Zerion Browser Security Report background image
Home - Coinspect Security
ZerionZerionChrome
Search
Zerion logo

Zerion

Security Score

74.8

dApp Permissions

26.8 / 35
  • Pass User confirmation before processing requests
    8.7 / 8.7 Expand details
    Description

    Requires user confirmation before processing requests from dApps for specific RPC methods.

    • Requires user confirmation before processing each DApp request

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass User consent for dApp access
    7.7 / 7.7 Expand details
    Description

    Requires user approval before granting dApp access to specific RPC methods.

    • Requires user connection before processing each DApp request

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Wallet unlock before requests
    5.6 / 5.6 Expand details
    Description

    Requires users to unlock it before processing dApp requests when in a locked state.

    • Requires the user to unlock the wallet before processing each DApp request

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Mismatching EIP-712 chainId detection
    0.0 / 3.5 Expand details
    Description

    Alerts users or rejects signing EIP-712 messages with a mismatched chain ID.

    • The wallet doesn't warn the user about the mismatching chain ID.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass eth_sign method disabled
    3.3 / 3.3 Expand details
    Description

    Restricts the use of the deprecated and insecure eth_sign method by default.

    • The 'eth_sign' method is disabled by default

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Mismatching SIWE domain detection
    0.0 / 1.8 Expand details
    Description

    Warns users when the domain in a Sign-In with Ethereum (EIP-4361) message does not match the requesting dApp's origin.

    • The wallet doesn't warn users of domain or scheme mismatches when signing an EIP-4361 message.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Connected dApp management
    1.5 / 1.5 Expand details
    Description

    Allows users to list and revoke connected dApps.

    • It shows all connected DApps and also the chance to revoke access to them

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Token approval management
    0.0 / 1.5 Expand details
    Description

    Allows users to view and revoke token approvals.

    • The wallet does not include functionality to revoke approvals; it only allows users to view them.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail User confirmation before switching chains
    0.0 / 1.1 Expand details
    Description

    Requires user confirmation before switching the active chain.

    • It doesn´t require user confirmation before processing the method

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot

Intent Verification

20.7 / 25
  • Pass Transaction simulation
    6.7 / 6.7 Expand details
    Description

    Previews the expected outcome by simulating the request execution on the blockchain before signing.

    • It shows the NFT we are receiving when providing liquidity to a pool.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Clear token approval dialog
    6.7 / 6.7 Expand details
    Description

    Clearly displays all the key details for ERC-20 Approve requests.

    • It includes token, effect, allowance, and contract spender address.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Clear message signing dialog
    3.8 / 3.8 Expand details
    Description

    Clearly displays all message signature request details without truncating or hiding information.

    • The wallet displays all the information in a JSON without parsing.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 5 screenshots
  • Pass EIP-712 message parsing
    2.4 / 2.4 Expand details
    Description

    Displays human-readable details for EIP-712 signature requests from well-known protocols.

    • The wallet parses EIP-712 Opensea Seaport listings and ERC-20 Permits

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 4 screenshots
  • Fail Invalid address checksum detection
    0.0 / 2.2 Expand details
    Description

    Warns users when they input addresses with invalid EIP-55 checksums.

    • It doesn't show any warning about incorrect address checksums and fixes the address, letting you confirm the transaction.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 4 screenshots
  • Fail Mandatory message review
    0.0 / 2.1 Expand details
    Description

    Requires users to review all the details before signing a message.

    • The sign button is always available

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 4 screenshots
  • Pass Links to blockchain explorers
    1.2 / 1.2 Expand details
    Description

    Consistently provides clickable links to block explorers for all key blockchain identifiers.

    • The wallet includes clickable links in the transaction history and during the process of sending a transaction.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots

Physical Access

14.9 / 20
  • Pass Seed phrase access control
    5.4 / 5.4 Expand details
    Description

    Requires authentication to access seed phrases or private keys.

    • After clicking the 'Recovery phrase' button, the wallet requires a password to display the mnemonics or private keys.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Manual wallet lock
    3.9 / 3.9 Expand details
    Description

    Allows users to lock it manually.

    • The wallet has a "Lock Button".

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Automatic wallet lock
    0.0 / 3.4 Expand details
    Description

    Verifies wallet auto-locks on inactivity.

    • The wallet's default lock time is more than 20 minutes

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Robust Authentication
    3.3 / 3.3 Expand details
    Description

    Uses strong authentication, such as resistance to trivial or commonly-used passwords. Including biometrics and rate limiting in mobile.

    • The wallet supports biometrics but is not enabled by default. It enforces rate limits on login attempts, requires a password of at least six characters, and does not allow weak passwords.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Clipboard seed phrase leak prevention
    0.0 / 1.8 Expand details
    Description

    Limits exposure of secrets by restricting or warning on copying seed phrases or taking screenshots.

    • It doesn't warn the user about the risks of copying mnemonics to the clipboard and exceeds the minute.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Seed phrase access warning
    1.8 / 1.8 Expand details
    Description

    Warns users of the risk before allowing access to seed phrases or private keys.

    • It tells you it's risky to share your secret words or private keys with others. These alerts appear before the mnemonic viewing process.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots

Threat Prevention

12.4 / 20
  • Pass Phishing dApp detection
    5.1 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious URL.

    • The wallet alerts users about connections to known phishing dApps like https://arbitrum-token-bridge-cqjggprvn-offchain-labs.vercel.app/

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass Malicious address detection
    5.1 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious address.

    • The wallet alerts users about interactions with known phishing or scam addresses.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Fail Trusted dApp detection
    0.0 / 3.3 Expand details
    Description

    Informs users when interacting with a trusted dApp URL.

    • The wallet doesn't inform users when they are interacting with well-known, verified URLs (DApps) like 1inch or uniswap.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots
  • Fail Unknown address detection
    0.0 / 2.8 Expand details
    Description

    Warns users when interacting with an unknown address.

    • The wallet doesn't emit any warnings when trying to send a transaction to an unknown address.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Fail Full dApp URL display
    0.0 / 1.5 Expand details
    Description

    Clearly displays the full dApp URL in the connection prompt.

    • The wallet truncates the website URL when it detects a phishing url

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
  • Pass Malicious or spam token filtering
    1.3 / 1.3 Expand details
    Description

    Hides malicious tokens and NFTs by default.

    • The wallet hides spam or scam tokens and NFTs sent to the wallet.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
  • Pass dApp access disclosure dialog
    1.0 / 1.0 Expand details
    Description

    Informs dApp access to balances, history, and signing requests on connection.

    • The wallet clearly informs users, within the connection dialog, that by connecting they are allowing the DApp to view their wallet balance and activity, as well as to request transaction approvals.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots

This ranking is for informational purposes only. It should not be relied on to provide legal, tax, financial, investment, or other types of advice. Coinspect does not guarantee or warrant the accuracy, completeness, timeliness, suitability, or validity of the information provided and will not be responsible for any claim attributable to reliance on errors, omissions, or other inaccuracies of any part of such information.