Trust Wallet Chrome Security Report background image
Home - Coinspect Security
Trust WalletTrust WalletChrome
Search
Trust Wallet logo

Trust Wallet

Also on Android Android iOS iOS
Security Score

62.0

dApp Permissions

33.1 / 35
  • Pass User confirmation before processing requests
    8.7 / 8.7 Expand details
    Description

    Requires user confirmation before processing requests from dApps for specific RPC methods.

    • The wallet requires user confirmation before switching chains.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-52e6e4d1.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass User consent for dApp access
    7.7 / 7.7 Expand details
    Description

    Requires user approval before granting dApp access to specific RPC methods.

    • The wallet requires user connection to access the RPC endpoints.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-d96bcc92.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass Wallet unlock before requests
    5.6 / 5.6 Expand details
    Description

    Requires users to unlock it before processing dApp requests when in a locked state.

    • The wallet requires user to unlock to access the RPC endpoints.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-4a8d2600.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass Mismatching EIP-712 chainId detection
    3.5 / 3.5 Expand details
    Description

    Alerts users or rejects signing EIP-712 messages with a mismatched chain ID.

    • The wallet displays an error message: "Provided chainId does not match the currently active chain" when attempting to sign an EIP-712 object with a different chainId.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-c7316505.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass eth_sign method disabled
    3.3 / 3.3 Expand details
    Description

    Restricts the use of the deprecated and insecure eth_sign method by default.

    • The wallet rejects `eth_sign` requests with an "ETH_SIGN_DISABLED" error.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-307f339d.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Fail Mismatching SIWE domain detection
    0.0 / 1.9 Expand details
    Description

    Warns users when the domain in a Sign-In with Ethereum (EIP-4361) message does not match the requesting dApp's origin.

    • The wallet does not warn users of a domain or scheme mismatch when signing a SIWE message.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 2 screenshots
    trust-wallet-browser-2.90.2-1dfbbd71.pngtrust-wallet-browser-2.90.2-55ee6f0b.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass Token approval management
    1.6 / 1.6 Expand details
    Description

    Allows users to view and revoke token approvals.

    • The wallet UI provides a way to list existing token approvals and revoke them.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 2 screenshots
    trust-wallet-browser-2.90.2-5934bd72.pngtrust-wallet-browser-2.90.2-bfadf219.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass Connected dApp management
    1.5 / 1.5 Expand details
    Description

    Allows users to list and revoke connected dApps.

    • The wallet lists connected dApps and revoking access prevents further RPC requests from the disconnected dApp.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 2 screenshots
    trust-wallet-browser-2.90.2-6615a4b4.pngtrust-wallet-browser-2.90.2-6e7b60d8.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass User confirmation before switching chains
    1.2 / 1.2 Expand details
    Description

    Requires user confirmation before switching the active chain.

    • The wallet prompts the user for confirmation before switching networks.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-0866af0e.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check

Intent Verification

1.2 / 25
  • Fail Transaction simulation
    0.0 / 6.7 Expand details
    Description

    Previews the expected outcome by simulating the request execution on the blockchain before signing.

    • The wallet does not leverage transaction simulation for either swaps or adding liquidity to the pool, meaning that it does not display the incoming and outgoing amounts of the transaction.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-6626a46d.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Fail Clear token approval dialog
    0.0 / 6.7 Expand details
    Description

    Clearly displays all the key details for ERC-20 Approve requests.

    • The wallet clearly displays the token (Native USD Coin) and the approved amount (Unlimited), but it does not show the spender address.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-690aec59.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Fail Clear message signing dialog
    0.0 / 3.8 Expand details
    Description

    Clearly displays all message signature request details without truncating or hiding information.

    • The wallet successfully displays and allows scrolling of large payloads for both personal_sign and eth_signTypedData. However, for EIP-712 objects, the EIP712Domain, including the verifyingContract, is not displayed in the signature request.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 4 screenshots
    trust-wallet-browser-2.90.2-f6b27b01.pngtrust-wallet-browser-2.90.2-76ea1c8d.pngtrust-wallet-browser-2.90.2-9d0e371a.pngtrust-wallet-browser-2.90.2-5a248e17.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Fail EIP-712 message parsing
    0.0 / 2.4 Expand details
    Description

    Displays human-readable details for EIP-712 signature requests from well-known protocols.

    • The wallet is rendering the EIP-712 signature request as raw JSON instead of structured, human-readable details.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 2 screenshots
    trust-wallet-browser-2.90.2-835cce65.pngtrust-wallet-browser-2.90.2-12e5e7e8.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Fail Invalid address checksum detection
    0.0 / 2.2 Expand details
    Description

    Warns users when they input addresses with invalid EIP-55 checksums.

    • The transaction proceeds without a warning message or block. The wallet does not appear to have EIP-55 checksum validation for dapp transactions.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 3 screenshots
    trust-wallet-browser-2.90.2-9162b979.pngtrust-wallet-browser-2.90.2-b2c93b16.pngtrust-wallet-browser-2.90.2-2d25897c.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Fail Mandatory message review
    0.0 / 2.1 Expand details
    Description

    Requires users to review all the details before signing a message.

    • The sign buttons are always enabled.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 4 screenshots
    trust-wallet-browser-2.90.2-f5bed813.pngtrust-wallet-browser-2.90.2-1bdb531c.pngtrust-wallet-browser-2.90.2-b599b448.pngtrust-wallet-browser-2.90.2-3090eb6d.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass Links to blockchain explorers
    1.2 / 1.2 Expand details
    Description

    Provides clickable links to block explorers for at least one key blockchain identifier.

    • Addresses and transaction hashes are displayed as clickable links, in both the transaction history and the transaction details screen.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 2 screenshots
    trust-wallet-browser-2.90.2-d85bdd95.pngtrust-wallet-browser-2.90.2-07aacbda.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check

Physical Access

20.0 / 20
  • Pass Seed phrase access control
    6.6 / 6.6 Expand details
    Description

    Requires authentication to access seed phrases or private keys.

    • Authentication is required before displaying the secret phrase.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-bd0c6eb2.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass Manual wallet lock
    3.4 / 3.4 Expand details
    Description

    Allows users to lock it manually.

    • The wallet includes a 'Lock' button within the settings menu, satisfying the requirement for a manual lock control.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-c90dfb0b.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass Automatic wallet lock
    3.4 / 3.4 Expand details
    Description

    Verifies wallet auto-locks on inactivity.

    • The wallet does not have an autolock setting but it does autolock after 10 minutes, as requested by the acceptance criteria.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 2 screenshots
    trust-wallet-browser-2.90.2-cde41b8e.pngtrust-wallet-browser-2.90.2-1a734ec3.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass Robust Authentication
    3.2 / 3.2 Expand details
    Description

    Uses strong authentication, such as resistance to trivial or commonly-used passwords.

    • Trivial passwords like "11111111" and "12345678" are rejected with the message "This password is too common. Try something more unique."

      — Verified by Sebastian Camia at Coinspect
    Evidence · 2 screenshots
    trust-wallet-browser-2.90.2-2f513f45.pngtrust-wallet-browser-2.90.2-9ab46f04.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass Seed phrase access warning
    1.8 / 1.8 Expand details
    Description

    Warns users of the risk before allowing access to seed phrases or private keys.

    • The "View Secret Phrase" screen displays a warning, communicating the risks of sharing the secret phrase.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-007eca25.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass Clipboard seed phrase leak prevention
    1.8 / 1.8 Expand details
    Description

    Limits exposure of secrets by restricting or warning on copying seed phrases or taking screenshots.

    • The wallet prevents copying the seed phrase, so it meets the acceptance criteria.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-d510f02c.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check

Threat Prevention

7.6 / 20
  • Fail Malicious and poisoned address detection
    0.0 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious address or a lookalike (poisoned) address.

    • The wallet did not surface any warnings or flags when attempting to send transactions to a known malicious address or a lookalike address, whether initiated via dApp or direct wallet UI. Neither of the two required detection mechanisms were observed.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 4 screenshots
    trust-wallet-browser-2.90.2-ca048a83.pngtrust-wallet-browser-2.90.2-f0f6fe45.pngtrust-wallet-browser-2.90.2-43a37e80.pngtrust-wallet-browser-2.90.2-efe863bb.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass Phishing dApp detection
    5.1 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious URL.

    • The wallet warns the user that the URL they are trying to connect to is marked as harmful.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 3 screenshots
    trust-wallet-browser-2.90.2-a015f697.pngtrust-wallet-browser-2.90.2-6b8de8be.pngtrust-wallet-browser-2.90.2-d59062b1.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Fail Trusted dApp detection
    0.0 / 3.3 Expand details
    Description

    Informs users when interacting with a trusted dApp URL.

    • The connection requests for both well-known dApps (Uniswap, Sushiswap, 1inch) and an unknown dApp (wallettesting.netlify.app) are displayed identically, failing to distinguish verified dApps from unknown ones as required.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 4 screenshots
    trust-wallet-browser-2.90.2-b2b8a4e3.pngtrust-wallet-browser-2.90.2-ea54723a.pngtrust-wallet-browser-2.90.2-f6aecaf5.pngtrust-wallet-browser-2.90.2-028bc203.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Fail Unknown address detection
    0.0 / 2.8 Expand details
    Description

    Warns users when interacting with an unknown address.

    • There is no warning or indicator displayed when sending a transaction to a fresh address.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-11745e7d.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass Full dApp URL display
    1.5 / 1.5 Expand details
    Description

    Clearly displays the full dApp URL in the connection prompt.

    • The full dApp origin URL is shown without truncation in the connection dialog.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-a3e8df03.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Fail Malicious or spam token filtering
    0.0 / 1.3 Expand details
    Description

    Hides malicious tokens and NFTs by default.

    • The screenshot shows spam NFTs are displayed by default, which fails the acceptance criteria.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-b210a065.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check
  • Pass dApp access disclosure dialog
    1.0 / 1.0 Expand details
    Description

    Discloses the dApp's read access to the user's account and its ability to request signatures on connection.

    • The connection dialog displays the ability to view the user's balance and activity and the ability to request transaction approvals.

      — Verified by Sebastian Camia at Coinspect
    Evidence · 1 screenshot
    trust-wallet-browser-2.90.2-ae403b95.png
    Last updated on Sep 3, 2026
    Report an issue Report an issue with this check

This ranking is for informational purposes only. It should not be relied on to provide legal, tax, financial, investment, or other types of advice. Coinspect does not guarantee or warrant the accuracy, completeness, timeliness, suitability, or validity of the information provided and will not be responsible for any claim attributable to reliance on errors, omissions, or other inaccuracies of any part of such information.