Tomo

Tomo

Chrome
·
v2.0.2
·
Last updated on Jan 12, 2026

Also on

Android

iOS

Security Score

71.4

dApp Permissions

31.6 / 35

User confirmation before processing requests

8.7 / 8.7
Description
Requires user confirmation before processing requests from dApps for specific RPC methods.
- The wallet requires user confirmation for every request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
User consent for dApp access

7.7 / 7.7
Description
Requires user approval before granting dApp access to specific RPC methods.
- The wallet requires a user connection for every request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Wallet unlock before requests

5.6 / 5.6
Description
Requires users to unlock it before processing dApp requests when in a locked state.
- The wallet requires the user to unlock the wallet for every request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Mismatching EIP-712 chainId detection

3.5 / 3.5
Description
Alerts users or rejects signing EIP-712 messages with a mismatched chain ID.
- The wallet refuses to sign an EIP-712 object with a chain id that does not match the currently active chain.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
eth_sign method disabled

3.3 / 3.3
Description
Restricts the use of the deprecated and insecure eth_sign method by default.
- The `eth_sign` method is disabled by default.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Mismatching SIWE domain detection

0.0 / 1.8
Description
Warns users when the domain in a Sign-In with Ethereum (EIP-4361) message does not match the requesting dApp's origin.
- The wallet did not emit any warnings to the user when signing a message with a domain or scheme mismatch.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Connected dApp management

1.5 / 1.5
Description
Allows users to list and revoke connected dApps.
- The wallet displays a list of connected dApps and provides the option to disconnect from them either individually or all at once.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Token approval management

0.0 / 1.5
Description
Allows users to view and revoke token approvals.
- Wallet lacks built-in token allowance revocation. No in-app redirection to third-party services for this function was detected.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
User confirmation before switching chains

1.1 / 1.1
Description
Requires user confirmation before switching the active chain.
- The wallet requires user confirmation before switching chains.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Nov 14, 2025
Report an issue with this check

Intent Verification

8.7 / 25

Transaction simulation

0.0 / 6.7
Description
Previews the expected outcome by simulating the request execution on the blockchain before signing.
- The wallet does not offer transaction simulation, as it is not displaying all the incomes and outcomes of the transaction.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Clear token approval dialog

0.0 / 6.7
Description
Clearly displays all the key details for ERC-20 Approve requests.
- The wallet displays the spender address, token, and amount but does not include the function. It is unclear who is receiving the approval, and it shows a large number instead of indicating 'Unlimited' for the amount of the token being approved.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Clear message signing dialog

3.8 / 3.8
Description
Clearly displays all message signature request details without truncating or hiding information.
- The verifying contract is displayed in the EIP-712 object, and the wallet does not truncate large inputs in a personal sign request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 3 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
EIP-712 message parsing

0.0 / 2.4
Description
Displays human-readable details for EIP-712 signature requests from well-known protocols.
- The wallet does not parse EIP-712 objects from well-known contracts and protocols.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Invalid address checksum detection

2.2 / 2.2
Description
Warns users when they input addresses with invalid EIP-55 checksums.
- The wallet successfully prevents the user from sending transactions with invalid checksum addresses in both scenarios, through the dApp and within the wallet itself.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Mandatory message review

2.1 / 2.1
Description
Requires users to review all the details before signing a message.
- The wallet forces the user to scroll down on large messages before signing in personal sign, though the Sign button is slightly clipped. This issue does not occur when signing an EIP-712 object.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 3 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Links to blockchain explorers

0.6 / 1.2
Description
Consistently provides clickable links to block explorers for all key blockchain identifiers.
- The wallet provides a link to the dApp requesting the transaction in the transaction preview and displays the transaction hash in the wallet history.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check

Physical Access

18.2 / 20

Seed phrase access control

5.4 / 5.4
Description
Requires authentication to access seed phrases or private keys.
- The wallet provides seed-phrase backup functionality and requires authentication to access mnemonics.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Manual wallet lock

3.9 / 3.9
Description
Allows users to lock it manually.
- The wallet features a lock button to lock it manually in the main menu.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Automatic wallet lock

3.4 / 3.4
Description
Verifies wallet auto-locks on inactivity.
- The wallet does not have an auto-lock option in the settings menu, but it locks itself after 20 minutes of inactivity.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Robust Authentication

3.3 / 3.3
Description
Uses strong authentication, such as resistance to trivial or commonly-used passwords. Including biometrics and rate limiting in mobile.
- The wallet enforces an 8-character password with letters, numbers, and a special character, preventing easy-to-guess passwords like 11111111 or 12345678.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Clipboard seed phrase leak prevention

0.0 / 1.8
Description
Limits exposure of secrets by restricting or warning on copying seed phrases or taking screenshots.
- The wallet allows copying mnemonics to the clipboard for over a minute without providing any warning about the risks.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Seed phrase access warning

1.8 / 1.8
Description
Warns users of the risk before allowing access to seed phrases or private keys.
- The wallet warns users about the risks of sharing mnemonics through an "Important" message, which is hidden by default, and reveals a warning when clicked.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check

Threat Prevention

12.9 / 20

Phishing dApp detection

5.1 / 5.1
Description
Prevents or alerts users about interactions with a known malicious URL.
- The wallet effectively warns users within the connection dialog when they attempt to access a malicious dApp.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Malicious address detection

5.1 / 5.1
Description
Prevents or alerts users about interactions with a known malicious address.
- The wallet successfully warns the user about a deceptive address while trying to send funds to the Tornado Cash Attacker address.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Trusted dApp detection

0.0 / 3.3
Description
Informs users when interacting with a trusted dApp URL.
- The wallet does not inform the user when they are connecting to a well-known verified URL.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Unknown address detection

0.0 / 2.8
Description
Warns users when interacting with an unknown address.
- The wallet does not inform the user when attempting to send a transaction to an address that has not been previously interacted with.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Nov 17, 2025
Report an issue with this check
Full dApp URL display

1.5 / 1.5
Description
Clearly displays the full dApp URL in the connection prompt.
- The wallet displays the dApp URL in full within the connection dialog when attempting to connect.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Malicious or spam token filtering

1.3 / 1.3
Description
Hides malicious tokens and NFTs by default.
- The wallet does not display a list of NFTs owned by the user.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
dApp access disclosure dialog

0.0 / 1.0
Description
Informs dApp access to balances, history, and signing requests on connection.
- The wallet does not inform users about the permissions or actions the dApp will have after connecting.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check

This ranking is for informational purposes only. It should not be relied on to provide legal, tax, financial, investment, or other types of advice. Coinspect does not guarantee or warrant the accuracy, completeness, timeliness, suitability, or validity of the information provided and will not be responsible for any claim attributable to reliance on errors, omissions, or other inaccuracies of any part of such information.