Partnered With:

This paper discusses the ecological status of wallet security plug-in market and the expandable market

Read this article in 7 Minutes

Moonbirds founder's wallet stolen, self-hosting wallet trading plug-in anti-phishing function has not been available?

Original author: Haotian

Even the founder of the Crypto industry OG can be attacked by fishing, fishing as fierce as the tiger also. A friend of DM consults, since the anti-phishing function of the transaction plug-in is so urgent, why the MetaMask wallet does not add the transaction preview to the front end to help users screen phishing malicious addresses?

In the following section, Thread takes a look at the current market ecology of wallet security plug-ins (introduce several) and the prospective analysis of the expanding market.

The technical logic of MetaMask and other self-managed wallets is as follows: help users keep local private keys safely, process user transaction signatures, provide a gateway to connect with major blockchain main networks, and facilitate the interaction of smart contracts such as DeFi.

In theory, it is possible to embed any plug-in service that optimizes the experience without compromising wallet transfer interaction. Anti-phishing address screening is only one of the rigid requirements.

Other common features that can optimize the experience are:

1) Token List of common smart contract addresses is displayed by default;

2) The user's commonly used transfer address address book;

3) input address matching phishing website library screening;

4) Counterparty address scoring and blacklist attribute;

5) Cooperate with regulatory KYT compliance review;

Should say, start brainstorming, all useful service features can be embedded before the transaction chain.

However, the current mainstream wallet product features are very simple, in the service optimization is very restrained. Why?

1) Affected by the client information payload, mobile side interaction is more concise than browser plug-in;

2) Under the influence of decentralized consensus, phishing websites and blacklist libraries need centralized operation and maintenance support, which will cause controversy on the consensus side;

3) Affected by commercialization tendency, service mezzanine can optimize the experience, but it is difficult to monetize commercially.

At present, most of the mainstream browser security plug-ins in the market are provided by third-party security data companies: the experience is good, but the popularity is not enough. I preliminary research a few:

1) MetaDockTeam, developed by security company BlockSec, is friendly to developers with its main trade fund flow visualization and transaction risk identification;

2) metashield identifies major phishing websites to help users alert and intercept phishing addresses;

3) PocketUniverse has a strong sense of product design and a good combination of marketing and business;

4) Wallet Guard, hatched by Binance labs, focuses on phishing protection and personal security Dashboard protection data display;

5) Abundant information preview before Stelo's main transaction can be used to intuitively judge the risks of the counterparty through historical data;

6) Blockem features anti-fraud features such as AI algorithm simulation transactions and address scoring.

They all have a dream to become the 360 security guard of web3, although the road is long and difficult.

1) Plug-ins that provide plug-in services also have potential security risks, and their trust consensus needs time to accumulate;

2) Active users who usually trade in DEX or Mint NFT have weak security awareness at the present stage, and the user habit needs to be formed SlowMist

3）钓鱼网站更新、黑名单地址库等运维挑战大；

And the wallet most likely to grab such add-ons by the throat went the other way. The idea behind MetaMask is to segment user groups and application scenarios.

Launched MetaMask Institutional clients with paying capacity and a large number of users. In addition to risk early warning and screening, the internal examination and approval console, data Dashboard, transaction KYT compliance, anti-money laundering review and other customized functions can be integrated and accessed through API.

在我看来，钱包叙事应该会趋向于垂直细分化。 1）面向极客的极简钱包；2）面向小白的安全交互防钓鱼钱包；3）面向机构的可定制化钱包；4）MPC 钱包；5）智能合约钱包等等。

But anyway, this and the security plug-in service market does not conflict, the current stage of coexistence, complementary, I believe that an excellent browser security plug-in will eventually become a wallet like the standard.