OWASP Web3 Wallet Security
(WWS) Securing the wallet layer of Web3

This is the official GitHub repository of the OWASP Web3 Wallet Security (WWS) project. This initiative focuses on defining security standards, testing methodologies, and risk awareness for Web3 wallet systems. The project is designed to address the unique security challenges at the wallet layer, where users interact directly with decentralized applications and manage digital assets. The WWS ecosystem consists of focused resources that work together to improve wallet security practices, enable consistent verification, and support secure development and auditing of wallet implementations.

---

Join the OWASP Smart Contract Security Slack

Community discussions and support focused on the project.

🧩 Project Components

The Web3 Wallet Security (WWS) project is structured around three core resources, each addressing a critical aspect of wallet security:

• Web3 Wallet Top 10
  Identifies the most critical risks affecting wallet security, based on real-world attack patterns and emerging threats.

• Web3 Wallet Security Verification Standard (WWSVS)
  Defines security requirements and controls for designing, building, and evaluating secure wallet systems.

• Web3 Wallet Security Testing Guide (WWSTG)
  Provides practical methodologies for testing, auditing, and validating wallet implementations against known attack scenarios.

These resources are designed to work together to establish a consistent and effective approach to wallet security.

---

Why Wallet Security Matters

Web3 wallets are the primary interface between users and decentralized systems.

They are responsible for:

• Managing private keys and sensitive data
• Signing transactions and messages
• Interacting with external applications and smart contracts

Despite this, wallets remain one of the most targeted and least standardized components in the ecosystem.

Attacks increasingly focus on:

• Manipulating user signing behavior
• Exploiting trust in external data (RPC, dApps)
• Abusing wallet permissions and session states

This project exists to address these gaps and define a clear security baseline for wallet systems.

---

👥 Who This Is For

This project is designed for:

• Wallet Developers
  Building secure wallet applications and improving existing implementations.

• Security Auditors
  Assessing wallet systems and identifying potential vulnerabilities.

• Organizations
  Establishing security baselines and evaluating wallet solutions.

• Researchers
  Studying wallet attack surfaces and emerging threats.

• Web3 Users (Advanced)
  Understanding risks associated with wallet usage and transaction signing.