Tomo

Tomo

iOS
·
v4.2.4
·
Last updated on Dec 3, 2025

Also on

Android

Chrome

Security Score

46.2

dApp Permissions

26.7 / 35

Confirmation for requests from WalletConnect

9.0 / 9.0
Description
Requires user confirmation for requests from WalletConnect before granting dApp access to specific RPC methods.
- When receiving requests from the DApp, the wallet only asks for confirmation via Face ID for all methods, without displaying any message or warning.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
User confirmation for requests from embedded browser

7.9 / 7.9
Description
Requires user confirmation before processing privileged RPC requests from embedded browsers.
- When receiving requests from the DApp, the wallet only asks for confirmation via Face ID for all methods, without displaying any message or warning.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Wallet unlock before requests

5.5 / 5.5
Description
Requires users to unlock it before processing dApp requests when in a locked state.
- Locking the wallet automatically disconnects it from the DApp.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Mismatching EIP-712 chainId detection

0.0 / 3.5
Description
Alerts users or rejects signing EIP-712 messages with a mismatched chain ID.
- When attempting to sign the EIP-712 requests, the wallet doesn’t display any message or warning—it only prompts for Face ID to confirm the request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
eth_sign method disabled

3.3 / 3.3
Description
Restricts the use of the deprecated and insecure eth_sign method by default.
- The `eth_sign` method is disabled by default.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Mismatching SIWE domain detection

0.0 / 1.8
Description
Warns users when the domain in a Sign-In with Ethereum (EIP-4361) message does not match the requesting dApp's origin.
- When attempting to sign the EIP-4361 (SIWE) requests, the wallet doesn’t display any message or warning—it only prompts for Face ID to confirm the request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Connected dApp management

0.0 / 1.5
Description
Allows users to list and revoke connected dApps.
- Connection via WalletConnect by scanning the QR code appears to be broken, while connecting through the embedded browser works but does not prompt any permission request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Token approval management

0.0 / 1.5
Description
Allows users to view and revoke token approvals.
- The wallet doesn't offer the ability to list and revoke token approvals via in-app functionality or links to external DApps.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
User confirmation before switching chains

1.1 / 1.1
Description
Requires user confirmation before switching the active chain.
- The wallet displays an “UNDEFINED” message when the switch_chain method is called and does not allow the chain to be changed.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Nov 14, 2025
Report an issue with this check

Intent Verification

2.8 / 25

Transaction simulation

0.0 / 6.7
Description
Previews the expected outcome by simulating the request execution on the blockchain before signing.
- When attempting to sign the pool requests, the wallet doesn’t display any message or warning—it only prompts for Face ID to confirm the request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Clear token approval dialog

0.0 / 6.7
Description
Clearly displays all the key details for ERC-20 Approve requests.
- When attempting to sign the approval, the wallet doesn’t display any message or warning—it only prompts for Face ID to confirm the request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Clear message signing dialog

0.0 / 3.8
Description
Clearly displays all message signature request details without truncating or hiding information.
- When attempting to sign the eth_personalSign or any eth_signTypedData requests, the wallet doesn’t display any message or warning—it only prompts for Face ID to confirm the request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
EIP-712 message parsing

0.0 / 2.4
Description
Displays human-readable details for EIP-712 signature requests from well-known protocols.
- When attempting to sign the eth_personalSign or any eth_signTypedData requests, the wallet doesn’t display any message or warning—it only prompts for Face ID to confirm the request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Invalid address checksum detection

2.2 / 2.2
Description
Warns users when they input addresses with invalid EIP-55 checksums.
- The wallet doesn't allow users to send a transaction with invalid checksums, and it emits a warning about it.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Mandatory message review

0.0 / 2.1
Description
Requires users to review all the details before signing a message.
- When attempting to sign the eth_personalSign or any eth_signTypedData requests, the wallet doesn’t display any message or warning—it only prompts for Face ID to confirm the request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Links to blockchain explorers

0.6 / 1.2
Description
Consistently provides clickable links to block explorers for all key blockchain identifiers.
- Clicking on the transfer takes you directly to PolygonScan. When attempting to sign the send transaction requests, the wallet doesn’t display any message or warning—it only prompts for Face ID to confirm the request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check

Physical Access

14.4 / 20

Seed phrase access control

5.4 / 5.4
Description
Requires authentication to access seed phrases or private keys.
- In the wallet management settings, clicking the “View seed phrase” button prompts a window requiring the password to reveal the seed phrase.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Manual wallet lock

3.9 / 3.9
Description
Allows users to lock it manually.
- The wallet doesn't include a manual lock button, but logging in again is required to regain access.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Automatic wallet lock

0.0 / 3.9
Description
Verifies wallet auto-locks on inactivity, device lock, or background.
- The wallet lacks an option to configure automatic locking and only locks when the app is closed.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Robust Authentication

3.3 / 3.3
Description
Uses strong authentication, such as resistance to trivial or commonly-used passwords. Including biometrics and rate limiting in mobile.
- The wallet requires a password of at least 6 characters but allows easily guessable ones. It supports biometrics and enforces rate limiting after the fifth failed attempt.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 5 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Clipboard seed phrase leak prevention

0.0 / 1.8
Description
Limits exposure of secrets by restricting or warning on copying seed phrases or taking screenshots.
- The wallet does not allow copying the seed phrase but does not prevent or warn against taking screenshots.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Seed phrase access warning

1.8 / 1.8
Description
Warns users of the risk before allowing access to seed phrases or private keys.
- In both the password entry window and the seed phrase display screen, a clear warning is shown indicating that sharing the phrase can give others access to your wallet and funds.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check

Threat Prevention

2.2 / 20

Phishing dApp detection

0.0 / 5.1
Description
Prevents or alerts users about interactions with a known malicious URL.
- The wallet does not alert when visiting or attempting to connect to malicious sites like https://arbitrum-token-bridge-cqjggprvn-offchain-labs.vercel.app/ or https://trustdappmodal.pages.dev/. Connection via WalletConnect by scanning the QR code appears to be broken, while connecting through the embedded browser works but does not prompt any permission request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Malicious address detection

0.0 / 5.1
Description
Prevents or alerts users about interactions with a known malicious address.
- When attempting to sign the transaction requests, the wallet doesn’t display any message or warning—it only prompts for Face ID to confirm the request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Trusted dApp detection

0.0 / 3.3
Description
Informs users when interacting with a trusted dApp URL.
- The wallet does not inform users when they are interacting with well-known, verified URLs (DApps) like Uniswap or 1inch. Connection via WalletConnect by scanning the QR code appears to be broken, while connecting through the embedded browser works, but does not prompt any permission request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Unknown address detection

0.0 / 2.8
Description
Warns users when interacting with an unknown address.
- When attempting to sign the transaction requests, the wallet doesn’t display any message or warning—it only prompts for Face ID to confirm the request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Nov 17, 2025
Report an issue with this check
Full dApp URL display

0.0 / 1.5
Description
Clearly displays the full dApp URL in the connection prompt.
- The wallet does not inform users when they are interacting with well-known, verified URLs (DApps) like Uniswap or 1inch,
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Malicious or spam token filtering

1.3 / 1.3
Description
Hides malicious tokens and NFTs by default.
- The wallet does not include a dedicated NFT section.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
dApp access disclosure dialog

1.0 / 1.0
Description
Informs dApp access to balances, history, and signing requests on connection.
- Connection via WalletConnect by scanning the QR code appears to be broken, while connecting through the embedded browser works, and requires viewing the wallet balance and activity, as well as requesting transactions.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check

This ranking is for informational purposes only. It should not be relied on to provide legal, tax, financial, investment, or other types of advice. Coinspect does not guarantee or warrant the accuracy, completeness, timeliness, suitability, or validity of the information provided and will not be responsible for any claim attributable to reliance on errors, omissions, or other inaccuracies of any part of such information.