OtterSec Get in touch

WALLET SECURITY

Wallet security from the team that found flaws in 20+ major wallets

Our research found 20+ major wallets where a malicious dApp could reach core permissions through WebViews, and we’ve published deep work on MetaMask’s Snaps sandbox.

$36.82B+On-chain TVL secured
$1.00B+Vulnerabilities patched
Public audits Request a quote

Trusted by teams building the next generation of crypto

Public audit reportsSeal 911 membersSolana · EVM · Sui · Aptos · Cosmos · NEAR

WHY OTTERSEC

What wallet teams get

  1. Coverage across Solidity, Vyper, Solana Rust, CosmWasm, Go, Move, JavaScript, Circom and Halo 2.
  2. A quote built on expected duration, potential vulnerabilities and complexity.
  3. Findings shared as they emerge, not held back for the final report.
  4. The mix of manual review, fuzzing and formal verification your system calls for.

FAQ

Wallet audit questions

What does OtterSec audit?

Protocol code, infrastructure and ecosystem integrations: Layer 1 foundations, wallets, DeFi protocols, bridges, compilers, ZK systems and Web2 backends, across Solana, EVM, Sui, Aptos, Cosmos, NEAR, Stellar and more.

Is it only manual review?

No. Different systems call for different techniques. Pentesting, formal verification and fuzzing are core disciplines, and we pick the mix that fits yours.

What happens after the report?

We’re not done when your report ships. We stay close with our clients, support their communities and build long-term relationships around stronger security.

Do you work beyond the major chains?

Yes. We love niche languages and have worked with teams on Optimism, Arbitrum, Polygon, Algorand, Stellar, Sei, StarkNet and more.

WHAT WE AUDIT

Where wallets break

Wallets sit between users and every chain they touch. We test the whole surface.

Wallets

From MetaMask’s Snaps sandbox to WebView integrations, where we found 20+ major wallets letting a malicious dApp reach core permissions.

Pentesting

White-box and black-box testing based on each project’s needs, aimed at the large, underexplored Web2 attack surfaces that remain in many Web3 applications.

Backends and frontends

The Web2 code around your contracts: frontends and backends written in JavaScript, Rust and Python.

Published research

Notes on exploits, audits, reverse engineering and security patterns from the field. When a pattern affects our clients, we notify them and publish the work.

WALLETS

Have your wallet tested by researchers who study wallet attack surfaces

White-box or black-box, based on what your project needs. Tell us where you are.

Get in touch