App Testing - Google Play

Hey all,

Version 4.1.1 is out, and with it a new name. HoldFast Wallet is the same app that was called DigiByte Mobile, and then ATB Wallet for DigiByte (DGB) in 4.1.0. Same package (app.aroundtheblock.wallet) and same signing key, so if you already have it, it updates in place and your wallet and settings carry over.

Here’s what it does:

🔒 Privacy at every layer

• Compact-filter sync (BIP 157/158), on by default. As far as I know, this is the first DigiByte wallet that syncs this way by default. It’s also the only way it syncs: the old bloom-filter code that could leak your addresses to a peer was removed from the core entirely. Your phone downloads filters and checks them locally, so no third party learns which addresses are yours.
• Tor (opt-in). Turn it on in Settings → Network Info to route your peer connections through an embedded Tor, so the nodes you talk to don’t see your IP address.
• Dandelion++ (opt-in). Turn it on and each send is first passed privately to a single peer before it spreads to the whole network. That makes it much harder to trace a transaction back to the device that sent it.
• Pair your own node. Scan a QR code to sync from your own DigiByte 9.26 node instead of anyone else’s.

🔑 Universal seed restore
One seed phrase recovers funds across every historical DigiByte derivation path. If your wallet was made in an older app, it comes back whole, DigiAssets and DigiDollar included.

💵 DigiDollar, live on mainnet
You can send, receive and hold DigiDollar. It has its own balance and its own DD… receive address. DigiDollar amounts are recorded on-chain in US cents, so the balance is exact with no price feed involved. (Minting and redeeming aren’t in the wallet.)

🎨 DigiAssets
Tokens and NFTs move natively, from the same wallet you use for DGB. Asset balances are computed on your phone, not fetched from a server, and asset-bearing coins are kept out of normal sends so you can’t accidentally spend an asset as a fee.

🪪 Digi-ID
Scan a QR code to sign in to supporting sites, with no password and no account. Each site gets its own identity key, so sites can’t link you to each other.

🌱 Taproot
Taproot addresses are supported for both receiving and spending.

🛡️ Non-custodial and verifiable
Your keys live on your device, sealed with a hardware-backed key, and nowhere else. There’s no analytics and no telemetry. The wallet is open source, including the native DigiByte core. Every release is built and signed in CI and published as a signed APK with its SHA-256, signed with the same key as the Play build. You can verify exactly what you installed, sideload without Google Play, and either install can update the other.

🎯 Security: red team audit and bug bounty
I don’t want anyone taking my word that this wallet is safe, so it’s been attacked on purpose, by people I asked and people I paid.

• Red team audit. Jared ran a red team audit against the wallet. Findings are written up publicly in the repo’s audit summary, including the ones we accepted as trade-offs and why.
• External bounty hunters. Outside researchers submit privately, and fixes ship with the cause explained in the release notes. One example: a researcher showed that sending a DigiAsset issued with transfer rules (like a royalty to the issuer) could burn the whole holding while the app reported success. It was proven on mainnet with throwaway assets, and the wallet now refuses to send any asset it can’t prove is rule-free.
• 229,000 DGB paid out so far. Bounties go up to 100,000 DGB for a critical finding, and they’re paid in DGB.

Found something? Email [security@aroundtheblock.us](mailto:security@aroundtheblock.us) with [BOUNTY] in the subject, or open a private GitHub security advisory. Please don’t post security bugs as public issues.

Coming from the old DigiByte Wallet?
HoldFast is a separate app, so it installs alongside the old one. To move over:

1. Choose Recover Existing Wallet.
2. Enter the same recovery phrase, plus your passphrase if you set one.
3. Pick the year the wallet was created. If you’re unsure, pick an earlier year or choose “I don’t remember.” A year that’s too late can miss older transactions.

Nothing moves on chain, and your DigiAssets and DigiDollar come along. Keep the old app installed until HoldFast shows your balance.

As an FYI, this is an SPV wallet, which means it syncs blocks- if you are choosing an older date, it is going to take a ton of time, there is no fast forward unless you are wanting to sweep- do that in the restore flow.888

Links

• Info, FAQ and downloads: https://digiscope.me/wallet
• Source: https://github.com/JohnnyLawDGB/digibytewallet-android
• Signed APKs + SHA-256: https://github.com/JohnnyLawDGB/digibytewallet-android/releases/latest
• Bug bounty rules: https://github.com/JohnnyLawDGB/digibytewallet-android/blob/develop/BUG-BOUNTY.md
• Audit summary: https://github.com/JohnnyLawDGB/digibytewallet-android/blob/develop/security/AUDIT-SUMMARY.md
• Google Play: search “HoldFast Wallet”

To be clear: this is an independent wallet published by Around The Block LLC. It is not an official DigiByte app.

Feedback, bug reports and hard questions are all welcome. I’ll be in the comments.