spark.exposed

The exit

Club Orange's reviewed app bundled exit primitives but exposed no app-facing exit operation

Club Orange's published 4.3.7 Android artifact bundled Breez Spark's lower-level unilateral-exit primitives, but its 46 exported BreezSdk method names contained no unilateral-exit or recovery operation and the targeted DEX search found no corresponding user-flow strings. 21

2 sourcesEvidence reviewed through September 11, 2026

Fresh source, release metadata, APK-surface and public-documentation review on September 11. Source and release versions are distinguished; no funded wallet runtime or operator-outage execution was performed.

What the evidence shows

Technical and product details

  1. Published artifact

    Club Orange 4.3.7 was published September 3, 2026. The September 11 refresh downloaded the full APK and repeated the native-symbol and five-DEX string searches. 21

    Supporting material shown on this page

  2. Exported interface

    The native UniFFI library exposes 46 BreezSdk method symbols. None of their names contains unilateral, exit, or recovery. 1

    Supporting material shown on this page

  3. User-flow strings

    An exact search across all five DEX files found no unilateral-exit, recovery-bundle, or prepare-unilateral user-flow string. 1

    Supporting material shown on this page

  4. Lower-level capability

    The bundled native library does contain Breez Spark's lower-level unilateral-exit primitives. Their presence establishes SDK capability but does not expose an application workflow by itself. 1

    Supporting material shown on this page

  5. Artifact identity

    The inspected APK is 322,765,741 bytes. Its SHA-256, reproduced from the download and matched to GitHub metadata, is 7f407e4cded6bbe33d0376aad75a6d0b56419d9625a6706531d57a51f1a25f74. 21

    Supporting material shown on this page

Product-level detail

What the published Club Orange application exposed

The conclusions below are reproduced here so the reader does not need to open the separate implementation review. Each result remains limited to the named source snapshot, published binary, or public product surface.

Club Orange

Surface reviewed: published android apk

No unilateral-exit, exit, or recovery operation appears in the 46 exported BreezSdk method names, and the targeted DEX search found no corresponding user-flow strings. The bundled native library nevertheless contains lower-level unilateral-exit primitives.

Capabilities that were present: the bundled native library contains lower-level unilateral-exit primitives.

Symbol and string searches cannot prove the absence of obfuscated or indirectly invoked private code.

See versions, search method, artifact hashes, and full review limits.

Scope control

What this does not establish

  • Symbol and string searches cannot prove that no obfuscated or indirectly invoked code exists. The result is limited to the named published artifact and the recorded interface and string searches. 1

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

consumer-wallet exit audit manifest

Reproducible audit manifest · Review of Spark's trust model · Pinned or archival · checked 2026-09-11

Open original source
2

Club Orange 4.3.7 release

Repository record · github.com · Live source · checked 2026-09-11

Open original source

How sources, absence findings, and limitations were evaluated