Skip to content
Fuga Labs
Scope an engagement
Sector preset

Wallets & signing

For anyone with a signing screen, where the loss is decided in the second before a user presses approve.

Scope an engagement Every sector preset
PresetonboardWalletDetectors in play16Boundaries declared3Refusals at onboarding1

How this sector loses money.

The drain does not begin with a drain. It begins with an approval nobody could read, granted to a contract deployed eleven minutes ago, on a site whose name differs from yours by one character. Every step is a valid transaction your interface rendered correctly.

Answered by
  • 16Deterministic rules

What the preset configures.

One command, and this is its output. The identifiers at the foot are real, so you can diff them against the catalogue rather than trust the list.

onboardWallet(platform, config) 7 configured
  1. 01Allow, warn or block at signature time, with a reason written for a person rather than for a log
  2. 02Transactions, token approvals, EIP-712 and personal-sign requests, screened on decoded intent
  3. 03Your own domains declared, so a homoglyph, a swapped TLD or an edit-distance typosquat is caught before connect
  4. 04Approval risk in full: unlimited allowances, fresh spenders, flagged spenders and blast radius
  5. 05Delegation risk under EIP-7702, session-key scope escalation, and smart-account module installs
  6. 06Address poisoning and dust-airdrop traps, which are aimed at the person rather than at the contract
  7. 07A hard client deadline, and a degraded warn with a legible reason when no answer can be computed
Detectors in play
  • rules.address-poisoning
  • rules.dust-airdrop-trap
  • rules.approval-to-flagged-spender
  • rules.unlimited-approval-fresh-spender
  • rules.monitored-approval-fresh-spender
  • rules.approval-blast-radius
  • rules.approval-campaign-aggregation
  • rules.nft-operator-drain
  • rules.eip7702-delegation-untrusted
  • rules.eip7702-delegated-account-drained
  • rules.session-key-scope-escalation
  • rules.smart-account-module-install
  • rules.paymaster-abuse
  • rules.deployer-reputation
  • rules.sanctioned-interaction
  • rules.intent-solver-mismatch

The perimeter, stated in writing.

Every edge, and the control that closes it. This is the list your auditor and underwriter will ask for, so it sits on the public page rather than an appendix.

The edge Fuga Labs holds no keys and moves no funds, so it cannot stop a signature.
Closed by Closed by putting the decision where it already sits. You get a verdict and a reason before your confirmation screen renders, and your interface decides what to do with it. This changes what your user knows at the moment they choose, not what they are permitted to do.
The edge An outage of ours must never become an outage of your signing flow.
Closed by Closed by owning the failure behaviour in the SDK rather than leaving every integrator to invent a catch block at the worst possible moment. There is a hard client deadline; past it you get a degraded warn. Never allow, because a verdict nobody could compute is not evidence of safety; never block, because that would brick every signature during an outage.
The edge A site impersonating a brand you never declared is not a lookalike to us.
Closed by Closed as far as it goes, and stated plainly where it stops. Cover is exactly the domains you declare, so the list is the product. Onboarding refuses a domain on a shared host, because the label protected there belongs to the platform.
A domain on a shared host is refused at onboarding, rather than accepted and left to generate noise.

Protection attaches to the registrable label, and on a shared host that label belongs to the platform rather than to you. Declaring one would make every other tenant score as a lookalike of your brand, so the check would fire on legitimate sites all day and somebody would switch it off inside a week. Declare a domain you control.

A default that is a refusalEnforced at onboarding, before anything is configured

How it goes live.

Three rungs, in order, and each one written for this preset rather than for presets in general.

  1. Step 1

    Scope

    The domains you own, declared and verified, and the chains your interface signs on. A domain on a shared host is refused outright, so the declared list is settled before anything is wired.

  2. Step 2

    Detect

    One call before your confirmation screen renders, with a hard client deadline and a reason written for a person. Past the deadline you get a degraded warn, never a silent allow.

  3. Step 3

    Prevent

    There is no breaker in this lane and we will not pretend otherwise. Fuga Labs holds no keys, so refusal happens in your interface on your verdict; what you arm is your own block threshold.

What runs underneath.

Signed, expiring alerts matter most in this lane: a verdict your interface showed a user has to stay verifiable long after that session ended.

The base under all eleven presets

Scope Wallets and signing coverage.

Every engagement is scoped by the team, and onboarding is performed by operators. There is no self-serve door, and that is a security decision first.

Scope an engagement Every sector preset