Is ROSE Wallet safe?
ROSE Wallet stores a V0 migration backup of private keys in extension localStorage protected by a KDF 31x weaker than the current standard.
During a one-time profile migration, ROSE Wallet writes an encrypted backup of all private keys and mnemonics to extension localStorage under the key 'oasis_wallet_backup_v0'. This backup is derived with only 10,000 PBKDF2-SHA256 iterations while the current storage path uses 310,000 iterations, making the backup significantly more vulnerable to offline brute-force if the browser profile is ever accessed by an attacker.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itOasis Protocol Foundation - no other listings under this identity
Oasis Protocol Foundation - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 2.5.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
Show you desktop notifications
notifications