VEYRNOX · Learn · RASP (Runtime Application Self-Protection)
RASP (Runtime Application Self-Protection)
RASP — Runtime Application Self-Protection — is an in-app defence that detects tampering, debugging, and hostile runtime conditions while the app is running, and responds by refusing to hold sensitive state. In wallets, RASP protects the signing environment.
How it works
RASP hooks into the app at build time and monitors the runtime for jailbreak / root indicators, dynamic instrumentation frameworks (Frida, Cydia Substrate), debugger attachments, code injection, and integrity violations of the app binary. On detection, the wallet degrades gracefully — refusing to unlock the vault, blocking transactions, or wiping ephemeral keys from memory — depending on the severity of the signal. Because RASP runs inside the app, it sees what an OS-level check cannot: an attacker who has compromised the runtime after launch.
Why it matters
Mobile wallets are attractive targets for tampering because they hold keys and sign transactions on-device. Jailbroken or rooted devices expose the app to memory-reading tools and hooking frameworks that can intercept PIN input or lift decrypted keys. RASP treats a compromised runtime as a first-class threat and refuses to proceed, rather than pretending the environment is trustworthy.
Related concepts
- iOS Secure Enclave — The Secure Enclave is a dedicated security coprocessor in Apple silicon (A7 and later, all M-series) that generates and stores cryptographic keys in hardware.
- Android StrongBox — StrongBox is a tamper-resistant hardware element on modern Android devices that backs the Android Keystore.
- Biometric Authentication — Biometric authentication uses a physical characteristic — fingerprint, face, iris — to authorise access.
- Panic Wipe — Panic wipe is an emergency wallet feature that erases on-device keys and cached state when triggered, leaving no recoverable material on the phone.
Frequently asked questions
Does RASP replace OS security?
No. RASP complements iOS and Android platform security by catching post-launch compromise that platform checks miss.
Will RASP block my wallet on a jailbroken phone?
Yes. Jailbreak is treated as a hostile environment; the wallet will not unlock the vault.
Can attackers bypass RASP?
Skilled attackers can defeat individual RASP checks, which is why RASP uses defence-in-depth — dozens of checks, not one.
In Veyrnox
Veyrnox ships RASP on every tier, including Free. Detection of jailbreak, debugging, or binary tampering blocks the vault from opening. The signing environment assumes it is being watched, and behaves accordingly.