Coinbase Wallet Browser Security Report background image
Home - Coinspect Security
Coinbase WalletCoinbase WalletChrome
Search
Coinbase Wallet logo

Coinbase Wallet

Security Score

80.1

dApp Permissions

28.4 / 35
  • Pass User confirmation before processing requests
    8.7 / 8.7 Expand details
    Description

    Requires user confirmation before processing requests from dApps for specific RPC methods.

    • The wallet requires user confirmation for every request.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass User consent for dApp access
    7.7 / 7.7 Expand details
    Description

    Requires user approval before granting dApp access to specific RPC methods.

    • The wallet requires a user connection for every request.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Wallet unlock before requests
    5.6 / 5.6 Expand details
    Description

    Requires users to unlock it before processing dApp requests when in a locked state.

    • The wallet requires the user to unlock it for every request.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Mismatching EIP-712 chainId detection
    0.0 / 3.5 Expand details
    Description

    Alerts users or rejects signing EIP-712 messages with a mismatched chain ID.

    • The wallet does not refuse or deny signing an EIP-712 object with different chain IDs.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass eth_sign method disabled
    3.3 / 3.3 Expand details
    Description

    Restricts the use of the deprecated and insecure eth_sign method by default.

    • The `eth_sign` method is disabled by default.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Mismatching SIWE domain detection
    0.0 / 1.8 Expand details
    Description

    Warns users when the domain in a Sign-In with Ethereum (EIP-4361) message does not match the requesting dApp's origin.

    • The wallet does not warn users about domain or scheme mismatches when signing a SIWE message.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Connected dApp management
    1.5 / 1.5 Expand details
    Description

    Allows users to list and revoke connected dApps.

    • The wallet displays a list of connected dApps and provides the option to disconnect from them either individually or all at once.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Token approval management
    1.5 / 1.5 Expand details
    Description

    Allows users to view and revoke token approvals.

    • The wallet allows users to revoke token approvals through its own built-in revocation system.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail User confirmation before switching chains
    0.0 / 1.1 Expand details
    Description

    Requires user confirmation before switching the active chain.

    • The wallet switches chains without requesting user confirmation.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot

Intent Verification

22.9 / 25
  • Pass Transaction simulation
    6.7 / 6.7 Expand details
    Description

    Previews the expected outcome by simulating the request execution on the blockchain before signing.

    • The wallet offers transaction simulation, displaying the incomes and outcomes of the transaction.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Clear token approval dialog
    6.7 / 6.7 Expand details
    Description

    Clearly displays all the key details for ERC-20 Approve requests.

    • It shows all the required information such as token, allowance, contract address, spender address and effect.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Clear message signing dialog
    3.8 / 3.8 Expand details
    Description

    Clearly displays all message signature request details without truncating or hiding information.

    • The verifying contract is displayed in the EIP-712 object, and the wallet does not truncate large inputs in a personal sign request.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass EIP-712 message parsing
    2.4 / 2.4 Expand details
    Description

    Displays human-readable details for EIP-712 signature requests from well-known protocols.

    • The wallet successfully parses the EIP-712 OpenSea contract and blocks the ERC20 permit.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Invalid address checksum detection
    2.2 / 2.2 Expand details
    Description

    Warns users when they input addresses with invalid EIP-55 checksums.

    • The wallet warns the user sending a transaction with an address containing invalid checksums.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Fail Mandatory message review
    0.0 / 2.1 Expand details
    Description

    Requires users to review all the details before signing a message.

    • When signing a personal message with a large input, the button remains available at all times.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Links to blockchain explorers
    1.2 / 1.2 Expand details
    Description

    Consistently provides clickable links to block explorers for all key blockchain identifiers.

    • The wallet includes clickable links in both historical transactions and ongoing transactions.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots

Physical Access

14.9 / 20
  • Pass Seed phrase access control
    5.4 / 5.4 Expand details
    Description

    Requires authentication to access seed phrases or private keys.

    • The wallet supports seed phrase backup functionality and it enforces authentication to display the mnemonics or private keys.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Manual wallet lock
    3.9 / 3.9 Expand details
    Description

    Allows users to lock it manually.

    • The wallet includes a manual lock button in the settings menu.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Automatic wallet lock
    0.0 / 3.4 Expand details
    Description

    Verifies wallet auto-locks on inactivity.

    • The wallet offers auto-lock options, but by default, it is set to activate after 24 hours of inactivity.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Robust Authentication
    3.3 / 3.3 Expand details
    Description

    Uses strong authentication, such as resistance to trivial or commonly-used passwords. Including biometrics and rate limiting in mobile.

    • The wallet requires users to create an 8-digit password and prevents the use of easily guessable passwords like "12345678."

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Clipboard seed phrase leak prevention
    0.0 / 1.8 Expand details
    Description

    Limits exposure of secrets by restricting or warning on copying seed phrases or taking screenshots.

    • The wallet does not explicitly warn the user about the risks of copying mnemonics or the private key to the clipboard for more than a minute

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Seed phrase access warning
    1.8 / 1.8 Expand details
    Description

    Warns users of the risk before allowing access to seed phrases or private keys.

    • The wallet displays a warning in the mnemonics interface, informing the user about the risks of sharing their mnemonics.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot

Threat Prevention

13.9 / 20
  • Pass Phishing dApp detection
    5.1 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious URL.

    • The wallet makes a strong effort to prevent users from connecting to phishing dApps.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Malicious address detection
    5.1 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious address.

    • The wallet successfully warns the user when attempting to send a transaction to a well-known scam address, such as the Tornado Cash Attacker address.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Trusted dApp detection
    0.0 / 3.3 Expand details
    Description

    Informs users when interacting with a trusted dApp URL.

    • The wallet does not inform the user when they are connecting to a well-known verified URL.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Unknown address detection
    0.0 / 2.8 Expand details
    Description

    Warns users when interacting with an unknown address.

    • The wallet does not warn the user when interacting with an unknown address.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Full dApp URL display
    1.5 / 1.5 Expand details
    Description

    Clearly displays the full dApp URL in the connection prompt.

    • The dApp origin URL is displayed in full without truncation.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Malicious or spam token filtering
    1.3 / 1.3 Expand details
    Description

    Hides malicious tokens and NFTs by default.

    • The wallet successfully filters out scam and spam NFTs from the list.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass dApp access disclosure dialog
    1.0 / 1.0 Expand details
    Description

    Informs dApp access to balances, history, and signing requests on connection.

    • The wallet clearly informs users within the connection dialog about the permissions being granted to the dApp, such as viewing wallet balance, transaction activity, and requesting transaction approvals.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot

This ranking is for informational purposes only. It should not be relied on to provide legal, tax, financial, investment, or other types of advice. Coinspect does not guarantee or warrant the accuracy, completeness, timeliness, suitability, or validity of the information provided and will not be responsible for any claim attributable to reliance on errors, omissions, or other inaccuracies of any part of such information.