Wallets
From MetaMask’s Snaps sandbox to WebView integrations, where we found 20+ major wallets letting a malicious dApp reach core permissions.
WALLET SECURITY
Wallet audits from MetaMask Snaps researchers
Our research found 20+ major wallets where a malicious dApp could reach core permissions through WebViews, and we’ve published deep work on MetaMask’s Snaps sandbox.
$36.82B+On-chain TVL secured
$1.00B+Vulnerabilities patched
Trusted by teams building the next generation of crypto
Public audit reportsSeal 911 membersSolana · EVM · Sui · Aptos · Cosmos · NEAR
WHAT WE AUDIT
Where wallets break
Wallets sit between users and every chain they touch. We test the whole surface.
Pentesting
White-box and black-box testing based on each project’s needs, aimed at the large, underexplored Web2 attack surfaces that remain in many Web3 applications.
Backends and frontends
The Web2 code around your contracts: frontends and backends written in JavaScript, Rust and Python.
CLIENTS
Wallet teams on OtterSec
“Their website says protecting Blockchain ideas, but their command of JavaScript is impressive. If you've got something that you think would be "too hard for pentesters to understand" - these folks will surprise you. They're not your average pentester.”
“OtterSec is one of the strongest auditors on Solana. Fast, thorough, and a joy to work with. They are the best in the business and I can’t recommend them enough.”
FAQ
Wallet audit questions
What does OtterSec audit?
Protocol code, infrastructure and ecosystem integrations: Layer 1 foundations, wallets, DeFi protocols, bridges, compilers, ZK systems and Web2 backends, across Solana, EVM, Sui, Aptos, Cosmos, NEAR, Stellar and more.
Is it only manual review?
No. Different systems call for different techniques. Pentesting, formal verification and fuzzing are core disciplines, and we pick the mix that fits yours.
What happens after the report?
We’re not done when your report ships. We stay close with our clients, support their communities and build long-term relationships around stronger security.
Can we read past audits?
Yes. Every public security review from the OtterSec team is listed at osec.io/audits.
How is the price worked out?
We quote from the expected duration, the potential vulnerabilities and the overall complexity of your project.
WALLETS
Have your wallet tested by researchers who study wallet attack surfaces
White-box or black-box, based on what your project needs. Tell us where you are.
Get in touch