APK Gate

Release this APK

Do these in order once an APK is loaded. Each button sends a real transaction to the contract.

1. Developer registers the appBuilders B1, B2, B3. Threshold k = 2.
   Register
2. Builders vote for this buildEach builder sends digest D once for this version.
   B1 votesB2 votesB3 votes
3. Check the APKRuns the five checks above with a free read-only call.
   Check

Attack lab

Each attack runs against the APK you loaded and shows what the gate decides.

• Build server hackedB3 is compromised and votes for a backdoored build. The file carries the real certificate.
  Run
• Signing key stolenThe attacker injects code and signs with the real key. No builder voted for it.
  Run
• Repackaged appInjected code, re-signed with the attacker's own key (certificate swap is simulated).
  Run
• DowngradeThe developer raises the minimum version above this one.
  Run
• Revoked releaseThe developer revokes this version, then a user tries to install it. Run this last.
  Run
• Outsider tries to voteAn account that is not a builder sends a vote.
  Run