Start with the free SDK — it closes the gap immediately. Add managed signing when you want velm to operate the quorum. Book an audit if you're not sure where your pipeline is exposed. Every option is the same on-chain verification primitive, applied at the right depth for your team.
Free. Open source. Closes the supply-chain gap permanently.
A Rust crate that runs as a native module before any update is applied. It hashes the downloaded bundle with keccak256, queries the on-chain registry, and rejects anything the developer's hardware wallet didn't sign — even if CI/CD, CDN, or the signing server is fully compromised. React Native JSI wrapper included. MIT licensed. This is the foundation everything else is built on.
We run the hardware wallet quorum. Your team never touches signing keys.
velm operates a Gnosis Safe multi-sig on your behalf. M-of-N hardware wallet holders co-sign every on-chain hash publication — one compromised developer machine cannot push a malicious update. Offline signing ceremonies. Sub-5-minute hash publication. 99.9% uptime SLA. This is the revenue product — the SDK is the distribution.
Know exactly where you're vulnerable before an attacker does.
End-to-end audit of your CI/CD configuration, signing key management, CDN setup, and current verification layer. We rank every finding by exploitability and give you a concrete on-chain verification implementation plan. Most wallet teams are surprised by how many hops exist between the developer's commit and the user's device — and how few of them are protected.
The verifier must be native — it cannot live inside the bundle it's verifying.
If verification logic runs in JavaScript, a malicious bundle overrides it before it executes. We wrap the Rust verifier as a JSI native module linked at build time — it runs before the JS engine loads the new code. Full iOS and Android delivery. This is the correct architecture for every React Native wallet using OTA updates.
New wallet from scratch, with on-chain OTA verification in Sprint 1 — not Sprint 4.
BIP-39/44 key derivation, Rust transaction signing, multi-chain RPC integrations, and on-chain OTA verification baked in from the first sprint. Non-custodial by default — keys never leave the device, updates never bypass the on-chain check. This is how Coin was built. Your wallet gets the same architecture.