Get the extension The Locker Protocol Threat Model
What we protect against, what we don't, and why we chose verifiability over trusted hardware.
Three principles
Air gap by construction, not by policy
The signing device has no USB, no Bluetooth, no network. Requests and signatures cross as QR codes you can see. A property enforced by physics needs no promise.
Verifiable beats certified
The contracts, where your funds actually live, are published and verified on-chain on all 9 networks. Certification asks for your trust; verified contracts don't need it.
No account, nothing shipped
Nothing to register and nothing shipped, so we hold no name or home address of yours. The extension's usage measurement is on by default and switched off in Settings.
Threats, honestly
Remote malware and wallet drainers
Keys live on a device with no network connection. Malware on your computer can propose a transaction, but only the offline vault can sign it, after you've read it.
Blind signing and phishing
The vault decodes every request into human-readable fields on a trusted screen before signing. What you sign is what you saw.
Vendor and supply-chain compromise
No hardware is sold, so none can be intercepted. Updates come only through the browser stores, and the contracts holding your funds are verified on-chain.
Loss or destruction of the device
The paper backup is an encrypted QR code. Print it, store it, restore on any phone with your password.
Physical theft with lab equipment
The vault is encrypted at rest behind your password. But a phone has no certified secure element: against a lab-equipped attacker holding the device, a hardware wallet's chip resists better. On this specific point, a Ledger wins, and we say so.
Coercion (the $5 wrench)
No wallet resists physical coercion. The structural answer is M-of-N multisig: no single person, coerced or not, can move the funds.
Where a secure element wins
A certified secure element (CC EAL5+) resists physical key extraction: decapping, glitching, side channels. If your main risk is a sophisticated attacker physically seizing your signer, a dedicated hardware chip defends that scenario better than a phone. We publish this page so you make that trade-off consciously instead of discovering it later.
Why software anyway
In 2023, Ledger Recover demonstrated that firmware decides what a secure element does: the chip protected the seed only until its vendor shipped a way out. A component you cannot inspect protects you only as long as its vendor chooses to. We prefer properties you can check to promises you must trust.
Don't trust us either: check
2,000+
automated tests, run on every change
7
smart contracts, deployed on 9 chains
0
static-analysis findings, config published
100%
of the contracts published & verified on-chain