Is Puzzle Wallet safe?

Medium risk

Puzzle Wallet is medium risk. When you create a Puzzle Wallet, the extension sends your Aleo view key to its own server at jigsaw.puzzlethebar.com along with the wallet-creation request. The view key can decrypt every private transaction tied to the account.

Puzzlev5.2.20Chrome Web Store
45Risk
Who publishes it

Medici Collective Co - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Puzzle
Declared legal entity
Medici Collective Co
Registered address
312 ARIZONA AVE, OFC 208, Santa Monica, CA 90401, US
Registered contact
Jonathan Gonzalez
Website
github.com/puzzlehq/puzzle-sdk/issues

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Puzzle Wallet sends your Aleo view key to its server when you create a wallet

When you create a Puzzle Wallet, the extension sends your Aleo view key to its own server at jigsaw.puzzlethebar.com along with the wallet-creation request.

The view key can decrypt every private transaction tied to the account.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You create a new wallet by entering or generating an Aleo seed phrase.

This happens once, during the initial wallet setup flow.

The extension did this

The extension sends your Aleo view key to its own server as part of the wallet-creation request.

The request also includes your wallet address, device ID, and Ethereum address.

Captured request
POSThttps://jigsaw.puzzlethebar.com/api/v3/wallet

200 OK, wallet record created server-side.

Body
{  "walletAddress": "aleo1p6ug02vkeyzcm2ncdujxwwnkfffdm8rrgnhrukcyvvv0f2c99grqxwv793 (illustrative)",  "imported": false,  "signupCode": null,  "primaryAccount": {    "privateKeyAuth": "<auth token, illustrative>",    "address": "aleo1p6ug02vkeyzcm2ncdujxwwnkfffdm8rrgnhrukcyvvv0f2c99grqxwv793 (illustrative)",    "viewkey": "AViewKey1jRXftMgTLQhdWagFhDtDLMQVPremRc74S7RLVrqsU5Dd",    "walletAddress": "aleo1p6ug02vkeyzcm2ncdujxwwnkfffdm8rrgnhrukcyvvv0f2c99grqxwv793 (illustrative)"  },  "deviceID": "8f2a41c9-6b3d-4e21-9a77-2c5e0d914abf (illustrative)",  "ethAddress": "0x7e5f2C1a9B3D4e6F8A0c2B4d6E8f0A2c4E6f8A0c (illustrative)",  "source": "extension"}
The code that does this

Wallet-creation payload and the API call that sends it

Readable version
const walletCreationPayload = {  walletAddress: aleoAddress,  imported: isImportedWallet,  signupCode: referralCode || signupCode,  primaryAccount: {    privateKeyAuth: privateKeyAuthToken,    address: aleoAddress,    viewkey: aleoViewKey,    walletAddress: aleoAddress,  },  deviceID: deviceId,  ethAddress: ethService.deriveFromMnemonic(seedPhrase).address,  source: 'extension',};await jigsawApiClient.createWallet(walletCreationPayload);// JigsawApiClientasync createWallet(payload) {  return this.post('/api/v3/wallet', payload);}
Fields sent in the wallet-creation request
  • Aleo view key
    AViewKey1jRXftMgTLQhdWagFhDtDLMQVPremRc74S7RLVrqsU5Dd

    Lets anyone who has it decrypt and read every private transaction tied to your wallet. It cannot move funds.

  • Wallet address
    aleo1p6ug02vkeyzcm2ncdujxwwnkfffdm8rrgnhrukcyvvv0f2c99grqxwv793

    Your public Aleo address, used to look up your account on the server.

  • Device ID
    8f2a41c9-6b3d-4e21-9a77-2c5e0d914abf

    A persistent identifier for this browser installation.

  • Ethereum address
    0x7e5f2C1a9B3D4e6F8A0c2B4d6E8f0A2c4E6f8A0c

    A companion Ethereum address derived from the same seed phrase.

Where the view key is sent
    • jigsaw.puzzlethebar.com

    Puzzle Wallet's own backend. Stores the view key to compute balances and transaction history server-side.

Why the server needs this

The server needs the view key to compute balances and transaction history for the account. A privacy policy is shown at wallet creation, but the view key upload itself is not called out there.

Updated 30 September 2026fdchdcpieegfofnofhgdombfckhbcokj