- •Private key or seed phrase extraction from local storage
- •Remote code execution in the desktop application
- •Smart contract exploit draining bridge funds
- •Authentication bypass leading to full wallet access
- •Cross-site scripting (XSS) in the web renderer
- •Transaction manipulation before signing
- •Unauthorized access to read-only wallet data
- •Bridge protocol state manipulation
- •UI spoofing or misleading transaction details
- •Denial of service in portfolio sync
- •Incorrect NFT ownership attribution
- •Information disclosure of non-sensitive data
✓ In Scope
- Smart contracts: NFT bridge contracts (LayerZero, Wormhole adapters)
- Desktop application core: wallet key management, encryption, local storage
- Bridge protocol: quote generation, transaction signing flow
- API endpoints: authentication, data validation, rate limiting
✕ Out of Scope
- Social engineering attacks against NFT Wallet team or users
- Vulnerabilities in third-party dependencies (report to them directly)
- Issues already reported or being fixed (check our public tracker)
- Theoretical vulnerabilities without a working proof of concept
Found a vulnerability?
Send a detailed report including steps to reproduce, impact assessment, and any proof-of-concept code. We respond within 48 hours.
Report to security@nftwallet.org →Please allow up to 90 days before public disclosure.