Web3 Wallet Security

Wallet security, signed end to end.

Wallet-specific security audit covering signature handling, key management, account abstraction, EIP-7702 delegation, and the integration surface where users sign things they shouldn't.

EOAs · smart wallets · AA · EIP-7702 · SDKs

Request an intro call
Why this exists

Wallets are the new attack surface.

Most 2025 user losses didn’t come from contract bugs. They came from wallet flows that signed the wrong payload — phishing drainers, EIP-7702 delegation traps, permit signature abuse. The contracts behaved as designed. The wallet UX was the failure mode. A wallet audit covers that surface specifically.

Scope

What’s in the audit.

What we check

Wallet-specific risk classes

Signature handling (EIP-191, EIP-712, EIP-1271, EIP-7702), key derivation, session keys, transaction simulation, allowance management, and the UI-to-signer trust path.

Wallet types

EOAs, smart wallets, AA, hardware

Browser extensions, mobile wallets, ERC-4337 account abstraction wallets, EIP-7702-delegated EOAs, and the SDKs that integrate with hardware wallets.

Integration surface

Wallet-Connect, RPC providers, dApp integration

WalletConnect session handling, RPC endpoint trust, dApp permission models, and the off-chain backend that often gates wallet flows.

Recent engagements

Recent wallet engagement.

Account Abstraction · Solidity

Bastion Wallet Account Abstraction SDK

Audit of an account abstraction SDK — wallet contract logic, signature handling, and EntryPoint integration.

Mar 2024 · Bastion Wallet

How pricing works

Scoped to your wallet.

Wallet audits are sized to surface (SDK vs full consumer wallet), wallet type (EOA, AA, hardware), and integration depth. Talk to us for a scope and quote.

Request an intro call
FAQ

Questions.

Both. SDK audits cover the code that other teams will integrate. Consumer wallet audits cover the full user-facing flow, from key generation to transaction submission, plus the UX patterns that lead users into mistakes.

First-class scope. The audit covers UserOperation validation, paymaster trust, bundler interaction, the EntryPoint integration, and the SDK that constructs UserOps client-side. Bastion Wallet's AA SDK is a recent example.

Yes. EIP-7702 delegated EOAs introduce new attack surfaces — drainer kits already target them in production. We cover delegation authorization, code-set transaction validation, and the wallet UX that authorizes delegation safely.

Yes. Entropy sourcing, BIP-32 / BIP-39 derivation, seed phrase handling, and the boundary between key material and the JavaScript runtime are all in scope.

We review the wallet's defenses: signature simulation, contract verification, known-malicious checks, and the UX that helps users notice they're being phished. The audit reports on what's present and what's missing.

Two to five weeks depending on the surface (SDK only vs. full consumer wallet). We scope and quote against your specific codebase before you commit.

From our research

Go deeper.

EIP-7702

EIP-7702 wallet security after Pectra

The new attack surfaces EIP-7702 opened, the live exploits already in the wild, and what auditors now check.

Threat model

The weakest link in DeFi is the web app

How frontend and wallet integration mistakes turn audited contracts into losing customer funds.

Supply chain

Supply-chain attacks against Web3 teams

npm compromise and dependency confusion — relevant to wallet SDKs that ship code into other developers' apps.

Other services

Need something else?

Parent

Application security

Back to the parent service — full off-chain audit scope.

Sibling

TypeScript audit

If your wallet SDK ships TypeScript code into other developers' apps.

Sibling

Smart contract audit

For the on-chain wallet contract side — AA wallets, EIP-7702 delegators, multisigs.

Ready when you are

Ready to audit your wallet?

Send us your repo and a target date. We’ll come back with a scope and a quote within 24 hours.

Request an intro call