallet.app"}]},{"content":"The code is public under the MIT license. Defuse Security (ZecSec, funded under the Zcash Ecosystem Security grant) reviewed YWallet for security and privacy issues in October 2022 and published the final report on January 3, 2023. The post reports one high-severity issue, two medium-severity and several low-severity issues, and states that all were remediated or deemed safe to deprioritize. The high-severity issue involved contact lists stored in transaction memos and was mitigated by accepting contact list updates only from memos in transactions signed by the same wallet. No later independent audit of YWallet was found, so changes after 2022 (including any Ycash-only or post-Ironwood changes) are not covered by any audit located.","heading":"Source code and security audit","severity":"medium","sources":[{"credibility":2,"name":"ZecSec: ywallet audit published","type":"research","url":"https://defuse.ca/zecsec/ywallet-audit-published.htm"}]},{"content":"Store and Flathub listings describe support for shielded transactions, Warp Sync fast syncing, multiple accounts, 24-word BIP-39 backups, viewing-key import/export, coin control and cold-wallet modes. The README claims Warp Sync processes roughly 10,000 blocks per second on one tested phone and that the wallet is 'currently the fastest by far'; these are the developer's own claims and no independent benchmark was found. The Zcash network later activated the Ironwood shielded pool (NU6.3) after a soundness bug was found in the Orchard pool; per press reports there was no evidence of exploitation, and funds in Orchard must pass through a turnstile to enter Ironwood. Because YWallet states it does not support Zcash after Ironwood, Zcash users holding Orchard funds would need to use a different wallet (the developer points to zkool2); the migration path was not independently tested here.","heading":"Handling of shielded funds and performance claims","severity":"medium","sources":[{"credibility":2,"name":"Flathub: YWallet","type":"official","url":"https://flathub.org/apps/details/app.ywallet.Ywallet"},{"credibility":2,"name":"App Store listing: YWallet","type":"official","url":"https://apps.apple.com/mx/app/ywallet/id1583859229"},{"credibility":2,"name":"zwallet README (raw)","type":"official","url":"https://raw.githubusercontent.com/hhanh00/zwallet/main/README.md"},{"credibility":2,"name":"The Block: Zcash activates Ironwood upgrade","type":"news_article","url":"https://theblock.co/post/409934/zcash-ironwood-upgrade-launching-new-shielded-pool-after-orchard-vulnerability"},{"credibility":2,"name":"Zodl: Moving your funds to Ironwood","type":"official","url":"https://support.zodl.com/article/42-moving-your-funds-to-ironwood"}]},{"content":"Searches for YWallet vulnerabilities, scams, hacks or fund losses returned no incident reports specific to YWallet. Related ecosystem-level events exist but do not name YWallet: Decrypt reported a critical Orchard-pool counterfeiting vulnerability in Zcash, fixed by an emergency patch in June 2026, with no definitive way to determine from cryptography alone whether it was exploited. Absence of reports is not evidence of safety, and coverage of this niche wallet is sparse.","heading":"Incidents","severity":"low","sources":[{"credibility":2,"name":"Decrypt: ZEC crashes as Zcash discloses critical counterfeiting vulnerability","type":"news_article","url":"https://decrypt.co/370105/zec-crashes-38-as-zcash-discloses-critical-counterfeiting-vulnerability"},{"credibility":2,"name":"Decrypt: Zcash Activates Ironwood Upgrade After Counterfeiting Scare","type":"news_article","url":"https://decrypt.co/374577"}]},{"content":"Little about YWallet is independently verifiable. No release dates, contributor lists, user counts, or independent performance tests were confirmed, and the maintainer is identified only by a GitHub handle. The figures supplied with the request were not re-verified against a primary source beyond those cited above.","heading":"Limits of available information","severity":"low","sources":[{"credibility":2,"name":"hhanh00/zwallet GitHub repository","type":"official","url":"https://github.com/hhanh00/zwallet"}]}],"sources_used":[{"credibility":2,"name":"hhanh00/zwallet GitHub repository","type":"official","url":"https://github.com/hhanh00/zwallet"},{"credibility":2,"name":"zwallet README (raw)","type":"official","url":"https://raw.githubusercontent.com/hhanh00/zwallet/main/README.md"},{"credibility":2,"name":"YWallet documentation site","type":"official","url":"https://ywallet.app"},{"credibility":2,"name":"ZecSec: ywallet audit published","type":"research","url":"https://defuse.ca/zecsec/ywallet-audit-published.htm"},{"credibility":2,"name":"Flathub: YWallet","type":"official","url":"https://flathub.org/apps/details/app.ywallet.Ywallet"},{"credibility":2,"name":"App Store listing: YWallet","type":"official","url":"https://apps.apple.com/mx/app/ywallet/id1583859229"},{"credibility":2,"name":"The Block: Zcash activates Ironwood upgrade","type":"news_article","url":"https://theblock.co/post/409934/zcash-ironwood-upgrade-launching-new-shielded-pool-after-orchard-vulnerability"},{"credibility":2,"name":"Zodl: Moving your funds to Ironwood","type":"official","url":"https://support.zodl.com/article/42-moving-your-funds-to-ironwood"},{"credibility":2,"name":"Decrypt: ZEC crashes as Zcash discloses critical counterfeiting vulnerability","type":"news_article","url":"https://decrypt.co/370105/zec-crashes-38-as-zcash-discloses-critical-counterfeiting-vulnerability"},{"credibility":2,"name":"Decrypt: Zcash Activates Ironwood Upgrade After Counterfeiting Scare","type":"news_article","url":"https://decrypt.co/374577"}],"summary":"YWallet is an open-source (MIT) light wallet for Zcash and Ycash that describes itself as the 'most advanced and fastest' wallet for both coins. Its public repository is held by a single individual account (hhanh00), it received a third-party security audit published in January 2023, and its README now states it no longer supports Zcash since the Ironwood update and is in maintenance mode. No incidents specific to YWallet were found; independent verification is limited, and the project's own claims are not independently benchmarked.","timeline":[{"date":"2022-10","event":"Defuse Security reviews YWallet for security and privacy issues","source":"ZecSec","source_url":"https://defuse.ca/zecsec/ywallet-audit-published.htm"},{"date":"2023-01-03","date_evidence":"January 3, 2023","event":"Final YWallet audit report published; one high, two medium and several low issues reported as remediated or deprioritized","source":"ZecSec","source_url":"https://defuse.ca/zecsec/ywallet-audit-published.htm"},{"date":"2026-06","event":"Emergency fix deployed for Orchard-pool soundness vulnerability in Zcash","source":"Decrypt","source_url":"https://decrypt.co/370105/zec-crashes-38-as-zcash-discloses-critical-counterfeiting-vulnerability"},{"date":"2026","event":"Zcash activates Ironwood pool (NU6.3); YWallet README states Zcash support ended and the app is in maintenance mode","source":"The Block / zwallet README","source_url":"https://theblock.co/post/409934/zcash-ironwood-upgrade-launching-new-shielded-pool-after-orchard-vulnerability"}]},"v":1}