Pocket Node Completion Report

Jnr6 · July 24, 2026, 12:00pm

Pocket Node: DAO Grant Completion Report (Milestones 1 to 4)

Project: Pocket Node, a mobile CKB light-client wallet for Android
Repository: github.com/RaheemJnr/pocket-node
Website: pocket-node.com
Grant: Nervos Community DAO, four milestones over four months
Current release: v1.8.0

Summary

All four accepted milestones are complete and shipping in production. Pocket Node is a fully self-custodial CKB wallet that runs an embedded Rust light client on the device. There is no gateway server: the phone verifies the chain itself, generates and stores keys locally, and builds and broadcasts transactions peer to peer.

Across the grant we shipped every accepted deliverable, plus a set of features and hardening work that went beyond the original scope in response to real user reports. This report maps each milestone to the code and releases that deliver it, is honest about where we deviated, and closes with our readiness to begin an iOS build.

Milestone to release mapping:

Milestone	Theme	Releases
M1	Mainnet Ready and Hardware-Backed Security	v1.1.0, v1.2.0
M2	Nervos DAO Protocol Integration	v1.3.0, v1.4.0
M3	Multi-Wallet and Sync Optimization	v1.5.0, v1.6.0
M4	Address Book, Polish and Launch	v1.7.0 and the v1.7.x line
Beyond scope	Reliability, discovery, security depth	v1.7.1 to v1.8.0

Milestone 1: Mainnet Ready and Hardware-Backed Security

Accepted deliverables and status:

Production mainnet configuration. Done. assets/mainnet.toml and assets/testnet.toml carry the light-client config (bootnodes, RPC, checkpoints), copied to app storage at runtime with isolated data directories per network. The secp256k1-blake160 lock, cell deps, and network prefixes are wired for both networks.
BIP39 mnemonic with TEE/StrongBox encryption. Done. Local BIP39 generation and validation (Bip39WordList), keys stored in Android Keystore (hardware-backed where available), never leaving the device.
Biometric authentication with PIN fallback. Done. AuthManager drives BiometricPrompt, PinManager provides the PIN path, with an escalating lockout.
Comprehensive mainnet testing with real transactions. Done. Verified on mainnet and testnet with real sends, including large fragmented wallets.
Open-source repository. Done. MIT licensed, public from day one.
Releases v1.1.0 and v1.2.0. Done (v1.1.0 “Mainnet”, v1.2.0 “Room”).

Milestone 2: Nervos DAO Protocol Integration

Accepted deliverables and status:

DAO deposit. Done.
DAO withdraw (phase 1 and phase 2). Done.
Compensation tracking. Done. The DAO screen shows accrued compensation and an APC label per deposit.
Releases v1.3.0 and v1.4.0. Done (both tagged “Nervos”).

The DAO subsystem is substantial and lives across a dedicated set of files: DaoScreen, DaoViewModel, DaoDepositCard, ApcLabel, DaoConstants, DaoSyncManager, DaoHeaderResolver, DaoDepositReader, DaoCellMapping, DaoDedup, plus DaoCellEntity and PendingDaoWithdrawEntity in Room. Deposits, withdrawals, header-dependency resolution for compensation math, and a pending-withdraw safety net are all implemented on-device against the embedded light client.

Milestone 3: Multi-Wallet and Sync Optimization

Accepted deliverables and status:

Multi-wallet: independent mnemonics and HD sub-accounts from one mnemonic. Done. WalletRepository manages multiple wallets and derived sub-accounts.
Wallet management UI: create, switch, rename, delete, export. Done. WalletManagerScreen, AddWalletViewModel, WalletSettingsViewModel.
SQLite optimization: pagination, composite indices, WAL, VACUUM, monitoring. Done. Room with Paging 3 (Pager) for the activity list, composite indices and partial indices on the transactions and cache tables, and DatabaseMaintenanceUtil running a throttled VACUUM on a periodic cadence.
Transaction history export (CSV). Done. ActivityViewModel.exportTransactions() writes CSV through the Storage Access Framework (CreateDocument("text/csv")), scoped to the active wallet and current network.
Releases v1.5.0 and v1.6.0. Done.

Milestone 4: Address Book, Polish and Launch

Accepted deliverables and status:

Security review. Done, and expanded well beyond the original internal-audit scope (see “Beyond scope” below). Internal audits of JNI memory safety, Keystore and key-material storage, and third-party dependencies were completed with reports and per-finding fix issues, carried out with valuable guidance and review from the Nervos team; all High and Critical findings are resolved or formally risk-accepted.
Identity and contacts: local address book with labels and smart suggestions in the send flow. Done. ContactEntity, ContactDao, ContactRepository, ContactsScreen, ContactDetailScreen, ContactPickerSheet, plus send-flow autocomplete and a save-on-successful-send prompt.
App Store optimization: UI/UX polish and an optimized Google Play listing (SEO, screenshots, localized descriptions). Partially complete and in progress. Localized Play metadata exists in fastlane/metadata for en-US, es-ES, ru-RU, zh-CN (title, short and full descriptions, changelogs, images). The Play Store listing itself is about 70 percent complete. In the meantime the app is distributed as a signed APK via the website and a signature-pinned in-app updater.
Community launch: full documentation and completion report. Done. docs/USER_GUIDE.md (install, backup, send/receive, sync, DAO, troubleshooting).
Releases v1.7.0 and the v1.7.x line. Done.

Deviations from the original plan

We want to be transparent about where the delivered work differs from the letter of the proposal.

Version numbering. The proposal sketched a “v2.0.0 final” cut for the end of M4. In practice we kept the 1.x line and continued shipping incremental, well-tested releases through v1.8.0 rather than cutting a marketing-driven 2.0. The feature content promised for the final milestone is all shipped; only the version label differs.
Play Store listing. The listing is about 70 percent complete rather than fully live. We prioritized correctness and security fixes for existing users (see below) over racing the store review. Distribution today is via a signed APK from pocket-node.com and the in-app updater; the store listing is being finished in parallel.

image2306×440 44.4 KB

Beyond the accepted scope

Several significant pieces were built that were not in the original milestone list. They were driven by real user reports and by our own security review, and we consider them part of making the wallet genuinely production-grade.

Background sync. A foreground-service sync path plus a WorkManager catch-up worker so balances and history stay fresh between opens, within Android’s background-work limits.
In-app updater. A signature-pinned updater that fetches the latest signed APK and installs it in one tap, so users on direct-APK distribution get updates without manual sideloading. It refuses any build whose signing certificate does not match the embedded fingerprint.
Imported-wallet fund discovery. A CKB address is one lock per account, but seed phrases imported from other wallets (for example Neuron) spread funds across derived and change addresses this app did not originally scan. We added detection, a “scan other addresses” flow, and a one-tap “move to main wallet” sweep so imported users can find and consolidate funds that would otherwise look missing.
Deep security hardening beyond the internal audit. On top of the M4 internal audits we ran external automated security scans and shipped: a V2 auth-bound AES-256-GCM Keystore key chain with per-operation authentication, an Argon2id PIN KDF with an escalating lockout, informed consent before software-only key storage on lock-less devices, an app-PIN gate on seed and private-key reveal, and a hardened, pinned, split release-signing CI pipeline.
Correctness fixes for large and fragmented wallets. We root-caused and fixed a native pagination cap that limited reads to the first 100 cells and transactions (which caused wrong balances and amounts on busy wallets), and moved to dynamic fee sizing so large multi-input sends are never rejected for low fee.
Sync-coverage education. In-app guidance and FAQ explaining how balances and amounts depend on syncing back to a wallet’s first funding block, which is the honest answer to a genuine light-client limitation.
Bulk airdrop send. A one-to-many send flow that pays many recipients the same amount in a single flow: paste a list of addresses, review a live preview (valid, duplicate, and invalid counts, total, and fee), and authorize the whole batch with one biometric or PIN prompt. Under the hood it builds one CKB transaction with many outputs, splits large lists into safely sequenced batches that cannot double-spend one another, and sizes the fee to the real transaction. It was built for and demonstrated at a community event (Nairobi Meetup), and is verified end to end on testnet.

On an external security audit

We have deliberately not commissioned one yet, and would rather explain the reasoning than quietly skip it.

An external audit is most valuable when it covers the surface a project will actually ship. Pocket Node is about to gain a second, parallel codebase: the iOS app. A meaningful share of the security-critical surface (the application layer, key-storage integration, platform authentication, and the bridge to the embedded light client) will be re-implemented natively on iOS. Auditing only the Android codebase now would mean paying for and coordinating a review that covers roughly half of the eventual attack surface, and then repeating the exercise for iOS shortly after.

It makes more sense, and is a better use of grant funds, to schedule a single external audit once the iOS build reaches parity, so one engagement covers both platforms and the shared Rust core together. Until then we continue to run internal audits and automated security scanning on every change(with the Nervos testing team), with all High and Critical findings resolved or formally risk-accepted (see Milestone 4 and Beyond scope).

Roadmap and ongoing maintenance

Planned next:

iOS app. Bring the same self-custodial, server-free experience to iPhone, reusing the embedded Rust light client through a Swift bridge and re-implementing only the application and UI layer.
Complete the Google Play Store launch (listing, testing tracks, review).
A single combined external security audit once iOS reaches parity (see above).
Wider localization beyond the current English, Spanish, Russian, and Chinese set.
Background-sync polish (notification UX, metered-network handling, OEM battery guidance).

Ongoing maintenance:

A regular release cadence with per-release changelogs.
Prompt fixes for user-reported issues, tracked publicly on GitHub.
Keeping the embedded ckb-light-client, the CKB SDK, and third-party dependencies current, including security advisories.
Continued automated security scanning and internal review on every change.

Issue tracker

Development has been fully in the open. Across the four milestones, more than 150 issues have been opened and closed on GitHub, each tied to the pull request that resolved it. Around 19 issues remain open. These are non-blocking: UI and UX polish, the remaining Play Store launch tasks, wider localization, background-sync niceties, and a few internal-tooling items. None affect the correctness or safety of the shipped wallet. They are trivial follow-ups tracked for continuous improvement and will be addressed on the normal release cadence in due time.

Current state and readiness for iOS

Pocket Node on Android is feature-complete against all four milestones, security-audited, and live at v1.8.0. Every milestone deliverable is in users’ hands today.

On that basis we are ready to begin the iOS version of Pocket Node, bringing the same self-custodial, server-free CKB experience to iPhone users.

Thanks

This work was funded by the Nervos Community DAO. We are especially grateful to the Nervos team for their help and guidance on the internal security audit.

It was also shaped throughout by community members and testers whose reports caught the edge cases that made the wallet better. In particular: @ArthurZhang , yanli, Alex, @gpBlockchain, Georgiev, @knmo @scz and other users who reported bugs and gave feedbacks. Thank you to them and to everyone else who filed issues, tested releases, and pushed us to make Pocket Node better.