wallet-security.json

{
  "nodes": [
    {
      "id": "asset-seed-secrets",
      "type": "asset",
      "title": "Seed phrase and recovery secrets",
      "summary": "The mnemonic or recovery material that reconstructs signing keys. Anyone who sees it can take the wallet.",
      "domains": ["devices-identity", "people"],
      "status": "proposed",
      "tags": ["seed-phrase", "recovery", "keys"],
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations", "incident-response"],
      "framework": "wallet-security"
    },
    {
      "id": "component-hardware-wallet",
      "type": "component",
      "title": "Hardware wallet",
      "summary": "A dedicated signing device that keeps keys offline and shows destination and amount on its own screen.",
      "domains": ["devices-identity", "governance-treasury"],
      "status": "proposed",
      "tags": ["hardware-wallet", "cold-wallet"],
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "wallet-security"
    },
    {
      "id": "component-software-wallet",
      "type": "component",
      "title": "Software wallet",
      "summary": "A hot wallet on a phone or browser that signs from an internet-connected device. Convenience with a larger remote attack surface.",
      "domains": ["devices-identity", "onchain-systems"],
      "status": "proposed",
      "tags": ["software-wallet", "hot-wallet"],
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "wallet-security"
    },
    {
      "id": "component-seed-backup",
      "type": "component",
      "title": "Seed backup",
      "summary": "Offline copies of the seed phrase: paper, metal, or split shares. Physical access here is wallet takeover.",
      "domains": ["devices-identity", "people"],
      "status": "proposed",
      "tags": ["seed-phrase", "backup"],
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations", "recovery"],
      "framework": "wallet-security"
    },
    {
      "id": "surface-transaction-signing",
      "type": "attack-surface",
      "title": "Transaction signing",
      "summary": "The moment a wallet approves calldata. A hostile UI or unread payload turns a good key into an authorized drain.",
      "domains": ["devices-identity", "onchain-systems"],
      "status": "proposed",
      "tags": ["signing", "calldata"],
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "wallet-security"
    },
    {
      "id": "surface-seed-custody",
      "type": "attack-surface",
      "title": "Seed custody",
      "summary": "How the seed is written, stored, split, and retrieved. Digital copies and casual physical access both count as exposure.",
      "domains": ["devices-identity", "people"],
      "status": "proposed",
      "tags": ["seed-phrase", "custody"],
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations", "recovery"],
      "framework": "wallet-security"
    },
    {
      "id": "surface-token-approvals",
      "type": "attack-surface",
      "title": "Token approvals",
      "summary": "ERC-20 approve and permit grants that let a spender move tokens later. Unlimited allowance outlives the original swap.",
      "domains": ["onchain-systems"],
      "status": "proposed",
      "tags": ["approvals", "permit", "erc20"],
      "roles": ["engineer-developer", "multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "wallet-security"
    },
    {
      "id": "threat-blind-signing",
      "type": "threat",
      "title": "Blind signing",
      "summary": "The signer approves attacker-controlled calldata because a website, chat, or wallet UI was trusted instead of the raw transaction.",
      "domains": ["devices-identity", "onchain-systems"],
      "status": "proposed",
      "tags": ["signing", "phishing", "calldata"],
      "severity": "critical",
      "severityBasis": "Default triage is critical because a valid signature spends funds without stealing the key. Impact scales with what the wallet can move.",
      "framework": "wallet-security"
    },
    {
      "id": "threat-seed-phrase-compromise",
      "type": "threat",
      "title": "Seed phrase compromise",
      "summary": "The seed is photographed, typed into a connected device, stored in cloud notes, or read by someone with physical access.",
      "domains": ["devices-identity", "people"],
      "status": "proposed",
      "tags": ["seed-phrase", "theft"],
      "severity": "critical",
      "severityBasis": "Default triage is critical because the seed reconstructs every derived key. Treat any suspected exposure as full compromise.",
      "framework": "wallet-security"
    },
    {
      "id": "threat-unlimited-token-approval",
      "type": "threat",
      "title": "Unlimited token approval",
      "summary": "A spender keeps uint256 allowance or a permit grant after the intended swap. A later exploit or hostile spender drains the wallet.",
      "domains": ["onchain-systems"],
      "status": "proposed",
      "tags": ["approvals", "permit"],
      "severity": "high",
      "severityBasis": "Default triage is high because the drain does not need the key, but it is limited to the approved token and spender. Treat as critical when the spender is unaudited or the allowance is protocol-wide.",
      "framework": "wallet-security"
    },
    {
      "id": "control-cold-wallet-separation",
      "type": "control",
      "title": "Cold and hot wallet separation",
      "summary": "Keep high-value keys on offline or hardware signers. Use a hot wallet only for amounts you can afford to lose.",
      "domains": ["devices-identity", "governance-treasury"],
      "status": "proposed",
      "tags": ["cold-wallet", "isolation"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "wallet-security"
    },
    {
      "id": "control-offline-seed-custody",
      "type": "control",
      "title": "Offline seed custody",
      "summary": "Keep the seed offline, preferably durable and split. Treat any screen, photo, or cloud copy as compromise and rotate.",
      "domains": ["devices-identity", "people"],
      "status": "proposed",
      "tags": ["seed-phrase", "offline"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations", "recovery"],
      "framework": "wallet-security"
    },
    {
      "id": "control-simulate-before-sign",
      "type": "control",
      "title": "Simulate and decode before signing",
      "summary": "Independently simulate the transaction and read destination, asset, and calldata on a trusted display. Do not sign because a website said it was safe.",
      "domains": ["devices-identity", "onchain-systems"],
      "status": "proposed",
      "tags": ["simulation", "verification"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "wallet-security"
    },
    {
      "id": "control-limited-token-approvals",
      "type": "control",
      "title": "Limited token approvals",
      "summary": "Approve only the amount needed for this transaction. Revoke leftover allowances. Avoid permit and infinite approve by default.",
      "domains": ["onchain-systems"],
      "status": "proposed",
      "tags": ["approvals", "allowance"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["engineer-developer", "multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "wallet-security"
    },
    {
      "id": "guidance-wallet-security",
      "type": "guidance",
      "title": "Wallet Security",
      "summary": "Custody models, hot versus cold tradeoffs, signing verification, seed custody, and safer contract interaction.",
      "domains": ["devices-identity", "onchain-systems"],
      "status": "proposed",
      "tags": ["wallet"],
      "href": "/wallet-security/overview",
      "framework": "wallet-security"
    },
    {
      "id": "guidance-cold-vs-hot",
      "type": "guidance",
      "title": "Cold vs hot wallets",
      "summary": "Match fund tier to connectivity. Cold and hardware signers cut remote theft; hot wallets stay for operational amounts.",
      "domains": ["devices-identity"],
      "status": "proposed",
      "tags": ["cold-wallet", "hot-wallet"],
      "href": "/wallet-security/cold-vs-hot-wallet",
      "framework": "wallet-security"
    },
    {
      "id": "guidance-seed-phrase-management",
      "type": "guidance",
      "title": "Seed phrase management",
      "summary": "Offline backup, metal and split-share options, and the rule that suspected exposure means rotate immediately.",
      "domains": ["devices-identity", "people"],
      "status": "proposed",
      "tags": ["seed-phrase"],
      "href": "/wallet-security/seed-phrase-management",
      "framework": "wallet-security"
    },
    {
      "id": "guidance-signing-verification",
      "type": "guidance",
      "title": "Signing and verification",
      "summary": "Never sign blindly. Prefer the hardware screen and independently verified calldata over any web UI claim.",
      "domains": ["devices-identity", "onchain-systems"],
      "status": "proposed",
      "tags": ["signing", "verification"],
      "href": "/wallet-security/signing-and-verification/signing-verification",
      "framework": "wallet-security"
    },
    {
      "id": "guidance-smart-contract-interaction",
      "type": "guidance",
      "title": "Smart contract interaction security",
      "summary": "Verify the contract, simulate, and limit approvals before interacting. Most losses here are interaction mistakes, not stolen keys.",
      "domains": ["onchain-systems"],
      "status": "proposed",
      "tags": ["approvals", "simulation"],
      "href": "/wallet-security/smart-contract-interaction-security",
      "framework": "wallet-security"
    }
  ]
}