Security-audit references & GHSA-7g72-jxww-q9vq affected-range confirmation (integrator request)

[mywebcore]

Hello Trust Wallet team,

We are the developers of MWC Wallet, a self-custodial Polygon-first wallet
(mobile + browser extension). We have pinned wallet-core 4.7.1
(tag commit 12f09abe496937576b44ae043d9f6fbcdd52ac11, artifacts verified by
SHA-256) as the cryptographic core of our mobile signer, consumed strictly
through official distribution channels (SPM release-asset manifest on iOS;
GitHub Packages on Android).

Our usage surface is deliberately minimal: BIP-39 entropy→mnemonic,
BIP-44 EVM derivation (m/44'/60'/0'/0/0), EIP-155/EIP-1559 transaction
signing and EIP-191 personal-message signing. We do not use the
StoredKey/Keystore module, Ed25519 signing paths, or any non-EVM coin
support.

Before our next release gate, our security process requires first-party
confirmation of the following:

1. Independent security audits of wallet-core. We could not locate a
   public audit report as of 2026-07-30. Have independent audits of
   wallet-core (in particular the C++ core: BIP-39/32 implementation, EVM
   signer, memory handling) been performed? If so, could you share the
   reports or summaries (auditor, scope, date, resolved findings), publicly
   or under NDA? (We are happy to sign one for non-public material — a
   contact address for that route would be appreciated.)

2. GHSA-7g72-jxww-q9vq affected-version range. The advisory
   (Ed25519 sign_with_pubkey key extraction, 2024) maps to
   ed25519-dalek < 2.0.0. Which wallet-core release first shipped the
   fixed dependency, and can you confirm 4.7.1 is not affected? (Our bridge
   exposes no Ed25519 operation; we still require confirmation because the
   code ships in the binary.)

3. Security-advisory notification channel. Beyond GitHub Security
   Advisories on this repository, is there a channel (mailing list, RSS,
   security page) you commit to using for wallet-core vulnerability
   disclosures, so we can subscribe our monitoring?

4. Release-metadata corrections (FYI). Two issues we verified on
   2026-07-30 that may bite other integrators: (a) the Package.swift
   committed at tag 4.7.1 (and on master) still points to the 4.2.9
   binaries — only the release-asset Package.swift is correct; (b) the
   4.7.1 CocoaPods podspec declares licence "MIT" while the repository
   LICENSE is Apache-2.0.

Thank you for your work on wallet-core.

— MWC Wallet engineering

[mywebcore]

Update: we located the audit directory and issue #4706 — questions 1 and 4 may already be addressed there. Our remaining blocking question is #2 (the exact wallet-core release that first shipped ed25519-dalek ≥ 2.0.0). Is a private channel preferred for that?

[mywebcore]

Update from our side : thank you, and a partial self-resolution:

We located the answers to two of these in-repo, so this is mostly to close
the loop and leave the remaining points as low-priority:

• Q1 (audits): found — the audit/ directory, plus the Kudelski and CertiK
  reports and the community audit in Security Audit: Multiple Findings in Key Management, Encryption, and Memory Handling #4706. Considered answered.
• Q2 (GHSA-7g72-jxww-q9vq / Ed25519 key-extraction): self-resolved from the
  4.7.1 source. rust/tw_keypair/src/ed25519/secret.rs renames the function
  to dangerous_sign_with_pubkey, keeps it pub(crate), and hazmat-labels
  it with a link to the advisory. That, combined with our integration
  surface being secp256k1/EVM only (no Ed25519 path is reachable from our
  bridge), resolves it for us. No action needed on your side.
• Q4 (release metadata): still flagging for other integrators — the
  tag-4.7.1 committed Package.swift points at 4.2.9 binaries (only the
  release-asset Package.swift is correct), and the 4.7.1 podspec declares
  licence "MIT" vs the repo's Apache-2.0 LICENSE. Low priority, FYI.

Only genuinely open question left: Q3 is there a security-advisory
notification channel (list/RSS/page) we can subscribe to for wallet-core?

Thanks again for the library and for publishing the advisory transparently.