Wallet Security Ranking Methodology background image
Home - Coinspect Security

We created a standard security checklist to provide transparent, objective insights into the most secure crypto wallets.

We test, you decide.

Search

dApp Permissions

Evaluates how the wallet manages dApp permissions and restricts sensitive RPCs. Includes enforcing user consent for connections, disclosing access scopes, and enforcing unlocks, plus tools to review or revoke persistent connections and token allowances.

Attack scenario A malicious dApp exploits weak access controls, silent RPC execution, or undisclosed permission scopes to drain funds or perform unauthorized actions without explicit user consent.

12 checks

  • A mismatch between the dApp origin and the domain inside the SIWE message can indicate phishing or session hijacking attempt. Warning on this helps users avoid signing login messages that could authenticate them to a different service than the one they think they are using. Generate and attempt to sign a SIWE message from a dApp whose origin differs from the domain specified in the SIWE object. To craft a SIWE object, access the testing dApp at `/signinwithethereum`. Observe whether the wallet warns the user or blocks the signing. Passes if the wallet warns the user about the mismatch or blocks the signing request. A phishing site tricks the user into signing a login message that authenticates them to a different service targetted by the attacker

    Mismatching SIWE domain detection

    Expand

    Warns users when the domain in a Sign-In with Ethereum (EIP-4361) message does not match the requesting dApp's origin.

    Reasoning

    A mismatch between the dApp origin and the domain inside the SIWE message can indicate phishing or session hijacking attempt. Warning on this helps users avoid signing login messages that could authenticate them to a different service than the one they think they are using.

    Instructions

    Generate and attempt to sign a SIWE message from a dApp whose origin differs from the domain specified in the SIWE object. To craft a SIWE object, access the testing dApp at /signinwithethereum. Observe whether the wallet warns the user or blocks the signing.

    Criteria

    Passes if the wallet warns the user about the mismatch or blocks the signing request.

    Attack Scenario

    A phishing site tricks the user into signing a login message that authenticates them to a different service targetted by the attacker

  • A locked wallet must never continue serving sensitive requests, since that would weaken the purpose of the lock state. Requiring an unlock prevents unauthorized access to accounts, signatures, or encrypted material if the device is unattended or temporarily exposed. If the wallet implements WalletConnect, with the wallet previously connected but in a locked state, run the Auth Bypass Test which sends requests from the dApp to: `wallet_addEthereumChain`, `wallet_watchAsset`, `eth_decrypt`, `eth_getEncryptionPublicKey`, `eth_signTypedData*`, `personal_sign`, `eth_sendTransaction`. Observe whether each request triggers an authentication prompt before being processed and look for possible information leaks. Passes if every request requires unlocking before processing and no information is leaked while the wallet remains locked. If WalletConnect is not implemented, the test is also considered passed. An attacker with temporary access to the device triggers wallet operations or extracts sensitive data while the wallet is locked

    Wallet unlock before requests

    Mobile Expand

    Requires users to unlock it before processing dApp requests when in a locked state.

    Reasoning

    A locked wallet must never continue serving sensitive requests, since that would weaken the purpose of the lock state. Requiring an unlock prevents unauthorized access to accounts, signatures, or encrypted material if the device is unattended or temporarily exposed.

    Instructions

    If the wallet implements WalletConnect, with the wallet previously connected but in a locked state, run the Auth Bypass Test which sends requests from the dApp to: wallet_addEthereumChain, wallet_watchAsset, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData*, personal_sign, eth_sendTransaction. Observe whether each request triggers an authentication prompt before being processed and look for possible information leaks.

    Criteria

    Passes if every request requires unlocking before processing and no information is leaked while the wallet remains locked. If WalletConnect is not implemented, the test is also considered passed.

    Attack Scenario

    An attacker with temporary access to the device triggers wallet operations or extracts sensitive data while the wallet is locked

  • A locked wallet must never continue serving sensitive requests, since that would weaken the purpose of the lock state. Requiring an unlock prevents unauthorized access to accounts, signatures, or encrypted material if the device is unattended or temporarily exposed. With the wallet already connected to the testing dApp but in a locked state, run the Auth Bypass Test, which sends the following RPC requests: `wallet_addEthereumChain`, `wallet_watchAsset`, `eth_decrypt`, `eth_getEncryptionPublicKey`, `eth_signTypedData*`, `personal_sign`, `eth_sendTransaction`. Observe whether each request triggers an authentication prompt before being processed and look for possible information leaks. Passes if every request triggers an unlock prompt and none are processed and no sensitive information is leaked while the wallet is locked. An attacker with temporary access to the device triggers wallet operations or extracts sensitive data while the wallet is locked

    Wallet unlock before requests

    Browser Expand

    Requires users to unlock it before processing dApp requests when in a locked state.

    Reasoning

    A locked wallet must never continue serving sensitive requests, since that would weaken the purpose of the lock state. Requiring an unlock prevents unauthorized access to accounts, signatures, or encrypted material if the device is unattended or temporarily exposed.

    Instructions

    With the wallet already connected to the testing dApp but in a locked state, run the Auth Bypass Test, which sends the following RPC requests: wallet_addEthereumChain, wallet_watchAsset, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData*, personal_sign, eth_sendTransaction. Observe whether each request triggers an authentication prompt before being processed and look for possible information leaks.

    Criteria

    Passes if every request triggers an unlock prompt and none are processed and no sensitive information is leaked while the wallet is locked.

    Attack Scenario

    An attacker with temporary access to the device triggers wallet operations or extracts sensitive data while the wallet is locked

  • EIP-712 signatures are domain-separated partly through the chainId, so signing data for a different chain can enable cross-chain confusion or replay-like abuse in poorly designed integrations. Warning or rejecting mismatched chainIds helps users understand what environment they are authorizing and prevents signatures from being produced under misleading assumptions. Craft an EIP-712 object with a `chainId` different from the wallet's currently active network and attempt to sign it. This is done by accessing the testing dApp at `/sign`, clicking on 'Show SIGN Params' and modifying the `chainId` parameter for a different value. Observe whether the wallet warns or rejects the request. Passes if the wallet rejects the signing request or displays a warning about the `chainId` mismatch. A malicious dApp tricks the user into signing data for a different network than expected, enabling misuse of the signature under a misleading execution context

    Mismatching EIP-712 chainId detection

    Expand

    Alerts users or rejects signing EIP-712 messages with a mismatched chain ID.

    Reasoning

    EIP-712 signatures are domain-separated partly through the chainId, so signing data for a different chain can enable cross-chain confusion or replay-like abuse in poorly designed integrations. Warning or rejecting mismatched chainIds helps users understand what environment they are authorizing and prevents signatures from being produced under misleading assumptions.

    Instructions

    Craft an EIP-712 object with a chainId different from the wallet's currently active network and attempt to sign it. This is done by accessing the testing dApp at /sign, clicking on 'Show SIGN Params' and modifying the chainId parameter for a different value. Observe whether the wallet warns or rejects the request.

    Criteria

    Passes if the wallet rejects the signing request or displays a warning about the chainId mismatch.

    Attack Scenario

    A malicious dApp tricks the user into signing data for a different network than expected, enabling misuse of the signature under a misleading execution context

  • Persistent dApp connections represent an ongoing trust relationship, so users need visibility into which apps still have access. The ability to review and revoke those connections reduces the risk of stale approvals, forgotten sessions, or continued access after the user no longer trusts the dApp. Having previously connected to at least two dApps, look for a section within the wallet UI that lists all connected dApps. Disconnect the testing dApp, then send RPC requests from it to verify access has been fully revoked. Passes if the wallet lists connected dApps and revoking access prevents further RPC requests from the disconnected dApp. A previously trusted dApp becomes malicious or is compromised, and due to another vulnerability or excessive permissions, it can abuse its existing connection to perform unintended actions or access sensitive data

    Connected dApp management

    Expand

    Allows users to list and revoke connected dApps.

    Reasoning

    Persistent dApp connections represent an ongoing trust relationship, so users need visibility into which apps still have access. The ability to review and revoke those connections reduces the risk of stale approvals, forgotten sessions, or continued access after the user no longer trusts the dApp.

    Instructions

    Having previously connected to at least two dApps, look for a section within the wallet UI that lists all connected dApps. Disconnect the testing dApp, then send RPC requests from it to verify access has been fully revoked.

    Criteria

    Passes if the wallet lists connected dApps and revoking access prevents further RPC requests from the disconnected dApp.

    Attack Scenario

    A previously trusted dApp becomes malicious or is compromised, and due to another vulnerability or excessive permissions, it can abuse its existing connection to perform unintended actions or access sensitive data

  • Token approvals can outlive a single transaction and are a common source of loss when a spender contract is compromised or malicious. Letting users inspect and revoke approvals gives them a practical way to reduce standing risk and clean up excessive allowances. Look for functionality within the wallet UI to list and revoke token approvals, either as a built-in feature or as a link to an external dApp. Passes if the wallet provides a way to list existing token approvals and revoke them. A malicious or compromised contract or address uses previously granted token approvals to transfer tokens without additional user consent

    Token approval management

    Expand

    Allows users to view and revoke token approvals.

    Reasoning

    Token approvals can outlive a single transaction and are a common source of loss when a spender contract is compromised or malicious. Letting users inspect and revoke approvals gives them a practical way to reduce standing risk and clean up excessive allowances.

    Instructions

    Look for functionality within the wallet UI to list and revoke token approvals, either as a built-in feature or as a link to an external dApp.

    Criteria

    Passes if the wallet provides a way to list existing token approvals and revoke them.

    Attack Scenario

    A malicious or compromised contract or address uses previously granted token approvals to transfer tokens without additional user consent

  • `eth_sign` is historically dangerous because it signs raw data in a way that is easy to misuse and hard for users to interpret safely. In particular, it can be abused to trick users into signing raw transaction hashes or other opaque payloads without clear context. Disabling it by default reduces compatibility with insecure legacy flows and pushes dApps toward safer, more explicit signing methods. With the wallet connected and unlocked, send an `eth_sign` RPC request via the testing dApp at `/sign` and press the SIGN button. Observe the response. Note that some wallets silently redirect `eth_sign` calls to `personal_sign` instead. Passes if the wallet rejects `eth_sign` requests or redirects them to `personal_sign`. A malicious dApp tricks the user into signing opaque data that can be interpreted as a valid transaction or authorization

    eth_sign method disabled

    Expand

    Restricts the use of the deprecated and insecure eth_sign method by default.

    Reasoning

    eth_sign is historically dangerous because it signs raw data in a way that is easy to misuse and hard for users to interpret safely. In particular, it can be abused to trick users into signing raw transaction hashes or other opaque payloads without clear context. Disabling it by default reduces compatibility with insecure legacy flows and pushes dApps toward safer, more explicit signing methods.

    Instructions

    With the wallet connected and unlocked, send an eth_sign RPC request via the testing dApp at /sign and press the SIGN button. Observe the response. Note that some wallets silently redirect eth_sign calls to personal_sign instead.

    Criteria

    Passes if the wallet rejects eth_sign requests or redirects them to personal_sign.

    Attack Scenario

    A malicious dApp tricks the user into signing opaque data that can be interpreted as a valid transaction or authorization

  • Requiring confirmation for sensitive RPC methods ensures the dApp cannot silently trigger signing, encryption, asset watching, or transaction actions without the user noticing. If the wallet implements WalletConnect, connect to a dApp via WalletConnect and send requests to: `wallet_addEthereumChain`, `wallet_watchAsset`, `eth_decrypt`, `eth_getEncryptionPublicKey`, `eth_signTypedData*`, `personal_sign`, `eth_sendTransaction`. Observe whether each request surfaces a confirmation prompt. Passes if each request requires confirmation, or if WalletConnect is not supported. A malicious dApp triggers sensitive operations through WalletConnect without clear user awareness or intent

    Confirmation for requests from WalletConnect

    Mobile Expand

    Requires user confirmation for requests from WalletConnect before granting dApp access to specific RPC methods.

    Reasoning

    Requiring confirmation for sensitive RPC methods ensures the dApp cannot silently trigger signing, encryption, asset watching, or transaction actions without the user noticing.

    Instructions

    If the wallet implements WalletConnect, connect to a dApp via WalletConnect and send requests to: wallet_addEthereumChain, wallet_watchAsset, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData*, personal_sign, eth_sendTransaction. Observe whether each request surfaces a confirmation prompt.

    Criteria

    Passes if each request requires confirmation, or if WalletConnect is not supported.

    Attack Scenario

    A malicious dApp triggers sensitive operations through WalletConnect without clear user awareness or intent

  • A dApp should not be able to access accounts or request sensitive operations before the user explicitly grants it permission. Enforcing a connection step prevents passive data exposure and makes the trust decision visible and deliberate. Without first connecting the wallet, access the test dApp at `/authTest`, provide your wallet address in the address box, and click on the RUN AUTHORIZATION BYPASS TEST button, which sends requests to: `eth_accounts`, `eth_decrypt`, `eth_getEncryptionPublicKey`, `eth_signTypedData*`, `personal_sign`, `eth_sendTransaction`. Observe whether each request triggers a connection prompt or is rejected, and there are no information leaks. Passes if each request is rejected or requires a connection approval with no information leaked. A malicious or untrusted dApp accesses accounts or initiates sensitive requests without explicit user authorization

    User consent for dApp access

    Browser Expand

    Requires user approval before granting dApp access to specific RPC methods.

    Reasoning

    A dApp should not be able to access accounts or request sensitive operations before the user explicitly grants it permission. Enforcing a connection step prevents passive data exposure and makes the trust decision visible and deliberate.

    Instructions

    Without first connecting the wallet, access the test dApp at /authTest, provide your wallet address in the address box, and click on the RUN AUTHORIZATION BYPASS TEST button, which sends requests to: eth_accounts, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData*, personal_sign, eth_sendTransaction. Observe whether each request triggers a connection prompt or is rejected, and there are no information leaks.

    Criteria

    Passes if each request is rejected or requires a connection approval with no information leaked.

    Attack Scenario

    A malicious or untrusted dApp accesses accounts or initiates sensitive requests without explicit user authorization

  • Chain switching changes the execution context of future transactions and signatures, so it should never happen silently. Confirmation protects users from being moved onto an unexpected network where balances, assets, or contract interactions may behave very differently. Send a `wallet_switchEthereumChain` RPC request from a dApp and observe whether a confirmation prompt appears. If no prompt is shown, check whether the wallet allows users to manage pre-approved networks — if so, configure only one approved network and attempt to switch to any other chain. Perform this test through both the browser and WalletConnect, if applicable. Passes if the wallet prompts confirmation before switching networks or blocks switching to non-approved networks. A malicious dApp switches the user to an unexpected network where assets or interactions behave differently, leading to unintended actions

    User confirmation before switching chains

    Expand

    Requires user confirmation before switching the active chain.

    Reasoning

    Chain switching changes the execution context of future transactions and signatures, so it should never happen silently. Confirmation protects users from being moved onto an unexpected network where balances, assets, or contract interactions may behave very differently.

    Instructions

    Send a wallet_switchEthereumChain RPC request from a dApp and observe whether a confirmation prompt appears. If no prompt is shown, check whether the wallet allows users to manage pre-approved networks — if so, configure only one approved network and attempt to switch to any other chain. Perform this test through both the browser and WalletConnect, if applicable.

    Criteria

    Passes if the wallet prompts confirmation before switching networks or blocks switching to non-approved networks.

    Attack Scenario

    A malicious dApp switches the user to an unexpected network where assets or interactions behave differently, leading to unintended actions

  • Requiring confirmation for sensitive RPC methods ensures the dApp cannot silently trigger signing, encryption, asset watching, or transaction actions without the user noticing. If the wallet has an embedded browser, send requests to: `wallet_addEthereumChain`, `wallet_watchAsset`, `eth_decrypt`, `eth_getEncryptionPublicKey`, `eth_signTypedData*`, `personal_sign`, `eth_sendTransaction`. Observe whether each requires user confirmation. To execute the test, press the 'Run Authorization Bypass Test' button. Passes if each request requires explicit user confirmation before execution, or the wallet does not have an embedded browser. A malicious dApp triggers privileged operations from an embedded browser without the user clearly reviewing and approving each request

    User confirmation for requests from embedded browser

    Mobile Expand

    Requires user confirmation before processing privileged RPC requests from embedded browsers.

    Reasoning

    Requiring confirmation for sensitive RPC methods ensures the dApp cannot silently trigger signing, encryption, asset watching, or transaction actions without the user noticing.

    Instructions

    If the wallet has an embedded browser, send requests to: wallet_addEthereumChain, wallet_watchAsset, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData*, personal_sign, eth_sendTransaction. Observe whether each requires user confirmation. To execute the test, press the 'Run Authorization Bypass Test' button.

    Criteria

    Passes if each request requires explicit user confirmation before execution, or the wallet does not have an embedded browser.

    Attack Scenario

    A malicious dApp triggers privileged operations from an embedded browser without the user clearly reviewing and approving each request

  • Sensitive RPC methods can lead to asset movement, approval of malicious contracts, disclosure of encryption material, or misleading signatures. Requiring per-request confirmation ensures the user reviews each action in context instead of the dApp operating with broad invisible permission. With the wallet connected to the dApp, click on the RUN AUTHORIZATION BYPASS TEST button, which calls the following RPC endpoints `wallet_addEthereumChain`, `wallet_watchAsset`, `eth_decrypt`, `eth_getEncryptionPublicKey`, `eth_signTypedData*`, `personal_sign`, `eth_sendTransaction`. Observe whether each requires user confirmation. Send requests to: `wallet_addEthereumChain`, `wallet_watchAsset`, `eth_decrypt`, `eth_getEncryptionPublicKey`, `eth_signTypedData*`, `personal_sign`, `eth_sendTransaction`. Observe whether each requires user confirmation. A malicious dApp executes privileged operations (signing, transactions, approvals) without the user explicitly reviewing and approving each request

    User confirmation before processing requests

    Browser Expand

    Requires user confirmation before processing requests from dApps for specific RPC methods.

    Reasoning

    Sensitive RPC methods can lead to asset movement, approval of malicious contracts, disclosure of encryption material, or misleading signatures. Requiring per-request confirmation ensures the user reviews each action in context instead of the dApp operating with broad invisible permission.

    Instructions

    With the wallet connected to the dApp, click on the RUN AUTHORIZATION BYPASS TEST button, which calls the following RPC endpoints wallet_addEthereumChain, wallet_watchAsset, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData*, personal_sign, eth_sendTransaction. Observe whether each requires user confirmation.

    Criteria

    Send requests to: wallet_addEthereumChain, wallet_watchAsset, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData*, personal_sign, eth_sendTransaction. Observe whether each requires user confirmation.

    Attack Scenario

    A malicious dApp executes privileged operations (signing, transactions, approvals) without the user explicitly reviewing and approving each request

Intent Verification

Evaluates how effectively the wallet decodes and presents transaction data. Includes translating raw hex/EIP-712 into readable formats, simulating outcomes, validating checksums, and ensuring payloads are fully visible and reviewed before signing.

Attack scenario An attacker tricks the user into blind-signing opaque or partially hidden payloads, or exploits mistyped addresses, causing unintended asset transfers to malicious destinations.

7 checks

  • EIP-55 checksums are meant to catch address-entry mistakes that would otherwise be hard to spot. Warning on an invalid checksum reduces the chance of sending funds to a mistyped or malformed address, especially when users copy addresses from unreliable sources. Attempt to send a transaction to an address with an incorrect EIP-55 checksum (e.g. alter the case of any letter). The transaction should be attempted manually and from a dApp. Observe whether the wallet surfaces a warning or blocks the transaction. Passes if the wallet blocks the transaction or displays a checksum warning before the transaction proceeds. A user sends funds to a mistyped or manipulated address due to input errors or clipboard tampering

    Invalid address checksum detection

    Expand

    Warns users when they input addresses with invalid EIP-55 checksums.

    Reasoning

    EIP-55 checksums are meant to catch address-entry mistakes that would otherwise be hard to spot. Warning on an invalid checksum reduces the chance of sending funds to a mistyped or malformed address, especially when users copy addresses from unreliable sources.

    Instructions

    Attempt to send a transaction to an address with an incorrect EIP-55 checksum (e.g. alter the case of any letter). The transaction should be attempted manually and from a dApp. Observe whether the wallet surfaces a warning or blocks the transaction.

    Criteria

    Passes if the wallet blocks the transaction or displays a checksum warning before the transaction proceeds.

    Attack Scenario

    A user sends funds to a mistyped or manipulated address due to input errors or clipboard tampering

  • Explorer links let users independently verify addresses, contracts, and transactions instead of trusting only the wallet UI. This improves transparency and makes it easier to inspect counterparties, token contracts, and transaction outcomes before or after signing. Attempt to send a transaction and inspect the details screen. Also browse the wallet's transaction history. Observe whether addresses, contract addresses, and transaction hashes are displayed as clickable links to a block explorer. Passes if addresses, contract addresses and transaction hashes are clickable and open a block explorer both when attempting to send a transaction and querying the wallet history. If just one of these is provided, it's given half the points. A malicious interface misrepresents transaction or address details, preventing independent verification by the user

    Links to blockchain explorers

    Expand

    Consistently provides clickable links to block explorers for all key blockchain identifiers.

    Reasoning

    Explorer links let users independently verify addresses, contracts, and transactions instead of trusting only the wallet UI. This improves transparency and makes it easier to inspect counterparties, token contracts, and transaction outcomes before or after signing.

    Instructions

    Attempt to send a transaction and inspect the details screen. Also browse the wallet's transaction history. Observe whether addresses, contract addresses, and transaction hashes are displayed as clickable links to a block explorer.

    Criteria

    Passes if addresses, contract addresses and transaction hashes are clickable and open a block explorer both when attempting to send a transaction and querying the wallet history. If just one of these is provided, it's given half the points.

    Attack Scenario

    A malicious interface misrepresents transaction or address details, preventing independent verification by the user

  • Many dangerous transactions only become obvious when looking at their actual effects, not just calldata or method names. Simulation helps users see expected token movements, approvals, or state changes in advance, which is one of the strongest defenses against deceptive dApp flows. Attempt to provide liquidity into a liquidity pool and perform a swap (e.g. Uniswap) and observe whether the wallet shows the expected inputs and outputs from the execution of such transaction before it is signed. Passes if the wallet shows the expected inputs and outputs from the execution of such transaction effects before signing. A malicious dApp disguises the real effects of a transaction, such as draining funds or granting approvals, until after it is signed

    Transaction simulation

    Expand

    Previews the expected outcome by simulating the request execution on the blockchain before signing.

    Reasoning

    Many dangerous transactions only become obvious when looking at their actual effects, not just calldata or method names. Simulation helps users see expected token movements, approvals, or state changes in advance, which is one of the strongest defenses against deceptive dApp flows.

    Instructions

    Attempt to provide liquidity into a liquidity pool and perform a swap (e.g. Uniswap) and observe whether the wallet shows the expected inputs and outputs from the execution of such transaction before it is signed.

    Criteria

    Passes if the wallet shows the expected inputs and outputs from the execution of such transaction effects before signing.

    Attack Scenario

    A malicious dApp disguises the real effects of a transaction, such as draining funds or granting approvals, until after it is signed

  • EIP-712 is designed to make structured data more understandable, but that only works if the wallet parses and presents it clearly. Human-readable rendering helps users distinguish between harmless messages and signatures that authorize critical permissions or off-chain actions. Trigger EIP-712 signature requests from well-known protocols such as OpenSea Seaport, ERC-20 Permit flows, or Uniswap, and observe how the wallet renders them — whether it shows structured, human-readable detail or raw JSON. In the testing dApp, go to `/sign` and attempt signing an ERC20 Permit or Opensea listing. Passes if the wallet renders structured, human-readable signing details rather than raw JSON. A malicious dApp crafts structured data that appears benign but actually grants permissions or authorizations when signed

    EIP-712 message parsing

    Expand

    Displays human-readable details for EIP-712 signature requests from well-known protocols.

    Reasoning

    EIP-712 is designed to make structured data more understandable, but that only works if the wallet parses and presents it clearly. Human-readable rendering helps users distinguish between harmless messages and signatures that authorize critical permissions or off-chain actions.

    Instructions

    Trigger EIP-712 signature requests from well-known protocols such as OpenSea Seaport, ERC-20 Permit flows, or Uniswap, and observe how the wallet renders them — whether it shows structured, human-readable detail or raw JSON. In the testing dApp, go to /sign and attempt signing an ERC20 Permit or Opensea listing.

    Criteria

    Passes if the wallet renders structured, human-readable signing details rather than raw JSON.

    Attack Scenario

    A malicious dApp crafts structured data that appears benign but actually grants permissions or authorizations when signed

  • ERC-20 approvals can grant a spender long-lived control over tokens. Clearly showing the token, spender, and amount helps users detect malicious approvals, unlimited allowances, and approvals targeting unexpected contracts. Trigger an ERC-20 approve in two ways: 1) deploy a custom ERC-20 (via `/sendtransaction` in the testing dApp) and call approve directly, and 2) access any swap dApp and trigger an approve through the UI. Observe what information the wallet displays about the token, spender, and amount. Passes if the wallet clearly displays the token, spender and approved amount. A malicious dApp tricks the user into approving excessive or unlimited token allowances to an attacker-controlled contract

    Clear token approval dialog

    Expand

    Clearly displays all the key details for ERC-20 Approve requests.

    Reasoning

    ERC-20 approvals can grant a spender long-lived control over tokens. Clearly showing the token, spender, and amount helps users detect malicious approvals, unlimited allowances, and approvals targeting unexpected contracts.

    Instructions

    Trigger an ERC-20 approve in two ways: 1) deploy a custom ERC-20 (via /sendtransaction in the testing dApp) and call approve directly, and 2) access any swap dApp and trigger an approve through the UI. Observe what information the wallet displays about the token, spender, and amount.

    Criteria

    Passes if the wallet clearly displays the token, spender and approved amount.

    Attack Scenario

    A malicious dApp tricks the user into approving excessive or unlimited token allowances to an attacker-controlled contract

  • Users cannot give meaningful consent if important parts of the message are hidden, truncated, or impossible to inspect. Full visibility into signed data is critical because attackers can bury harmful payloads or structured objects. Send large payloads via `personal_sign` and `eth_signTypedData` (via `/sign` in the testing dApp) and observe whether all content is visible, scrollable, and not truncated. For EIP-712 objects, also check whether the `EIP712Domain`, including `verifyingContract`, is displayed. Passes if all signing data is visible (including the `verifyingContract` for EIP-712), scrollable and not truncated. A malicious dApp hides or obfuscates critical parts of a signing payload, leading the user to approve unintended or harmful data

    Clear message signing dialog

    Expand

    Clearly displays all message signature request details without truncating or hiding information.

    Reasoning

    Users cannot give meaningful consent if important parts of the message are hidden, truncated, or impossible to inspect. Full visibility into signed data is critical because attackers can bury harmful payloads or structured objects.

    Instructions

    Send large payloads via personal_sign and eth_signTypedData (via /sign in the testing dApp) and observe whether all content is visible, scrollable, and not truncated. For EIP-712 objects, also check whether the EIP712Domain, including verifyingContract, is displayed.

    Criteria

    Passes if all signing data is visible (including the verifyingContract for EIP-712), scrollable and not truncated.

    Attack Scenario

    A malicious dApp hides or obfuscates critical parts of a signing payload, leading the user to approve unintended or harmful data

  • Forcing the user to scroll through the full request makes rushed or accidental approvals less likely. It is not a perfect defense, but it raises friction in exactly the places where attackers benefit from users clicking through without reviewing the content. Send a large payload via `personal_sign` or `eth_signTypedData` and observe whether the sign button is accessible before scrolling to the end of the content. Passes if the sign button remains disabled until the user scrolls through the entire message. A malicious dApp relies on users blindly approving signature requests without reviewing their contents, leading to unintended authorizations

    Mandatory message review

    Expand

    Requires users to review all the details before signing a message.

    Reasoning

    Forcing the user to scroll through the full request makes rushed or accidental approvals less likely. It is not a perfect defense, but it raises friction in exactly the places where attackers benefit from users clicking through without reviewing the content.

    Instructions

    Send a large payload via personal_sign or eth_signTypedData and observe whether the sign button is accessible before scrolling to the end of the content.

    Criteria

    Passes if the sign button remains disabled until the user scrolls through the entire message.

    Attack Scenario

    A malicious dApp relies on users blindly approving signature requests without reviewing their contents, leading to unintended authorizations

Physical Access

Evaluates defenses against unauthorized physical access and local data exposure. Includes strong authentication, auto-locking, rate limiting, and restricting seed phrase exposure via clipboards, screenshots, or unauthenticated views.

Attack scenario An attacker with temporary physical access exploits an unlocked session or weak local authentication to authorize transactions or exfiltrate secrets (like the seed phrase).

7 checks

  • Seed phrases are extremely sensitive, and clipboards and screenshots are common exfiltration paths on both desktop and mobile systems. Limiting, warning, or blocking these actions reduces the exposure window and makes users think twice before handling secrets insecurely. Navigate to the seed phrase screen and copy the mnemonic to the clipboard. Observe whether the wallet clears it after a short time or displays a warning. On mobile, also attempt to take a screenshot and observe the response. Passes if the wallet limits clipboard exposure (1 min max), warns about clipboard risks, or prevents copying. On mobile, it should prevent or warn users about screenshot risks. Seed phrases are exposed through clipboard access or screenshots that may be stored locally, synced to the cloud, or accessed by someone with physical access to the device

    Clipboard seed phrase leak prevention

    Expand

    Limits exposure of secrets by restricting or warning on copying seed phrases or taking screenshots.

    Reasoning

    Seed phrases are extremely sensitive, and clipboards and screenshots are common exfiltration paths on both desktop and mobile systems. Limiting, warning, or blocking these actions reduces the exposure window and makes users think twice before handling secrets insecurely.

    Instructions

    Navigate to the seed phrase screen and copy the mnemonic to the clipboard. Observe whether the wallet clears it after a short time or displays a warning. On mobile, also attempt to take a screenshot and observe the response.

    Criteria

    Passes if the wallet limits clipboard exposure (1 min max), warns about clipboard risks, or prevents copying. On mobile, it should prevent or warn users about screenshot risks.

    Attack Scenario

    Seed phrases are exposed through clipboard access or screenshots that may be stored locally, synced to the cloud, or accessed by someone with physical access to the device

  • Weak local authentication can completely undermine all other security controls. Strong passwords, biometrics, and rate-limiting make brute force, shoulder surfing, and opportunistic device access much harder. Check whether biometric authentication is available and attempt to set a weak PIN (e.g. `1234`). Then attempt multiple incorrect logins and observe whether rate limiting activates. Passes if the wallet supports biometrics; if it allows easy-to-guess passwords/pins, make sure that it rate limits attempts after the 5th one. An attacker with access to the device bypasses weak authentication mechanisms (e.g., weak passwords, lack of rate limiting) to gain control of the wallet

    Robust Authentication

    Expand

    Uses strong authentication, such as resistance to trivial or commonly-used passwords. Including biometrics and rate limiting in mobile.

    Reasoning

    Weak local authentication can completely undermine all other security controls. Strong passwords, biometrics, and rate-limiting make brute force, shoulder surfing, and opportunistic device access much harder.

    Instructions

    Check whether biometric authentication is available and attempt to set a weak PIN (e.g. 1234). Then attempt multiple incorrect logins and observe whether rate limiting activates.

    Criteria

    Passes if the wallet supports biometrics; if it allows easy-to-guess passwords/pins, make sure that it rate limits attempts after the 5th one.

    Attack Scenario

    An attacker with access to the device bypasses weak authentication mechanisms (e.g., weak passwords, lack of rate limiting) to gain control of the wallet

  • Users sometimes reveal seed phrases or private keys without fully understanding that doing so grants complete control over their assets. A clear warning at the moment of exposure can prevent catastrophic mistakes and reinforces the severity of the action. Navigate to the seed phrase or private key reveal screen and observe whether the risks of sharing the secrets are shown. Passes if the wallet clearly communicates these risks and displays a warning to the user before revealing the secrets. A user exposes their seed phrase without understanding it grants full control over their funds

    Seed phrase access warning

    Expand

    Warns users of the risk before allowing access to seed phrases or private keys.

    Reasoning

    Users sometimes reveal seed phrases or private keys without fully understanding that doing so grants complete control over their assets. A clear warning at the moment of exposure can prevent catastrophic mistakes and reinforces the severity of the action.

    Instructions

    Navigate to the seed phrase or private key reveal screen and observe whether the risks of sharing the secrets are shown.

    Criteria

    Passes if the wallet clearly communicates these risks and displays a warning to the user before revealing the secrets.

    Attack Scenario

    A user exposes their seed phrase without understanding it grants full control over their funds

  • Users need a fast way to secure the wallet when stepping away, sharing a screen, or using a device in public. Manual locking gives immediate control rather than forcing the user to wait for an inactivity timer. Look for a manual lock button within the wallet UI. Passes if the wallet includes a manual lock control. An attacker with access to the device interacts with an unlocked wallet session to perform unauthorized actions

    Manual wallet lock

    Expand

    Allows users to lock it manually.

    Reasoning

    Users need a fast way to secure the wallet when stepping away, sharing a screen, or using a device in public. Manual locking gives immediate control rather than forcing the user to wait for an inactivity timer.

    Instructions

    Look for a manual lock button within the wallet UI.

    Criteria

    Passes if the wallet includes a manual lock control.

    Attack Scenario

    An attacker with access to the device interacts with an unlocked wallet session to perform unauthorized actions

  • Seed phrases and private keys should be protected behind strong re-authentication because they are the ultimate account recovery and control mechanism. Displaying them without an authentication step makes accidental exposure and local compromise far more likely. Navigate to the seed phrase or private key display screen and observe whether authentication is required before the secrets are shown. Passes if authentication is required before displaying mnemonics or private keys. An attacker with access to the device retrieves seed phrases or private keys due to missing or weak re-authentication controls

    Seed phrase access control

    Expand

    Requires authentication to access seed phrases or private keys.

    Reasoning

    Seed phrases and private keys should be protected behind strong re-authentication because they are the ultimate account recovery and control mechanism. Displaying them without an authentication step makes accidental exposure and local compromise far more likely.

    Instructions

    Navigate to the seed phrase or private key display screen and observe whether authentication is required before the secrets are shown.

    Criteria

    Passes if authentication is required before displaying mnemonics or private keys.

    Attack Scenario

    An attacker with access to the device retrieves seed phrases or private keys due to missing or weak re-authentication controls

  • Mobile devices are frequently lost, borrowed, or left unlocked briefly, so short auto-lock periods materially reduce the chance of unauthorized access. Review the auto-lock timer in the wallet settings. If it's set to 0, the wallet won't likely auto-lock. If the wallet does not expose an auto-lock setting, exit the wallet or leave it idle and observe whether it locks after a period of inactivity. Also verify whether the wallet also locks when the application is moved to the background or when the device itself is locked. Passes if the wallet auto-locks after inactivity (1 minute or less by default), when the device locks, or when the app moves to the background. An attacker with access to the device exploits an idle or background wallet session that remains unlocked

    Automatic wallet lock

    Mobile Expand

    Verifies wallet auto-locks on inactivity, device lock, or background.

    Reasoning

    Mobile devices are frequently lost, borrowed, or left unlocked briefly, so short auto-lock periods materially reduce the chance of unauthorized access.

    Instructions

    Review the auto-lock timer in the wallet settings. If it's set to 0, the wallet won't likely auto-lock. If the wallet does not expose an auto-lock setting, exit the wallet or leave it idle and observe whether it locks after a period of inactivity. Also verify whether the wallet also locks when the application is moved to the background or when the device itself is locked.

    Criteria

    Passes if the wallet auto-locks after inactivity (1 minute or less by default), when the device locks, or when the app moves to the background.

    Attack Scenario

    An attacker with access to the device exploits an idle or background wallet session that remains unlocked

  • Browser extension wallets often remain open for long periods on shared or unattended computers. A reasonable auto-lock time reduces the window in which an attacker, coworker, or malicious webpage can exploit an already-unlocked wallet. Check the wallet settings for an auto-lock configuration. If no setting is visible, leave the wallet idle for up to 20 minutes to observe whether it auto-locks. If it's 0 by default, then the wallet does not auto-lock on inactivity. Passes if the wallet auto-locks after inactivity within 20 minutes. An attacker with access to the device exploits an idle or unattended wallet session that remains unlocked

    Automatic wallet lock

    Browser Expand

    Verifies wallet auto-locks on inactivity.

    Reasoning

    Browser extension wallets often remain open for long periods on shared or unattended computers. A reasonable auto-lock time reduces the window in which an attacker, coworker, or malicious webpage can exploit an already-unlocked wallet.

    Instructions

    Check the wallet settings for an auto-lock configuration. If no setting is visible, leave the wallet idle for up to 20 minutes to observe whether it auto-locks. If it's 0 by default, then the wallet does not auto-lock on inactivity.

    Criteria

    Passes if the wallet auto-locks after inactivity within 20 minutes.

    Attack Scenario

    An attacker with access to the device exploits an idle or unattended wallet session that remains unlocked

Threat Prevention

Evaluates proactive measures against deceptive dApps and external threats. Includes blocklists for phishing and malicious contracts, identification of trusted domains, and filtering out malicious tokens or NFTs.

Attack scenario A user interacts with a phishing site or malicious contract, and the wallet fails to intercept the interaction or warn about the risk, leading to direct asset loss.

7 checks

  • Verified dApp indicators help users distinguish trusted, well-known services from lookalike phishing sites. This is especially valuable during connection prompts, where users are often making a quick trust decision with limited information. Attempt to connect to a well-known dApp (e.g. Uniswap) and observe the connection request screen. Then repeat with an unknown dApp and compare how each is displayed. Passes if verified dApps are clearly distinguished from unknown ones. A phishing site impersonates a trusted dApp to gain user trust and request sensitive actions

    Trusted dApp detection

    Expand

    Informs users when interacting with a trusted dApp URL.

    Reasoning

    Verified dApp indicators help users distinguish trusted, well-known services from lookalike phishing sites. This is especially valuable during connection prompts, where users are often making a quick trust decision with limited information.

    Instructions

    Attempt to connect to a well-known dApp (e.g. Uniswap) and observe the connection request screen. Then repeat with an unknown dApp and compare how each is displayed.

    Criteria

    Passes if verified dApps are clearly distinguished from unknown ones.

    Attack Scenario

    A phishing site impersonates a trusted dApp to gain user trust and request sensitive actions

  • Many scams rely on users sending funds to addresses already known to be linked to theft, laundering, or fraud. Alerting on such addresses gives users a last defensive checkpoint before irreversible on-chain transfers. In the testing dApp, at `/scamtest`, click “Switch to Scam Address” and attempt to send the transaction to the pre-filled address **0x592340957eBC9e4Afb0E9Af221d06fDDDF789de9** (the Tornado Cash attacker address). Test both via dApp and direct wallet UI. Observe whether the wallet surfaces any warning. Passes if the wallet warns or flags the malicious address or blocks the transaction. A user unknowingly sends funds to an address associated with scams, theft, or malicious activity

    Malicious address detection

    Expand

    Prevents or alerts users about interactions with a known malicious address.

    Reasoning

    Many scams rely on users sending funds to addresses already known to be linked to theft, laundering, or fraud. Alerting on such addresses gives users a last defensive checkpoint before irreversible on-chain transfers.

    Instructions

    In the testing dApp, at /scamtest, click “Switch to Scam Address” and attempt to send the transaction to the pre-filled address **0x592340957eBC9e4Afb0E9Af221d06fDDDF789de9** (the Tornado Cash attacker address). Test both via dApp and direct wallet UI. Observe whether the wallet surfaces any warning.

    Criteria

    Passes if the wallet warns or flags the malicious address or blocks the transaction.

    Attack Scenario

    A user unknowingly sends funds to an address associated with scams, theft, or malicious activity

  • Phishing websites are one of the most common ways users lose funds or sign malicious payloads. Detecting and warning on known phishing domains blocks attacks early, before the user even reaches the approval stage. Visit or attempt to connect to sites included in the [MetaMask phishing list](https://github.com/MetaMask/eth-phishing-detect/blob/b68a72cc477273db3717204d5db699c11980b2f5/src/config.json) and observe whether the wallet warns the user. Note that Chrome also includes built-in phishing protection, which may trigger warnings for some of these sites, though not all. Passes if the wallet warns or prevents the user from visiting or connecting to known phishing sites. A user interacts with a known malicious website that attempts to steal funds or signatures

    Phishing dApp detection

    Expand

    Prevents or alerts users about interactions with a known malicious URL.

    Reasoning

    Phishing websites are one of the most common ways users lose funds or sign malicious payloads. Detecting and warning on known phishing domains blocks attacks early, before the user even reaches the approval stage.

    Instructions

    Visit or attempt to connect to sites included in the MetaMask phishing list and observe whether the wallet warns the user. Note that Chrome also includes built-in phishing protection, which may trigger warnings for some of these sites, though not all.

    Criteria

    Passes if the wallet warns or prevents the user from visiting or connecting to known phishing sites.

    Attack Scenario

    A user interacts with a known malicious website that attempts to steal funds or signatures

  • Explaining the scope of access during the connection flow improves informed consent and reduces the chance that users treat connection prompts as harmless. Attempt connecting a dApp to the wallet and inspect the connection dialog for any description of what access the dApp is being granted. Passes if the connection dialog clearly mentions the ability to view the user's balance and activity, as well as to request transaction approvals. A user grants access to a malicious dApp without understanding the scope of its capabilities, allowing it to later exploit its permissions or any wallet-side vulnerabilities once connected

    dApp access disclosure dialog

    Expand

    Informs dApp access to balances, history, and signing requests on connection.

    Reasoning

    Explaining the scope of access during the connection flow improves informed consent and reduces the chance that users treat connection prompts as harmless.

    Instructions

    Attempt connecting a dApp to the wallet and inspect the connection dialog for any description of what access the dApp is being granted.

    Criteria

    Passes if the connection dialog clearly mentions the ability to view the user's balance and activity, as well as to request transaction approvals.

    Attack Scenario

    A user grants access to a malicious dApp without understanding the scope of its capabilities, allowing it to later exploit its permissions or any wallet-side vulnerabilities once connected

  • Highlighting unknown recipients creates a useful pause before sending funds or interacting with a new contract that may be malicious or mistyped. Send a transaction to a fresh address (never interacted with and not saved as a contact) both through a dApp and directly through the wallet UI. Observe whether any warning or indicator appears. Passes if the wallet shows a warning or indicator for unknown addresses. A user sends funds to an unfamiliar or unverified address without recognizing the associated risk

    Unknown address detection

    Expand

    Warns users when interacting with an unknown address.

    Reasoning

    Highlighting unknown recipients creates a useful pause before sending funds or interacting with a new contract that may be malicious or mistyped.

    Instructions

    Send a transaction to a fresh address (never interacted with and not saved as a contact) both through a dApp and directly through the wallet UI. Observe whether any warning or indicator appears.

    Criteria

    Passes if the wallet shows a warning or indicator for unknown addresses.

    Attack Scenario

    A user sends funds to an unfamiliar or unverified address without recognizing the associated risk

  • The origin URL is one of the most important signals for spotting phishing or impersonation attempts. Showing the full, non-truncated URL helps users notice deceptive subdomains, typosquatting, or other visual tricks that could be hidden by truncation. Attempt to connect the wallet to the testing dApp and observe how the origin URL is displayed in the connection dialog. Passes if the full dApp origin URL is shown without truncation. A phishing site uses deceptive or truncated URLs to impersonate a legitimate service

    Full dApp URL display

    Expand

    Clearly displays the full dApp URL in the connection prompt.

    Reasoning

    The origin URL is one of the most important signals for spotting phishing or impersonation attempts. Showing the full, non-truncated URL helps users notice deceptive subdomains, typosquatting, or other visual tricks that could be hidden by truncation.

    Instructions

    Attempt to connect the wallet to the testing dApp and observe how the origin URL is displayed in the connection dialog.

    Criteria

    Passes if the full dApp origin URL is shown without truncation.

    Attack Scenario

    A phishing site uses deceptive or truncated URLs to impersonate a legitimate service

  • Spam tokens and NFTs are commonly used for phishing, impersonation, and social engineering inside wallet portfolios. Hiding them by default reduces clutter and lowers the chance that users click malicious assets or mistake them for legitimate holdings. Using a test wallet that has received spam NFTs and tokens, open the wallet and observe which assets are displayed by default. Passes if spam tokens or NFTs are hidden by default or the wallet does not display NFTs. Spam tokens or NFTs trick users into interacting with malicious links, contracts, or social engineering schemes

    Malicious or spam token filtering

    Expand

    Hides malicious tokens and NFTs by default.

    Reasoning

    Spam tokens and NFTs are commonly used for phishing, impersonation, and social engineering inside wallet portfolios. Hiding them by default reduces clutter and lowers the chance that users click malicious assets or mistake them for legitimate holdings.

    Instructions

    Using a test wallet that has received spam NFTs and tokens, open the wallet and observe which assets are displayed by default.

    Criteria

    Passes if spam tokens or NFTs are hidden by default or the wallet does not display NFTs.

    Attack Scenario

    Spam tokens or NFTs trick users into interacting with malicious links, contracts, or social engineering schemes

FAQ


This ranking is for informational purposes only. It should not be relied on to provide legal, tax, financial, investment, or other types of advice. Coinspect does not guarantee or warrant the accuracy, completeness, timeliness, suitability, or validity of the information provided and will not be responsible for any claim attributable to reliance on errors, omissions, or other inaccuracies of any part of such information.

Back to top