MetaMask Ios Security Report background image
Home - Coinspect Security
MetaMaskMetaMaskiOS
Search
MetaMask logo

MetaMask

Security Score

88.5

dApp Permissions

35.0 / 35
  • Pass Confirmation for requests from WalletConnect
    9.0 / 9.0 Expand details
    Description

    Requires user confirmation for requests from WalletConnect before granting dApp access to specific RPC methods.

    • Implements WalletConnect and requires user confirmation for each dApp request. The switchChain method displays a success message but defers the actual request until another method (e.g., sendTransaction) is invoked.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass User confirmation for requests from embedded browser
    7.9 / 7.9 Expand details
    Description

    Requires user confirmation before processing privileged RPC requests from embedded browsers.

    • Has an embedded browser, it requires user confirmation before processing each DApp request

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Wallet unlock before requests
    5.5 / 5.5 Expand details
    Description

    Requires users to unlock it before processing dApp requests when in a locked state.

    • Implements Wallet Connect and, when in a locked state, it requires users to unlock the wallet to start processing requests from DApps. The switch chain method shows a success message but only sends the request when you request another method like send transaction.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Mismatching EIP-712 chainId detection
    3.5 / 3.5 Expand details
    Description

    Alerts users or rejects signing EIP-712 messages with a mismatched chain ID.

    • Yes, it shows a warning when you are signing EIP-712 if the chain ID does not match the currently active chain.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass eth_sign method disabled
    3.3 / 3.3 Expand details
    Description

    Restricts the use of the deprecated and insecure eth_sign method by default.

    • The method "eth_sign" does not exist / is not available.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Mismatching SIWE domain detection
    1.8 / 1.8 Expand details
    Description

    Warns users when the domain in a Sign-In with Ethereum (EIP-4361) message does not match the requesting dApp's origin.

    • Shows a warning about different domains or scheme mismatches when signing an EIP-4361.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Connected dApp management
    1.5 / 1.5 Expand details
    Description

    Allows users to list and revoke connected dApps.

    • It shows all connected DApps and also the chance to revoke access to them

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Token approval management
    1.5 / 1.5 Expand details
    Description

    Allows users to view and revoke token approvals.

    • The wallet allows managing approvals in Browser > Connect > Dashboard > Spending Caps.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass User confirmation before switching chains
    1.1 / 1.1 Expand details
    Description

    Requires user confirmation before switching the active chain.

    • It does not require user confirmation before executing the method, but includes the connected chains in the connect dialog.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots

Intent Verification

20.1 / 25
  • Pass Transaction simulation
    6.7 / 6.7 Expand details
    Description

    Previews the expected outcome by simulating the request execution on the blockchain before signing.

    • The wallet displays the NFT received when providing liquidity to a pool or a swap, as well as the MATIC and the USDC.e to be spent in the process

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Clear token approval dialog
    6.7 / 6.7 Expand details
    Description

    Clearly displays all the key details for ERC-20 Approve requests.

    • The wallet includes the contract address, token, effect, allowance, and contract spender address when interacting with 1inch.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots
  • Pass Clear message signing dialog
    3.8 / 3.8 Expand details
    Description

    Clearly displays all message signature request details without truncating or hiding information.

    • The wallet displays large messages in personal sign requests without truncation and shows the verifying contract in the EIP-712 object.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 5 screenshots
  • Pass EIP-712 message parsing
    2.4 / 2.4 Expand details
    Description

    Displays human-readable details for EIP-712 signature requests from well-known protocols.

    • The wallet parses EIP-712 objects for well-known contracts and protocols, such as Opensea Seaport listings and ERC-20 Permits.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 4 screenshots
  • Fail Invalid address checksum detection
    0.0 / 2.2 Expand details
    Description

    Warns users when they input addresses with invalid EIP-55 checksums.

    • The wallet allows transactions to an address with invalid checksums through dApps but prevents them within the app itself.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Fail Mandatory message review
    0.0 / 2.1 Expand details
    Description

    Requires users to review all the details before signing a message.

    • The wallet allows users to sign data before reviewing it; although they can expand to read the full message, the Sign button remains enabled.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 5 screenshots
  • Partial Links to blockchain explorers
    0.6 / 1.2 Expand details
    Description

    Consistently provides clickable links to block explorers for all key blockchain identifiers.

    • The wallet includes clickable links in the transaction history but does not provide them during the transaction-sending process.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots

Physical Access

16.7 / 20
  • Pass Seed phrase access control
    5.4 / 5.4 Expand details
    Description

    Requires authentication to access seed phrases or private keys.

    • The wallet requires a password to reveal mnemonics or private keys.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Manual wallet lock
    3.9 / 3.9 Expand details
    Description

    Allows users to lock it manually.

    • To secure your wallet, navigate to Settings and scroll down to select the “Lock” option located at the bottom of the menu.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Automatic wallet lock
    3.9 / 3.9 Expand details
    Description

    Verifies wallet auto-locks on inactivity, device lock, or background.

    • The wallet automatically locks after 30 seconds of remaining in the background but does not lock when the phone itself is locked or when the app transitions to background execution. It locks immediately upon closing the application.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Robust Authentication
    0.0 / 3.3 Expand details
    Description

    Uses strong authentication, such as resistance to trivial or commonly-used passwords. Including biometrics and rate limiting in mobile.

    • The wallet supports biometric authentication but does not require its use, permits weak passwords (1 to 8 characters), and lacks rate limiting for login attempts.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots
  • Pass Clipboard seed phrase leak prevention
    1.8 / 1.8 Expand details
    Description

    Limits exposure of secrets by restricting or warning on copying seed phrases or taking screenshots.

    • The wallet permits copying for less than a minute, accompanied by an alert, and displays a security warning upon taking a screenshot.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Seed phrase access warning
    1.8 / 1.8 Expand details
    Description

    Warns users of the risk before allowing access to seed phrases or private keys.

    • The wallet features a highly user-friendly interface that prompts users to answer several questions before revealing the mnemonics. This approach is clear and reflects the application’s commitment to preventing users from inadvertently sharing their mnemonics.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 6 screenshots

Threat Prevention

16.7 / 20
  • Pass Phishing dApp detection
    5.1 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious URL.

    • After scanning the WalletConnect QR code from the following site: https://arbitrum-token-bridge-cqjggprvn-offchain-labs.vercel.app/, the wallet does not display a warning; however, when accessed through the embedded browser, a warning is shown.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 5 screenshots
  • Pass Malicious address detection
    5.1 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious address.

    • The wallet alerts users about interactions with known phishing or scam addresses.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Fail Trusted dApp detection
    0.0 / 3.3 Expand details
    Description

    Informs users when interacting with a trusted dApp URL.

    • The wallet does not display any messages when attempting to connect to UniSwap or 1inch, whether through WalletConnect or the embedded browser.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Unknown address detection
    2.8 / 2.8 Expand details
    Description

    Warns users when interacting with an unknown address.

    • Although the wallet displays a question mark icon, it does not warn users when interacting with unknown or untrusted addresses. However, it allows them to add such addresses to their address book.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots
  • Pass Full dApp URL display
    1.5 / 1.5 Expand details
    Description

    Clearly displays the full dApp URL in the connection prompt.

    • It shows the full URL of this site https://arbitrum-token-bridge-cqjggprvn-offchain-labs.vercel.app/

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Malicious or spam token filtering
    1.3 / 1.3 Expand details
    Description

    Hides malicious tokens and NFTs by default.

    • The wallet does not display tokens (legitimate or spam) or NFTs; this functionality appears broken. Although it fails to show legitimate NFTs, it also suppresses spam NFTs.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass dApp access disclosure dialog
    1.0 / 1.0 Expand details
    Description

    Informs dApp access to balances, history, and signing requests on connection.

    • The wallet displays a message indicating that it will have access to view accounts, use enabled networks, and suggest transaction approvals when a WalletConnect QR code is scanned.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot

This ranking is for informational purposes only. It should not be relied on to provide legal, tax, financial, investment, or other types of advice. Coinspect does not guarantee or warrant the accuracy, completeness, timeliness, suitability, or validity of the information provided and will not be responsible for any claim attributable to reliance on errors, omissions, or other inaccuracies of any part of such information.