New Wallet Testing Tool

Don’t trust, verify.

Today, we’re open-sourcing the Wallet Security Ranking (WSR) testing tool, developed by Coinspect to test browser extensions and mobile wallets.

You can use it to run the same security checks on any wallet by following step-by-step instructions and verifying how the tested application behaves.

A Security Checks Wizard

We built the wizard around the public checks behind WSR, turning their testing instructions into guided steps. Anyone can review what each check tests, its evaluation criteria, and the evidence it requires.

Choose between Extension and Mobile, then open a check from the index.

The wizard breaks the procedure into steps, with guidance on what to do, what to look for, and which observations to capture. Some steps send a request from the dApp. Others take place inside the wallet, such as checking its lock settings or inspecting a transaction screen.

Address Poisoning in Practice

The address-poisoning flow is one example. It guides you through establishing a familiar recipient in the wallet’s transaction history and then requesting a transaction to a lookalike address.

You can inspect whether the wallet warns about the similar recipient and how it displays the addresses.

Documented Test Parameters

The wizard uses predefined, documented parameters to run actions through the dApp. Depending on the check, these include the method, network, recipient address, and other request details.

This lets you see which parameters are used for each action and examine how the wallet responds.

Review and Export Evidence

Use Export evidence to download the records collected during your session as a JSON file. You can keep them for later review or share them when discussing a result with a stakeholder.

Observations of the wallet’s screens are recorded separately by the tester. You assess the behavior against the published criteria; the wizard does not automatically assign a security score.

We use this evidence with our AI Reviewer, an agent that helps us review the results of each check.

For Wallet Teams and Researchers

Wallet teams can run the tool locally to reproduce our findings, test a fix, and repeat checks after an update as part of their existing testing process.

We welcome collaboration to review test cases and develop checks for new features and attack scenarios. We’re open to evaluating proposals together to keep the checklist relevant as wallets evolve.

Looking Ahead

Our next goal is to automate the full testing process with AI agents. This includes following the wizard’s instructions, interacting with the wallet, evaluating its behavior, and documenting the results across the checks covered by the wizard.