Crypto Wallets

The reference implementation of pre-signature transparency in this pool, and the product that proves the signing axis actually separates. Rabby is a self-custodial EVM wallet from OPCODE LABS PTE. LTD. (the DeBank team), shipping as an MIT-licensed browser extension, a desktop app and iOS/Android apps. Where most wallets show a confirm button, Rabby's help centre documents an entire pre-signature apparatus: a simulation that previews the exact balance change, a decode that turns calldata into a readable action, a named Security Engine whose heuristics are published rather than hand-waved, and — uniquely in this pool — a hard lockout, "If a risk is detected, the Sign button will be disabled." Key custody is equally plain: one vendor page documents both Backup Seed Phrase and Backup Private Key on both platforms, with no email or account anywhere in the flow. The paperwork is better than it first appears: fourteen dated third-party audit reports across two repositories, from SlowMist, Least Authority and Cure53, spanning 2021-2025 and covering the extension, iOS and Android separately, joined by SlowMist reports dated 2026-08-24 for all three. What is genuinely missing is the disclosure machinery — no bug bounty, no security policy, no advisory archive — and the help centre remains silent on the October 2022 Rabby Swap contract exploit that cost users roughly $194,000, an event the vendor did in fact disclose on the day, on X, but never on its own website.

The default EVM wallet: seed and per-account private-key export both documented on a stated BIP-44 path, a 2017-2025 public audit trail with three dated vendor advisories, and a pre-signature balance preview for contract interactions only, enforced onchain on 15 named networks for smart accounts on Extension.

Mainstream self-custody mobile wallet with a genuinely documented simulate-and-decode signing screen on both platforms — but whose browser extension was supply-chain compromised in December 2025, still cannot export a raw private key, and whose audit register and security page carry no account of its own 2023 key-generation flaw.

The Solana-native software wallet turned multichain money app, whose default new-user account now keeps its private key in a Phantom-run enclave that will not export it.