Security Audit
Internal source-code review of Danny Wallet
- Scope
- Browser wallet · Desktop
- Network
- Danny Chain (EVM 5069)
- Audit type
- Internal source review
- Date
- June 25, 2026 (rev. 1.1)
- Version
- 1.1
Overall rating
🟢 Good
No critical, fund-loss vulnerabilities
0
Critical
1
High
1
Medium
2
Low / Info
Summary
Danny Wallet is non-custodial — private keys and recovery phrases are generated and stored only on the user's device, encrypted with a PIN. The core architecture follows good practice: WebCrypto (PBKDF2-SHA256 with 210,000 iterations + AES-256-GCM), PIN brute-force protection, no secret logging, and a PIN is required for every signing action. One high-severity issue (Permit phishing via typed-data signing) was found and has been fixed and deployed.
Reviewed areas
Cryptography & key management
PBKDF2-SHA256 (210k iters) + AES-256-GCM, random salt/IV per blob, GCM-tag PIN check
PIN brute-force protection
Exponential cooldown after 5 fails, wallet wipe after 10
Transaction & message signing
PIN required every time, no auto-sign; calldata decoded & warned
dApp browser (iframe)
Cross-origin + no provider injection → dApp can't reach keys
Data storage & privacy
Only encrypted blobs stored; no plaintext key/seed; no tracking
Network & headers
HTTPS, CSP frame-ancestors, nosniff, referrer-policy
Findings
Permit / typed-data blind signing — content not shown; risk of being tricked into signing a Permit (gasless approve) to drain tokens
Wallet wipe after 10 wrong PINs — seedless imported accounts without a key backup risk permanent loss
Dependency hardening — removed @stablelib/ed25519 and patched elliptic via package overrides (npm prod criticals now 0)
DappBrowser broad sandbox — mitigated by cross-origin
HIGH-01 — Fixed
The WalletConnect confirmation screen now decodes typed-data requests and shows what is being signed. When a request is an EIP-2612 Permit (a gasless, signature-based token approval), it displays a strong warning including the spender and amount — preventing blind-signed approvals that could drain tokens.
Remediations (rev. 1.1)
Dependency overrides removed @stablelib/ed25519 and patched elliptic — npm production criticals reduced to 0.
Unlimited token approvals (approve max / Permit) now require an explicit acknowledgement checkbox before signing.
Import / create flows now warn that seedless accounts are not in the recovery phrase and must be backed up.
This is an internal source-code review, not an audit by an independent third-party firm. It covers the wallet client only — not DEX/bridge smart contracts or network infrastructure. The report reflects the state at the audit date; re-audit when significant crypto, signing, or dependency changes are made.
Found a vulnerability? See our Bug Bounty program.