Elytro Browser Security Report background image
Home - Coinspect Security
ElytroElytroChrome
Search
Elytro logo

Elytro

Security Score

49.5

dApp Permissions

28.1 / 35
  • Pass User confirmation before processing requests
    8.7 / 8.7 Expand details
    Description

    Requires user confirmation before processing requests from dApps for specific RPC methods.

    • The wallet requires user confirmation before accessing RPC endpoints.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass User consent for dApp access
    7.7 / 7.7 Expand details
    Description

    Requires user approval before granting dApp access to specific RPC methods.

    • The wallet requires users to connect before accessing RPC endpoints.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Wallet unlock before requests
    5.6 / 5.6 Expand details
    Description

    Requires users to unlock it before processing dApp requests when in a locked state.

    • The wallet requires users to unlock it before processing requests from dApps.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Mismatching EIP-712 chainId detection
    0.0 / 3.5 Expand details
    Description

    Alerts users or rejects signing EIP-712 messages with a mismatched chain ID.

    • The wallet doesn't refuse to sign an EIP712 object with a chainId that does not match the currently active chain.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass eth_sign method disabled
    3.3 / 3.3 Expand details
    Description

    Restricts the use of the deprecated and insecure eth_sign method by default.

    • The wallet does not support the eth_sign method, or it is disabled by default.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Mismatching SIWE domain detection
    0.0 / 1.8 Expand details
    Description

    Warns users when the domain in a Sign-In with Ethereum (EIP-4361) message does not match the requesting dApp's origin.

    • The wallet does not warn users of a domain or scheme mismatch when signing a SIWE message.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Connected dApp management
    1.5 / 1.5 Expand details
    Description

    Allows users to list and revoke connected dApps.

    • The wallet displays a list of connected DApps and allows users to remove connections. The functionality operates as intended.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Token approval management
    0.0 / 1.5 Expand details
    Description

    Allows users to view and revoke token approvals.

    • The wallet does not offer a built-in or third-party option to revoke token approvals.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass User confirmation before switching chains
    1.1 / 1.1 Expand details
    Description

    Requires user confirmation before switching the active chain.

    • The wallet prompts users for confirmation before switching chains.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot

Intent Verification

2.8 / 25
  • Fail Transaction simulation
    0.0 / 6.7 Expand details
    Description

    Previews the expected outcome by simulating the request execution on the blockchain before signing.

    • The wallet doesn't provide a detailed transaction simulation, expected incomes, and outcomes before execution.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Clear token approval dialog
    0.0 / 6.7 Expand details
    Description

    Clearly displays all the key details for ERC-20 Approve requests.

    • The wallet displays the token, amount, and page URL with a link to the requesting website, but does not show the spender address in the approval transaction.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Clear message signing dialog
    0.0 / 3.8 Expand details
    Description

    Clearly displays all message signature request details without truncating or hiding information.

    • The wallet displays full messages in personal_sign requests and shows the truncated verifying contract within the EIP-712 object

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots
  • Fail EIP-712 message parsing
    0.0 / 2.4 Expand details
    Description

    Displays human-readable details for EIP-712 signature requests from well-known protocols.

    • The wallet does not parse EIP-712 objects for well-known contracts and protocols such as OpenSea Seaport listings or ERC-20 permits.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Invalid address checksum detection
    2.2 / 2.2 Expand details
    Description

    Warns users when they input addresses with invalid EIP-55 checksums.

    • The wallet does not allow sending transactions with invalid checksums when attempting to send them manually.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Fail Mandatory message review
    0.0 / 2.1 Expand details
    Description

    Requires users to review all the details before signing a message.

    • The sign button is available initially.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Partial Links to blockchain explorers
    0.6 / 1.2 Expand details
    Description

    Consistently provides clickable links to block explorers for all key blockchain identifiers.

    • The wallet provides clickable links in the history but not in the transaction preview for addresses, contracts, or transaction hashes.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots

Physical Access

14.9 / 20
  • Pass Seed phrase access control
    5.4 / 5.4 Expand details
    Description

    Requires authentication to access seed phrases or private keys.

    • The wallet provides seed phrase backup functionality and requires authentication to access the mnemonic or private keys.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots
  • Pass Manual wallet lock
    3.9 / 3.9 Expand details
    Description

    Allows users to lock it manually.

    • The wallet includes a lock button in the main menu, allowing users to lock it manually.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Automatic wallet lock
    0.0 / 3.4 Expand details
    Description

    Verifies wallet auto-locks on inactivity.

    • The wallet does not provide an auto-lock timer and does not automatically lock after approximately 20 minutes of inactivity.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Robust Authentication
    3.3 / 3.3 Expand details
    Description

    Uses strong authentication, such as resistance to trivial or commonly-used passwords. Including biometrics and rate limiting in mobile.

    • The wallet requires passwords to be at least eight characters long and prevents the use of easily guessable passwords, such as “12345678.”

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Clipboard seed phrase leak prevention
    1.8 / 1.8 Expand details
    Description

    Limits exposure of secrets by restricting or warning on copying seed phrases or taking screenshots.

    • The wallet does not allow users to copy the mnemonic, preventing it from being copied to the clipboard.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Seed phrase access warning
    0.0 / 1.8 Expand details
    Description

    Warns users of the risk before allowing access to seed phrases or private keys.

    • The wallet doesn't warn users about the risks of sharing or revealing their mnemonics or private keys.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot

Threat Prevention

3.8 / 20
  • Fail Phishing dApp detection
    0.0 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious URL.

    • The wallet doesn't display a warning message when users attempt to visit dApps flagged as malicious.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Malicious address detection
    0.0 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious address.

    • The wallet doesn't warn the user about a deceptive address while trying to send funds to the Tornado Cash Attacker address.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Fail Trusted dApp detection
    0.0 / 3.3 Expand details
    Description

    Informs users when interacting with a trusted dApp URL.

    • The wallet does not notify the user when attempting to connect to a well-known, verified URL such as Uniswap.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Unknown address detection
    0.0 / 2.8 Expand details
    Description

    Warns users when interacting with an unknown address.

    • The wallet does not inform the user that he is interacting with an unknown address.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Full dApp URL display
    1.5 / 1.5 Expand details
    Description

    Clearly displays the full dApp URL in the connection prompt.

    • The wallet displays the dApp’s full origin URL.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Malicious or spam token filtering
    1.3 / 1.3 Expand details
    Description

    Hides malicious tokens and NFTs by default.

    • The wallet lacks an NFT section.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass dApp access disclosure dialog
    1.0 / 1.0 Expand details
    Description

    Informs dApp access to balances, history, and signing requests on connection.

    • The wallet informs users within the connection dialog that connecting allows the dApp to view their wallet balance, activity, and send approval requests.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot

This ranking is for informational purposes only. It should not be relied on to provide legal, tax, financial, investment, or other types of advice. Coinspect does not guarantee or warrant the accuracy, completeness, timeliness, suitability, or validity of the information provided and will not be responsible for any claim attributable to reliance on errors, omissions, or other inaccuracies of any part of such information.