document security_report
Security report
Presign reads transactions for people who are about to sign them, so it has to be the most boring piece of software in their wallet. This page lists what was audited, what was found and what is still open.
- 2
- independent audits
- 23
- findings
- 23
- resolved
- 0
- open critical or high
audits
Two audits, both public
Sep 2025 · v1.0 extension and rule engine
Halcyon Security
14 findings, all resolved
Jun 2026 · v2.0 simulation engine and API
Northgate Audits
9 findings, all resolved
findings
Every finding, with its fix
| id | finding | severity | status |
|---|---|---|---|
| NG-01 | Simulation fork could lag the chain head by two blocks | High | Fixed in v2.0.1 |
| NG-04 | Rate limit bypass on the batch endpoint | Medium | Fixed in v2.0.2 |
| NG-07 | Verbose error leaked internal hostnames | Low | Fixed in v2.0.2 |
| HS-02 | Popup could be covered by a dapp iframe | High | Fixed in v1.0.1 |
| HS-09 | Permit signatures decoded without the deadline | Medium | Fixed in v1.1 |
| HS-13 | Settings sync stored a wallet label in plain text | Info | Fixed in v1.1 |
NG-01
HighSimulation fork could lag the chain head by two blocks
Fixed in v2.0.1
NG-04
MediumRate limit bypass on the batch endpoint
Fixed in v2.0.2
NG-07
LowVerbose error leaked internal hostnames
Fixed in v2.0.2
HS-02
HighPopup could be covered by a dapp iframe
Fixed in v1.0.1
HS-09
MediumPermit signatures decoded without the deadline
Fixed in v1.1
HS-13
InfoSettings sync stored a wallet label in plain text
Fixed in v1.1
how we work
Rules we keep
rule 01
No keys, ever
Presign reads requests. It cannot sign, send or hold anything.
rule 02
Runs on your device
Checks run locally by default. The private cloud mode is opt in and keeps no logs past 24 hours.
rule 03
Open rules
Every flag comes from a published rule you can read, test and argue with.
bug bounty
Find a hole, get paid in USDC
Report through security@presign.example. We answer within one working day and pay within 14 days of the fix.
- Critical
up to 50,000 USDC
- High
up to 10,000 USDC
- Medium
up to 2,500 USDC
- Low
up to 500 USDC
Read. Then sign.
Add Presign to your wallet and see every request in plain words before you confirm it.