Technology1 min read

Bastion: A Hardened Bank Template, and Crypto Wallets in Core

By · Published by Everything Blog

In short

The architecture provides a dual-environment virtual bank and exchange enabling users to manage fiat, bitcoin, and ether alongside standard account operations like card issuance. Client transactions are secured through cryptographic P-256 signing and single-use nonces, complemented by certificate pinning and WebAuthn authentication. Institutional governance relies on a double-entry ledger combined with a hash-chained audit log that exports to CSV. Core wallet functionalities execute across both mobile and server environments without relying on third-party cryptographic libraries.

Key points

  • Institutions gain a unified Java-based blueprint that bridges traditional fiat banking se…: Institutions gain a unified Java-based blueprint that bridges traditional fiat banking services with bitcoin and ether exchange capabilities.
  • Native cryptocurrency wallet functions operate using identical shared classes across clie…: Native cryptocurrency wallet functions operate using identical shared classes across client and backend systems without external libraries.
  • The framework incorporates defensive measures including tapjacking prevention, clipboard…: The framework incorporates defensive measures including tapjacking prevention, clipboard clearing, and an honest Security Center displaying active protections.

Sources checked by our analysis pipeline: 1

A large share of the teams building on Codename One are banks and financial institutions. They don’t ask me for a prettier list component. They ask how to pass a penetration test, what the auditor will want to see, and which protections actually work on which device.

Bastion is my answer, written as code. It’s a virtual bank and a small exchange, the app and its server in one Java project. Customers hold dollars, euros, bitcoin and ether, move money, issue and freeze cards, trade, and withdraw coins to addresses they’ve allowed in advance. Staff verify the ledger and the audit trail. It’s a template you can brand, but mostly it’s a reference: every hardening technique in it is there so you can read how it’s done.

Defense in layers

No single protection makes an app secure. Bastion stacks them, so an attacker who gets past one meets the next.

Signing in. OAuth authorization code with PKCE, five minute access tokens and rotating twelve hour refresh tokens. A TOTP second factor with ten recovery codes, plus WebAuthn passkeys. Once an…

Technology