Exodus Ios Security Report background image
Home - Coinspect Security
ExodusExodusiOS
Search
Exodus logo

Exodus

Security Score

45.2

dApp Permissions

27.3 / 35
  • Pass Confirmation for requests from WalletConnect
    9.0 / 9.0 Expand details
    Description

    Requires user confirmation for requests from WalletConnect before granting dApp access to specific RPC methods.

    • The wallet implements WalletConnect and requires user confirmation before processing each dApp request.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass User confirmation for requests from embedded browser
    7.9 / 7.9 Expand details
    Description

    Requires user confirmation before processing privileged RPC requests from embedded browsers.

    • Has an embedded browser and requires user confirmation before processing each DApp request

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Wallet unlock before requests
    5.5 / 5.5 Expand details
    Description

    Requires users to unlock it before processing dApp requests when in a locked state.

    • Implements Wallet Connect and, when in locked state, shows the request; it requires users to unlock the wallet to process requests from DApps

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Mismatching EIP-712 chainId detection
    3.5 / 3.5 Expand details
    Description

    Alerts users or rejects signing EIP-712 messages with a mismatched chain ID.

    • The wallet refuses to sign EIP-712 messages when the chain ID doesn't match the currently active chain.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Fail eth_sign method disabled
    0.0 / 3.3 Expand details
    Description

    Restricts the use of the deprecated and insecure eth_sign method by default.

    • The 'eth_sign' method is enabled by default

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Fail Mismatching SIWE domain detection
    0.0 / 1.8 Expand details
    Description

    Warns users when the domain in a Sign-In with Ethereum (EIP-4361) message does not match the requesting dApp's origin.

    • Doesn't show a warning about different domain or scheme mismatches when signing an EIP-4361.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Connected dApp management
    1.5 / 1.5 Expand details
    Description

    Allows users to list and revoke connected dApps.

    • It shows all connected DApps and also the chance to revoke access to them

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Token approval management
    0.0 / 1.5 Expand details
    Description

    Allows users to view and revoke token approvals.

    • The wallet displays token approvals but lacks the functionality to revoke them.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Fail User confirmation before switching chains
    0.0 / 1.1 Expand details
    Description

    Requires user confirmation before switching the active chain.

    • It doesn’t require user confirmation before processing requests, and it doesn’t provide a list of available chains in the connect dialog.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots

Intent Verification

2.8 / 25
  • Fail Transaction simulation
    0.0 / 6.7 Expand details
    Description

    Previews the expected outcome by simulating the request execution on the blockchain before signing.

    • The wallet fails to display the incoming and outgoing amounts for swap and pool transactions.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Clear token approval dialog
    0.0 / 6.7 Expand details
    Description

    Clearly displays all the key details for ERC-20 Approve requests.

    • The 1inch approval process does not include any required information like the contract address, token details, allowance, or spender information.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Clear message signing dialog
    0.0 / 3.8 Expand details
    Description

    Clearly displays all message signature request details without truncating or hiding information.

    • The wallet does not display full EIP712Domain information, nor show or interpret the verifyingContract address but shows the personal_sign with a large message.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots
  • Fail EIP-712 message parsing
    0.0 / 2.4 Expand details
    Description

    Displays human-readable details for EIP-712 signature requests from well-known protocols.

    • The wallet displays plain data instead of parsing it for ERC20 Permit or OpenSea listing transactions.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Invalid address checksum detection
    2.2 / 2.2 Expand details
    Description

    Warns users when they input addresses with invalid EIP-55 checksums.

    • The wallet fails to alert users about dApp requests with addresses containing invalid checksums, but it doesn’t process the request or complete the transaction. Manually sending to an address with an invalid checksum using the wallet is not possible.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Fail Mandatory message review
    0.0 / 2.1 Expand details
    Description

    Requires users to review all the details before signing a message.

    • The sign button is available from the start

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Partial Links to blockchain explorers
    0.6 / 1.2 Expand details
    Description

    Consistently provides clickable links to block explorers for all key blockchain identifiers.

    • The wallet includes clickable links in the transaction history, but not during the process of sending a transaction.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots

Physical Access

12.3 / 20
  • Pass Seed phrase access control
    5.4 / 5.4 Expand details
    Description

    Requires authentication to access seed phrases or private keys.

    • By default, the wallet has no authentication. However, if protection is activated, after confirming, the wallet requires a password to view mnemonics or private keys.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Manual wallet lock
    0.0 / 3.9 Expand details
    Description

    Allows users to lock it manually.

    • The wallet can be manually locked when leaving the app, but it doesn't have a button to lock the wallet.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Automatic wallet lock
    0.0 / 3.9 Expand details
    Description

    Verifies wallet auto-locks on inactivity, device lock, or background.

    • The wallet by default doesn't auto-lock immediately when the app is moved to background execution, but if you need it, you can activate it, and it locks instantly. The wallet doesn't auto-lock on inactivity, device lock, or background execution without user configuration.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Robust Authentication
    3.3 / 3.3 Expand details
    Description

    Uses strong authentication, such as resistance to trivial or commonly-used passwords. Including biometrics and rate limiting in mobile.

    • By default, it has no authentication mechanism, but you can enable Passcode and Face ID. It accepts simple codes like 123456 but enforces rate limiting after the fifth attempt.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Clipboard seed phrase leak prevention
    1.8 / 1.8 Expand details
    Description

    Limits exposure of secrets by restricting or warning on copying seed phrases or taking screenshots.

    • The wallet warns the user about the risks of taking screenshot captures and doesn't allow copying to the clipboard.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Seed phrase access warning
    1.8 / 1.8 Expand details
    Description

    Warns users of the risk before allowing access to seed phrases or private keys.

    • The wallet shows a brief warning about sharing both before and during the viewing of mnemonics or private keys.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots

Threat Prevention

2.8 / 20
  • Fail Phishing dApp detection
    0.0 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious URL.

    • The wallet does not alert users about connections to known phishing dApps like https://arbitrum-token-bridge-cqjggprvn-offchain-labs.vercel.app/

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Malicious address detection
    0.0 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious address.

    • The wallet does not alert users about interactions with known phishing or scam addresses.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Trusted dApp detection
    0.0 / 3.3 Expand details
    Description

    Informs users when interacting with a trusted dApp URL.

    • The wallet doesn't show any messages when I'm trying to connect to Uniswap

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Unknown address detection
    0.0 / 2.8 Expand details
    Description

    Warns users when interacting with an unknown address.

    • The wallet does not warn users when they interact with an unknown or untrusted address.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Full dApp URL display
    1.5 / 1.5 Expand details
    Description

    Clearly displays the full dApp URL in the connection prompt.

    • The wallet displays the full URL of the dApp the user is attempting to connect to.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Malicious or spam token filtering
    1.3 / 1.3 Expand details
    Description

    Hides malicious tokens and NFTs by default.

    • The wallet hides spam or scam tokens and NFTs sent to the address and provides a message in case you wish to view them anyway.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail dApp access disclosure dialog
    0.0 / 1.0 Expand details
    Description

    Informs dApp access to balances, history, and signing requests on connection.

    • The wallet does not clearly display messages for viewing balance, activity, or requesting transaction approvals. It only shows messages for viewing the address.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot

This ranking is for informational purposes only. It should not be relied on to provide legal, tax, financial, investment, or other types of advice. Coinspect does not guarantee or warrant the accuracy, completeness, timeliness, suitability, or validity of the information provided and will not be responsible for any claim attributable to reliance on errors, omissions, or other inaccuracies of any part of such information.