CaixaBank Now signing

Odyssey

Hello everyone,

I hope you can assist me with an issue I'm facing. The app I’m using has an embedded mechanism for transactions, but it only allows one device to be enabled at a time. While I can perform most functions, I am unable to confirm transactions using the embedded feature because I cannot configure my GrapheneOS device as the signing device. The error reported by the app is quite generic, but I have managed to capture the OS logs on a few occasions. However, the crash does not occur every time I attempt to use the feature.

I am running Google Play and Services sandboxed in the same environment as the app. To improve compatibility, I have also removed some hardening features, such as exploit protection.

I suspect the issue may stem from compatibility checks related to the differences between GrapheneOS and stock Android. If anyone is aware of any workarounds or solutions, I would greatly appreciate your help.

Thank you in advance for your assistance!

Please find the crash stack in attachment.

Best regards.

`type: crash
userType: profile.managed
package: es.lacaixa.mobile.android.newwapicon:2025072501, targetSdk 35
osVersion: google/panther/panther:16/BP2A.250805.005/2025081400:user/release-keys
uid: 1210241 (u:r:untrusted_app:s0:c241,c256,c524,c768)
cmdline: es.lacaixa.mobile.android.newwapicon
processUptime: 3189s

abortMessage: hardened_malloc: fatal allocator error: canary corrupted

signal: 6 (SIGABRT), code -1 (SI_QUEUE)
threadName: thread4-4012895

backtrace:
/apex/com.android.runtime/lib64/bionic/libc.so (abort+156, pc 7727c)
/apex/com.android.runtime/lib64/bionic/libc.so (fatal_error+44, pc 60984)
/apex/com.android.runtime/lib64/bionic/libc.so (deallocate_small+1272, pc 5e298)
/apex/com.android.art/lib64/libart.so (art::JNI<false>::ReleaseByteArrayElements(_JNIEnv, jbyteArray, signed char, int)+696, pc 67aed8)
/apex/com.android.conscrypt/lib64/libjavacrypto.so (NativeCrypto_EVP_CipherFinal_ex(JNIEnv, _jclass, _jobject, _jbyteArray, int) (.llvm.2823428834662479330)+368, pc 1eec0)
/system/framework/arm64/boot-framework.oat (art_jni_trampoline+136, pc 8475e8)
/apex/com.android.art/lib64/libart.so (nterp_helper+152, pc 6a1108)
/apex/com.android.conscrypt/javalib/conscrypt.jar (com.android.org.conscrypt.OpenSSLEvpCipher.doFinalInternal+38, pc 31dda)
/apex/com.android.art/lib64/libart.so (nterp_helper+3924, pc 6a1fc4)
/apex/com.android.conscrypt/javalib/conscrypt.jar (com.android.org.conscrypt.OpenSSLEvpCipher.engineDoFinal+70, pc 31d4e)
/data/app/mm9ZyrGEz5uiAVtrb6eHsg==/es.lacaixa.mobile.android.newwapicon-HmQVwAfx-N-d0rQ8l4eAow==/oat/arm64/base.odex (o.DownloadManager5.RemoteActionCompatParcelizer+316, pc 4fb751c)
/data/app/mm9ZyrGEz5uiAVtrb6eHsg==/es.lacaixa.mobile.android.newwapicon-HmQVwAfx-N-d0rQ8l4eAow==/oat/arm64/base.odex (o.DownloadManager5.values+224, pc 4fbe450)
/data/app/mm9ZyrGEz5uiAVtrb6eHsg==/es.lacaixa.mobile.android.newwapicon-HmQVwAfx-N-d0rQ8l4eAow==/oat/arm64/base.odex (o.Video1.values+468, pc 55fff74)
/data/app/mm9ZyrGEz5uiAVtrb6eHsg==/es.lacaixa.mobile.android.newwapicon-HmQVwAfx-N-d0rQ8l4eAow==/oat/arm64/base.odex (o.Video1.RemoteActionCompatParcelizer+52, pc 55ff984)
/data/app/mm9ZyrGEz5uiAVtrb6eHsg==/es.lacaixa.mobile.android.newwapicon-HmQVwAfx-N-d0rQ8l4eAow==/oat/arm64/base.odex (o.Video1.values+48, pc 55ffa40)
/data/app/mm9ZyrGEz5uiAVtrb6eHsg==/es.lacaixa.mobile.android.newwapicon-HmQVwAfx-N-d0rQ8l4eAow==/oat/arm64/base.odex (o.setDownloadId.run+4748, pc 56a4abc)
/system/framework/arm64/boot.oat (java.util.concurrent.Executors$RunnableAdapter.call+60, pc 20ad2c)
/system/framework/arm64/boot.oat (java.util.concurrent.FutureTask.run+164, pc 209da4)
/system/framework/arm64/boot.oat (java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run+128, pc 212900)
/system/framework/arm64/boot.oat (java.util.concurrent.ThreadPoolExecutor.runWorker+676, pc 214c54)
/system/framework/arm64/boot.oat (java.util.concurrent.ThreadPoolExecutor$Worker.run+56, pc 218bf8)
/system/framework/arm64/boot.oat (java.lang.Thread.run+64, pc a94f0)
/apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612, pc 323b94)
/apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread, unsigned int, unsigned int, art::JValue, char const)+216, pc 3125f8)
/apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void)+936, pc 4292b8)
/apex/com.android.art/lib64/libart.so (art::Thread::CreateCallbackWithUffdGc(void)+8, pc 428ef8)
/apex/com.android.runtime/lib64/bionic/libc.so (pthread_start(void)+236, pc 87c3c)
/apex/com.android.runtime/lib64/bionic/libc.so (start_thread+64, pc 7a200)`

n3t_admin

Odyssey abortMessage: hardened_malloc: fatal allocator error: canary corrupted

Your issue is caused by a memory bug inside the app.
You need to enable "exploit compatibility mode" for the app.
This will not fix the memory issue, but it will allow your app to run normally again.

MetropleX

Odyssey To improve compatibility, I have also removed some hardening features, such as exploit protection.

n3t_admin they appear to have done some.

@Odyssey you need to turn off the hardened memory allocator for it. Inadvisable and in fact I would be using this to make a complaint to say the app is badly coded and has memory vulnerabilities.

n3t_admin

MetropleX they appear to have done some

dang, seems like I forgot where the hardened_malloc switch was :(
you're right of course, it's a separate toggle.

Odyssey

Hello guys

Thanks for the quick answer. To provide more context my issue appears regardless of the hardening configuration. As I mentioned the crash doesn't occur on regular basis, but the error at the app level does.
I can open the app, check and use almost everything. Only the transaction singing mechanism fails. At the app level I only get something like "an error occurred, try later". A couple of time I was able to catch the error reported. But this is not always the case.

Thanks

n3t_admin

Odyssey I mentioned the crash doesn't occur on regular basis, but the error at the app level does.

Yeah, this is due to the memory bug.
The developers of your banking app didn't test it properly (or at all; debugging memory issues is often skipped).
You need to contact your bank/the developers of the app, because only they can fix the issue properly.

Odyssey

They will reply that my OS is not supported. I will try anyway.

Thanks again for your help

n3t_admin

Odyssey don't mention you're running GrapheneOS. This bug translates over to regular Android.

de0u

Odyssey They will reply that my OS is not supported.

It is nearly certain that there is a bug in their code. There is a fair likelihood that it is exploitable (especially on non-GrapheneOS devices). If your bank can't process and act on that information, do you want to leave your money there?

Odyssey

de0u do you want to leave your money there?

We all know that is more complex than that!

I opened a ticket with them and submitted the crash stack. I honestly think we have two issues and they be related or not:
1) the crash stack you already checked, that rando

mly happens when I try to configure the mentioned feature.
2) The feature doesn't work in GrapheneOS because the OS is not recognized as trustworthy. I found clues of this behavior in the following app logs:

09-01 18:21:22.142 19850 19850 W libc : Access denied finding property "ro.debuggable"
--------- switch to events
09-01 18:21:22.137 19850 19850 I auditd : avc=type=1400 audit(0.0:89077): avc: denied { read } for comm="which" name="u:object_r:userdebug_or_eng_prop:s0" dev="tmpfs" ino=826 scontext=u:r:untrusted_app:s0:c242,c256,c524,c768 tcontext=u:object_r:userdebug_or_eng_prop:s0 tclass=file permissive=0
--------- switch to main
09-01 18:21:22.137 19850 19850 W which : type=1400 audit(0.0:89077): avc: denied { read } for name="u:object_r:userdebug_or_eng_prop:s0" dev="tmpfs" ino=826 scontext=u:r:untrusted_app:s0:c242,c256,c524,c768 tcontext=u:object_r:userdebug_or_eng_prop:s0 tclass=file permissive=0
--------- switch to events
09-01 18:21:22.154 17985 17985 I wm_on_destroy_called: [Token=217242718,Component Name=com.caixabank.adam.project.ofbridge.features.openfront.view.OfBridgeActivityExtendingMCA,Reason=performDestroy,time=5ms]
--------- switch to main
09-01 18:21:22.154 17985 17985 W WindowOnBackDispatcher: sendCancelIfRunning: isInProgress=false callback=android.view.ViewRootImpl$$ExternalSyntheticLambda13@6362483
09-01 18:21:22.156 19851 19851 W libc : Access denied finding property "ro.debuggable"
09-01 18:21:22.163 17985 17985 D ViewRootImpl: Skipping stats log for color mode
--------- switch to events
09-01 18:21:22.153 19851 19851 I auditd : avc=type=1400 audit(0.0:89078): avc: denied { read } for comm="which" name="u:object_r:userdebug_or_eng_prop:s0" dev="tmpfs" ino=826 scontext=u:r:untrusted_app:s0:c242,c256,c524,c768 tcontext=u:object_r:userdebug_or_eng_prop:s0 tclass=file permissive=0
--------- switch to main
09-01 18:21:22.153 19851 19851 W which : type=1400 audit(0.0:89078): avc: denied { read } for name="u:object_r:userdebug_or_eng_prop:s0" dev="tmpfs" ino=826 scontext=u:r:untrusted_app:s0:c242,c256,c524,c768 tcontext=u:object_r:userdebug_or_eng_prop:s0 tclass

Googling around I found that the error "Access denied finding property "ro.debuggable" means that the app cannot check if the OS meets security requirements..

GrapheneOS is designed with a strong focus on security and privacy. It restricts access to certain system properties, including ro.debuggable, to prevent unauthorized access and potential exploitation. This is particularly important for banking applications, which handle sensitive financial information.

The above has been generated by ChatGPT!

Since I'm not a developer I can be wrong of course.

For point 1, if you could provide evidence that this crash can happen in android stock and is exploitable, that would make my position definitively stronger..

Thanks again