feat(rn_cli_wallet): encrypt MMKV secret storage with keychain-backed key

[ignaciosantise]

Problem

wallets/rn_cli_wallet persisted every chain's mnemonic / private key / secret key as plaintext in MMKV (new MMKV() with no encryptionKey). Anyone with filesystem or backup access to the device could read the seed phrases. The code itself warned about this ([SECURITY] … stored unencrypted).

Fix

Encrypt the whole MMKV store at rest on native using MMKV's built-in encryptionKey, with a random key generated once and kept in the iOS Keychain / Android Keystore via expo-secure-store. The key that protects the secrets never sits in plaintext.

Chosen deliberately over moving secrets into SecureStore per-chain: all secret access is funneled through a single chokepoint (getEncryptionKey), so every chain is protected at once, the 7 copy-pasted-from-web chain utils stay untouched, and it leaves a clean seam for optional biometric gating later.

Changes

• package.json / yarn.lock — add expo-secure-store@~56.0.4 (matches the SDK-56 unified versioning track).
• src/utils/secureEncryptionKey.ts (new) — owns the encryption-key lifecycle. Native-only; generates a 16-char key (8 random bytes hex, respecting MMKV's ≤16-byte limit) via the global crypto.getRandomValues, stores it in SecureStore, and memoizes. Web returns undefined (no native secure storage in a browser).
• src/utils/storage.ts — MMKV is now opened lazily (the key fetch is async; the storage.* methods were already async so signatures are unchanged). On first run it recrypts the existing plaintext store in place so wallets aren't reset on upgrade; afterwards it opens with encryptionKey. Dev-only console.logs report which path ran.
• 5 chain utils (Solana/Sui/Ton/Tron/Canton) — reworded the now-inaccurate stored unencrypted dev warnings.

Platform behavior

• iOS / Android: encrypted at rest, key in Keychain/Keystore.
• Web: unchanged — localStorage shim, unencrypted by design (documented limitation).

How to verify

1. cd wallets/rn_cli_wallet && yarn install, rebuild, clear Metro/gradle caches (encryption changes the on-disk format).
2. Console: on launch you'll see MMKV recrypted in place … (first run) then MMKV opened ENCRYPTED … on subsequent launches.
3. Definitive — grep the on-disk file (MMKV encrypts key names too, so plaintext key names disappear):

   adb exec-out run-as com.walletconnect.web3wallet.rnsample.debug \
     cat files/mmkv/mmkv.default | strings | grep -E 'EIP155_MNEMONIC|SOLANA_'

   Present before the fix, empty after — while the wallet still loads the same address in-app.

Notes

• No biometric gating in this PR (silent access on startup). The architecture is ready for it: add requireAuthentication: true in secureEncryptionKey.ts + the expo-secure-store config plugin for NSFaceIDUsageDescription.
• Not yet built/tested on a device in this workspace (node_modules not installed here) — verification above is the intended path.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
deposit-app-demo	Error		Jul 8, 2026 6:47pm
pos-demo	Ready	Preview, Comment	Jul 8, 2026 6:47pm

[claude]

Claude finished @ignaciosantise's task in 2m 33s —— View job

---

Code Review in Progress

• Gather context and read changed files
• Review secureEncryptionKey.ts (new file)
• Review storage.ts (encryption integration)
• Review chain utils warning updates
• License compliance subagent (running)
• Breaking changes subagent (running)
• Data classification subagent (running)
• Consolidate and post findings