Verifiable security, all the way down.
Starknet Wallet is designed around local-first keys, clear transaction review, Cairo call previews, and smart-account permission checks. The goal is simple: review before you sign.
- Local-first keys
- No telemetry by default
- Signed builds
- Mainnet/Sepolia clarity
Six pillars, one rule: review before you sign.
Starknet Wallet treats networks, dApps, contracts, and clipboard data as inputs to verify — not assumptions to trust.
Local-first keys
Sensitive account data stays on your device by default. Private keys are never transmitted to a remote server.
Cairo call preview
See contract calls and calldata context before signing. Review the dApp, network, contract, function, and fee in one place.
Smart-account permissions
Review session keys, spending approvals, and account permissions before granting or extending them.
Signed builds
Verify downloads with SHA256 checksums and PGP signatures. Maintained desktop builds are reproducible from open source.
No telemetry by default
No analytics, no usage tracking, and no remote logging unless you explicitly opt in.
Network clarity
Starknet Mainnet and Starknet Sepolia are clearly separated before every action so you always know what you are signing on.
Threat model
A structured view of the scenarios we account for when designing review flows. Statuses use plain language and describe how each scenario is addressed in the product.
| Threat | Scenario | Mitigation | Status |
|---|---|---|---|
| Malicious dApp transaction | A dApp requests a call that hides intent in calldata. | Cairo call preview surfaces the target contract, function, and decoded calldata before signing. | Mitigated |
| Blind signing risk | User signs without seeing what the call does. | Signing is always preceded by a structured transaction view. | Mitigated |
| RPC tampering | A compromised RPC returns inconsistent data. | Network and chain ID are validated and shown alongside every action. | Monitored |
| Clipboard hijack | Malware swaps an address from the clipboard. | Address checksums and full-address display reduce reliance on truncated views. | Monitored |
| Supply-chain download | User downloads a tampered installer. | SHA256 checksums and PGP signatures published for the current maintained build. | Mitigated |
| Phishing UI | Look-alike sites or apps imitate Starknet Wallet. | Brand guidelines, signed builds, and verification instructions. | Monitored |
| Session key abuse | Granted session keys exceed user intent. | Smart-account permission review highlights scope and limits. | Mitigated |
| Wrong network signing | User signs on Mainnet thinking they are on Sepolia. | Mainnet and Sepolia are visually distinct in every signing surface. | Mitigated |
Layered custody, local by default.
Readable Cairo context before signing.
Every signing surface shows: the dApp, the network, the target contract, the function and decoded calldata, an estimated fee, and any permission changes implied by the call.
Verify the binary you’re running.
Each signed build includes a SHA256 checksum and a PGP signature. The hash and signing key fingerprint for the current maintained build are published on the Versions page.
Built to be inspected.
Read the source, verify the build, review the Cairo call. Then sign. See Docs for how to verify builds step by step.