Rustok
Ethereum wallet with chain abstraction and transaction security engine.
Status: Production β Phase 7 DONE β Android verified on Sepolia; iOS supported. React Native app with real on-chain transactions, full onboarding, and txguard live analysis.
Website: rustok.uz | API: api.rustok.uz | X: @rustokwallet
What is this?
Rustok is a self-custody Ethereum wallet built around two ideas:
- Your keys, your chains β one seed phrase controls addresses across Ethereum, Arbitrum, Base, Optimism, and zkSync. Balance and routing are unified; you pick the chain, the wallet handles the rest.
- Trust but verify β every transaction is analyzed by
txguard before signing. It decodes calldata, runs security rules, simulates execution via revm, and enriches findings with threat intelligence.
The mobile app (Android + iOS) is the primary interface. A public HTTP API and CLI are available for headless txguard analysis.
Features
- Multi-chain wallet β unified balance, send, and receive across 5 mainnet chains + Sepolia testnet
- BIP39 seed phrase β MetaMask-compatible path (
m/44'/60'/0'/0/0), cross-device recovery
- txguard analysis β pre-sign security scan with risk badge and per-finding breakdown
- PIN + Biometric lock β Argon2id-hashed PIN, Face ID / fingerprint unlock, background auto-lock
- Onboarding β create wallet (4-step wizard + phrase quiz), import from seed phrase, or recover from lockout / biometric change
- Activity history β real transaction feed with pending-state tracking and explorer links
- Theme β light / dark / system with design-token consistency across the UI
Architecture
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Mobile App (Android / iOS) β
β βββββββββββ βββββββββββ βββββββββββ ββββββββββββββββββ β
β β Wallet β β Activityβ β TxGuard β β Settings β β
β β Tab β β Tab β β Tab β β (Appearance, β β
β β β β β β β β Biometric, β β
β β β’ Hero β β β’ TX β β β’ Risk β β Auto-lock, β β
β β card β β list β β badge β β Network) β β
β β β’ Send β β β’ Pull β β β’ Per- β β β β
β β β’ QR β β refreshβ β findingβ β β β
β βββββββββββ βββββββββββ βββββββββββ ββββββββββββββββββ β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β β React Navigation v7 β’ Zustand 5 β’ NativeWind v4 ββ
β β Reanimated 4 β’ MMKV β’ Keychain β’ Argon2id ββ
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
βββββββββββββββββββββββββββββ¬ββββββββββββββββββββββββββββββββββ
β JS β Rust Bridge
βββββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββ
β react-native-rustok-bridge β
β (uniffi-bindgen-react-native 0.31) β
βββββββββββββββββββββββββββββ¬ββββββββββββββββββββββββββββββββββ
β FFI
βββββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββ
β Rust Workspace β
β βββββββββββββββ βββββββββββββββ βββββββββββββββββββββββ β
β β rustok-core β β txguard β β rustok-api β β
β β β β β β β β
β β β’ keyring β β β’ parser β β Axum HTTP server β β
β β β’ provider β β β’ rules β β /health β β
β β β’ router β β β’ simulator β β /check-address β β
β β β’ send β β β’ enrichmentβ β /decode β β
β β β’ explorer β β β β β β
β β β’ explainer β β 8 security β β Live: β β
β β β’ convert β β rules β β api.rustok.uz β β
β βββββββββββββββ βββββββββββββββ βββββββββββββββββββββββ β
β βββββββββββββββ βββββββββββββββ βββββββββββββββββββββββ β
β β rustok-cli β β rustok-typesβ βrustok-mobile-bindingsβ β
β β β β β β β β
β β CLI binary β β Shared DTOs β β uniffi FFI exports β β
β β (decode, β β (no crypto β β for iOS / Android β β
β β analyze, β β deps) β β β β
β β wallet, β β β β β β
β β send) β β β β β β
β βββββββββββββββ βββββββββββββββ βββββββββββββββββββββββ β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Tech Stack
| Layer | Technology |
|---|
| Mobile | React Native 0.85.2, React 19.2.3, TypeScript 5.8 |
| Navigation | React Navigation v7 (bottom-tabs, native-stack) |
| Styling | NativeWind v4, TailwindCSS 3.4, design-token system |
| State | Zustand 5, MMKV (persistent), React Native Keychain (secrets) |
| Animations | Reanimated 4.3, React Native Worklets, Gesture Handler |
| Bridge | uniffi-bindgen-react-native 0.31.0-2 |
| Language | Rust (edition 2024) |
| EVM | revm v36, alloy-evm v0.30 |
| Ethereum | alloy-rs v1.8 (provider, signer, primitives, consensus) |
| Crypto | BIP39 (m/44'/60'/0'/0/0), AES-256-GCM, Argon2id, secp256k1 |
| HTTP | Axum 0.8, Tower HTTP (CORS, trace) |
| Async | Tokio, Futures |
| Serialization | Serde, Serde JSON |
| CLI | clap v4 |
| Logging | tracing, tracing-subscriber |
Quick Start
Mobile App
Prerequisites: Node.js β₯ 22.11, Android SDK (for Android) or Xcode + CocoaPods (for iOS).
# Install dependencies
cd mobile && npm install
# Start Metro bundler
npx react-native start --port 8081
# Android (separate terminal)
cd android && ./gradlew app:installDebug -PreactNativeDevServerPort=8081
# Windows: .\gradlew.bat app:installDebug -PreactNativeDevServerPort=8081
# iOS (macOS only, separate terminal)
cd ios && pod install && cd .. && npx react-native run-ios
For physical Android devices:
adb reverse tcp:8081 tcp:8081
Detailed mobile docs: See mobile/README.md for onboarding flow, bridge surface, DEV escape hatches, and Android/Windows specifics.
Rust Workspace
# Run all tests
cargo test --workspace
# Build CLI
cargo build -p rustok --release
# Run API server locally
cargo run -p rustok-api
CLI Examples
Transaction Security Analysis
# Decode ERC-20 approve calldata
rustok decode \
--to 0xdAC17F958D2ee523a2206206994597C13D831ec7 \
--data 0x095ea7b3000000000000000000000000000000000000000000000000000000000000dead00000000000000000000000000000000000000000000000000000000000f4240
# Full security analysis (parse + rules + verdict)
# Exit codes: 0=allow, 1=warn, 2=block
rustok analyze \
--to 0xdAC17F958D2ee523a2206206994597C13D831ec7 \
--data 0x095ea7b3ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
Wallet Operations
# Generate a new encrypted wallet
rustok wallet new --password "your-secure-password"
# Check unified balance across Ethereum, Arbitrum, Base, Optimism, zkSync
rustok wallet balance 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045
# Show wallet info from keystore file
rustok wallet info --keystore 0xabc...def.json --password "your-password"
# Send ETH (txguard security check mandatory, testnet by default)
rustok wallet send --keystore wallet.json --password "pwd" --to 0xd8dA...6045 --amount 0.1
Security Rules (txguard)
| Rule | Severity | Trigger |
|---|
unlimited_approval | Warning | approve(spender, type(uint256).max) |
set_approval_for_all | Warning | setApprovalForAll(operator, true) |
permit_to_unknown | Danger | EIP-2612 permit to unknown spender |
permit_unlimited | Warning | Permit with value == U256::MAX |
known_scam | Forbidden | Address in scam database |
unknown_function | Warning | Unrecognized function selector |
value_with_calldata | Warning | ETH sent with contract call |
send_to_contract | Info | Transfer to contract address |
Supported Chains
| Chain | ID | Status |
|---|
| Ethereum | 1 | Active |
| Arbitrum One | 42161 | Active |
| Base | 8453 | Active |
| Optimism | 10 | Active |
| zkSync Era | 324 | Active |
| Sepolia | 11155111 | Testnet |
txguard API
Public API for transaction security analysis. Live at api.rustok.uz.
| Endpoint | Method | Description |
|---|
/health | GET | Health check |
/check-address | POST | Address security check via GoPlus (malicious flag, risk level, risks) |
/decode | POST | Decode and analyze raw EVM transaction (action, risk score, findings) |
# Check address
curl -X POST https://api.rustok.uz/check-address \
-H "Content-Type: application/json" \
-d '{"address": "0xdAC17F958D2ee523a2206206994597C13D831ec7"}'
# Decode transaction
curl -X POST https://api.rustok.uz/decode \
-H "Content-Type: application/json" \
-d '{"to": "0xdAC17F958D2ee523a2206206994597C13D831ec7", "data": "0x095ea7b3000000000000000000000000000000000000000000000000000000000000dead00000000000000000000000000000000000000000000000000000000000f4240"}'
Deployed via Docker + Caddy on 185.197.195.191 (deploy/).
Tests
517 tests, 0 failures
- Rust workspace: 231 tests (txguard, core, types, mobile-bindings)
- Mobile (Jest): 286 tests (components, stores, hooks, screens)
Pre-commit gates:
# Rust
cargo fmt --all --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
# Mobile
cd mobile && npm run typecheck && npm run lint && npm run test
Project Layout