Back to home

Security Audit

Internal source-code review of Danny Wallet

Download full report (PDF)
Scope
Browser wallet · Desktop
Network
Danny Chain (EVM 5069)
Audit type
Internal source review
Date
June 25, 2026 (rev. 1.1)
Version
1.1

Overall rating

🟢 Good

No critical, fund-loss vulnerabilities

0

Critical

1

High

1

Medium

2

Low / Info

Summary

Danny Wallet is non-custodial — private keys and recovery phrases are generated and stored only on the user's device, encrypted with a PIN. The core architecture follows good practice: WebCrypto (PBKDF2-SHA256 with 210,000 iterations + AES-256-GCM), PIN brute-force protection, no secret logging, and a PIN is required for every signing action. One high-severity issue (Permit phishing via typed-data signing) was found and has been fixed and deployed.

Reviewed areas

Cryptography & key management

PBKDF2-SHA256 (210k iters) + AES-256-GCM, random salt/IV per blob, GCM-tag PIN check

PIN brute-force protection

Exponential cooldown after 5 fails, wallet wipe after 10

Transaction & message signing

PIN required every time, no auto-sign; calldata decoded & warned

dApp browser (iframe)

Cross-origin + no provider injection → dApp can't reach keys

Data storage & privacy

Only encrypted blobs stored; no plaintext key/seed; no tracking

Network & headers

HTTPS, CSP frame-ancestors, nosniff, referrer-policy

Findings

HIGH-01HighFixed

Permit / typed-data blind signing — content not shown; risk of being tricked into signing a Permit (gasless approve) to drain tokens

MED-01MediumRisk accepted

Wallet wipe after 10 wrong PINs — seedless imported accounts without a key backup risk permanent loss

LOW-01LowFixed

Dependency hardening — removed @stablelib/ed25519 and patched elliptic via package overrides (npm prod criticals now 0)

LOW-02LowAcknowledged

DappBrowser broad sandbox — mitigated by cross-origin

HIGH-01 — Fixed

The WalletConnect confirmation screen now decodes typed-data requests and shows what is being signed. When a request is an EIP-2612 Permit (a gasless, signature-based token approval), it displays a strong warning including the spender and amount — preventing blind-signed approvals that could drain tokens.

Remediations (rev. 1.1)

Dependency overrides removed @stablelib/ed25519 and patched elliptic — npm production criticals reduced to 0.

Unlimited token approvals (approve max / Permit) now require an explicit acknowledgement checkbox before signing.

Import / create flows now warn that seedless accounts are not in the recovery phrase and must be backed up.

This is an internal source-code review, not an audit by an independent third-party firm. It covers the wallet client only — not DEX/bridge smart contracts or network infrastructure. The report reflects the state at the audit date; re-audit when significant crypto, signing, or dependency changes are made.

Found a vulnerability? See our Bug Bounty program.