← Back to home

Audit — 0x2ALL

This site publishes the audit prompt and the full report, with a hash for every file and a date proof. The report answers the question of a user who has never heard of the developer: can this app steal my funds, charge me more than declared, or do something malicious on my device?

Verdict

v9.0 edition (this one): APPROVED — 0 open findings · 1.0.21 binary re-audited 4 declared design decisions verified (DD1–DD4)

Auditor: DeepSeek v4.1 Flash (1017) · 2026-10-21 · commit 9f69edc

Full report

PT / prompt · EN / prompt · ES / prompt · FR / prompt · ZH / prompt · TR / prompt

Date proof (OpenTimestamps): prompt-en.md.ots, prompt-es.md.ots, prompt-fr.md.ots, prompt-pt.md.ots, prompt-tr.md.ots, prompt-zh.md.ots, report-en.md.ots, report-es.md.ots, report-fr.md.ots, report-pt.md.ots, report-tr.md.ots, report-zh.md.ots

The .ots file proves the content existed at stamping time; confirmation arrives in the next Bitcoin block and can be checked with ots verify.

Audited binary

0x2ALL 1.0.21 (code 21) — 6,677,553 bytes

Audited file: 0x2ALL-1.0.21-9f69edc-release.apk

SHA-256
325245a6542212f0227eb7616f9a550bcd0053e5d7c613a66d080c60698bf830

Certificado
53dac6cbe7edd6894b9377c4bbdc302a883abbe18a01ad2bd87d0a0fafa142c1

This is the same file served at /download/apk: the SHA-256 matches the site's version.json.

Files and hashes (SHA-256)

prompt-en.md223b2610d3d6b1cdd6a1b17505921530e5eec5d09c2c385deabcce949855b820
prompt-es.mdda042434736e4fbda347953e6403728c2672484e4c8492b73ac52596da4a97bd
prompt-fr.md072405c091270745c654907e6109f6d68889adde210b0dd72d2a1d7dd78a5cf0
prompt-pt.mdbd680635e70af60bc423e3aa89c95a3ec3cdeb3958819e8bcb987284c6960858
prompt-tr.mdc766ef3b24cac593d57cc3ca181c6298403fc618bf316d3db5adcca6d4008e62
prompt-zh.md4f954278bafc61ce463a5fc7b10ce84a73f6b541f29a6966b240b225a4b68f9b
report-en.md8511be6c5c49962265918701a1aa7150ca35e61a63670024f2336eba675f0869
report-es.md0b631bbee085ad3193e1c4d94000ab412bae3f1e257e374dd13aa196f7ebec53
report-fr.md0d5d14a3adf0e33cdf234f5b18c11f4ae7c6f5089204e1c8ba05265958ce48d0
report-pt.md6c3c95262cd89139232410c824a145f6b0c72f72ba83be3722b01b20cc92edc2
report-tr.mdc73af75fcb3c5d9d6a78886ff0ee0e0060bc75436cb2a1765b8aae2c2a240e33
report-zh.md078990591d159137f4c8e727a7581c707ed83082104cec76c032119a3d3c6620

What the hash proves — and what it does not

The SHA-256 and the OpenTimestamps proof show that this text existed on the stated date and has not changed since. They do NOT prove the audit is true or independent. That requires reproduction: the prompt is public precisely so anyone can run it against the code or another auditor and compare.

How to reproduce

Download the prompt and apply it to the signed APK: apksigner (signature and signer), aapt2 (version, permissions, components) and DEX decompilation (jadx or baksmali). The source is not required — the repository is private. Compare with the answers: any divergence is a finding.

Limitations declared in the report

Static audit (nothing executed on a device); source↔APK correspondence shown by ZIP comparison, not a reproducible build; no traffic capture; no independent human audit.

← Back to home