> For the complete documentation index, see [llms.txt](https://learn.cypherock.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://learn.cypherock.com/design-decision/cypherock-x0-hardware-architecture/why-the-x0-cards-are-not-upgradeable.md).

# Why the X0 cards are not upgradeable

Upgradability allows a wallet provider to improve the overall wallet experience by adding newer features and bug fixes. But it also means that users have to trust their wallet provider with every update it pushes. There is a non-zero possibility that a malicious engineer working for a web3 wallet pushes a malicious software update which in turn takes away the private keys from users' wallets. We have explained this risk in more detail in[ Why the X1 cards are not upgradeable](/design-decision/cypherock-x1-hardware-architecture/why-the-x1-cards-are-not-upgradeable.md).

Cypherock X0 follows the same approach as Cypherock X1: the X0 Cards are not upgradeable. Once an X0 Card is shipped, the software running inside it cannot be changed by anyone, including Cypherock.

This matters even more for Cypherock X0, because the X0 Card is where every security-sensitive operation of the wallet takes place. Four of the five shards of every wallet are stored on the X0 Cards, and every wallet reconstruction, key derivation, and transaction signature happens inside them. Since no update can ever reach the X0 Cards, this ensures that hypothetically even if there is a malicious developer inside Cypherock, they will never be able to compromise the X0 Cards remotely.

The X0 Wallet App on the user's smartphone is updated through its official App Store and Google Play listings, like any other app. It holds only one of the five shards of each wallet, stored encrypted with a key derived from the wallet PIN.