WALLET SECURITY

Your wallet is a Web2 app with keys inside. Audit it like one.

Our research found 20+ major wallets where a malicious dApp could reach core permissions through WebViews, and we’ve published deep work on MetaMask’s Snaps sandbox.

$36.82B+On-chain TVL secured

$1.00B+Vulnerabilities patched

120+Projects audited

Public audits Get in touch

Trusted by teams building the next generation of crypto

Public audit reportsSeal 911 membersSolana · EVM · Sui · Aptos · Cosmos · NEAR

WHAT WE AUDIT

Where wallets break

Wallets sit between users and every chain they touch. We test the whole surface.

Wallets

From MetaMask’s Snaps sandbox to WebView integrations, where we found 20+ major wallets letting a malicious dApp reach core permissions.

Pentesting

White-box and black-box testing based on each project’s needs, aimed at the large, underexplored Web2 attack surfaces that remain in many Web3 applications.

Backends and frontends

The Web2 code around your contracts: frontends and backends written in JavaScript, Rust and Python.

Published research

Notes on exploits, audits, reverse engineering and security patterns from the field. When a pattern affects our clients, we notify them and publish the work.

WHY OTTERSEC

What wallet teams get

Findings shared as they emerge, not held back for the final report.
The mix of manual review, fuzzing and formal verification your system calls for.
A team that stays close after the report ships and supports your community.
A final report with every finding and suggestions for fixes.
Coverage across Solidity, Vyper, Solana Rust, CosmWasm, Go, Move, JavaScript, Circom and Halo 2.

WALLETS

Have your wallet tested by researchers who study wallet attack surfaces

White-box or black-box, based on what your project needs. Tell us where you are.

Get in touch