S-8 · EPIC-KDF-2026-01 · v1.0 · Audited 25 October 2026 · ~5 min read
Summary
The report examines the official Epic Cash wallet (cypherstack/epic-wallet) and its use in Epic Pay. wallet.seed contains the encrypted seed; the ChaCha20-Poly1305 encryption is correct, but the key is derived from the password with PBKDF2-HMAC-SHA512 using only 100 iterations and an 8-byte salt.
The risk is local: wallet.seed must first be obtained. Once the file is in hand, the password can be tested offline at low cost.
What is stored
wallet.seed is a JSON file with encrypted_seed, salt and nonce. The seed is 16 or 32 bytes and can reconstruct the BIP39 phrase and the keys of every account.
AEAD provides a direct password check: as soon as the tag is valid, the candidate is correct. No remote service is required.
Versions examined
The 13 tags in EpicCash/epic-wallet and the master branch of cypherstack/epic-wallet were examined. All use 100 iterations, an 8-byte salt and ChaCha20-Poly1305.
| Tags / branch | Derivation | Iterations | Salt | AEAD |
|---|---|---|---|---|
| v3.0.0 · v3.3.2 | pbkdf2::derive(&digest::SHA512, 100, …) | 100 | 8 B | ChaCha20-Poly1305 |
| v3.4.0 · v3.5.0 · v3.5.1 · v3.6.0 | ring::pbkdf2::PBKDF2_HMAC_SHA512 | 100 | 8 B | ChaCha20-Poly1305 |
| v4.0.0(-beta) · v4.0.1 · v4.0.2 · v4.1.0 | Same API, same parameters | 100 | 8 B | ChaCha20-Poly1305 |
| cypherstack v3.0.0 · v3.3.2 · master | Old/new API, same parameters | 100 | 8 B | ChaCha20-Poly1305 |
Result: 13/13 tags + master, identical parameters; no fixed version identified.
The problem
PBKDF2-HMAC-SHA512 with 100 iterations is far below current recommendations (600,000 iterations or Argon2id). The 8-byte salt is acceptable but shorter than the recommended 16 bytes.
The seed generator is not the issue: the report describes weak file protection, not weak entropy.
The file is often copied to a disk or cloud service as a backup, which widens the exposure.
Impact
If wallet.seed is obtained, an attacker can recover the password, then the seed, BIP39 phrase and private keys. They can move Epic assets and those derived from the same phrase.
There is no rate limit, no lockout and no network involvement.
Scope and limitations
- PoC based on the same Rust logic; no real user wallet sample was tested.
- Risk depends on password strength.
- 13 tags + master examined; the
floonettest network is not covered. - No fixed version was identified within the audited scope.
- No victim data, seed or private key is published.
Recommendations
- Move to PBKDF2-HMAC-SHA512 with at least 600,000 iterations, or Argon2id.
- Increase the salt to 16 bytes and version the file format.
- Migrate old files: an existing file remains attackable until it is rewritten.
- Correct the tag-length constant used during decryption.
- Treat
wallet.seedas a private-key backup; avoid synchronized folders. - If the file may have leaked, create a new seed and move the assets.
Disclosure
The full report and evidence remain restricted. To report a case: security@frblockchain.icu. Do not send a seed, private key or wallet file.