Is Talisman Wallet safe?
We analyzed Talisman Wallet version 3.10.0's actual code and gave it a 76/100 trust score. Talisman appears purpose-aligned, but its all-site wallet…
Bottom line
Talisman appears purpose-aligned, but its all-site wallet bridge and analytics-related data sharing warrant caution.
What it can access
It runs across all web pages and local files, exposing wallet functions where needed for dapp use; it does not show access to passwords, cookies, or general page contents. [Q1][Q2][Q3][Q14]
Security weaknesses
Every website can reach the wallet bridge, so a malicious site could attempt wallet requests, though site and account checks and approval prompts limit misuse. [Q21]
Signs of misuse
No clear misuse is established, but wallet and transaction information goes to related services and optional analytics can create persistent tracking identifiers. [Q6][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage, tabs, notifications and alarms and injects a page access at document start in every HTTP(S) and file frame. That broad page presence is expected for a wallet provider, while tabs supports phishing redirects and popup/tab handling.
Declares storage, tabs, notifications and alarms; injects content.js into all file/http/https frames and exposes only packaged page.js to them. — manifest.json:2
Which websites can it run on, and can it read or change what appears on those pages?
It adds packaged Ethereum, Solana and Substrate provider objects to every page. The isolated page access only inserts page.js and relays tagged window messages; no host-page text, form, cookie or general page-reading path was found.
Creates a packaged page.js script element, removes it after insertion and relays only messages tagged talisman-page/talisman-content. — content-scripts/content.js:1
Defines wallet-provider globals and request/response messaging; it does not query or edit host-page forms or content. — page.js:1-3
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The all-page code listens only for explicitly tagged wallet messages and contains no input, key or form listener. — content-scripts/content.js:1
Public signing methods check the authorized requesting URL/account and create approval requests before signing. — background.js:60
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The declared permission list omits cookies, history, bookmarks and downloads. — manifest.json:2
Tab queries and updates are used to replace a detected phishing origin with Talisman's warning page. — background.js:60
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests notifications but omits geolocation, media capture, clipboard, management, file-system and native-messaging permissions. — manifest.json:2
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends public wallet addresses and transaction/RPC data to the selected blockchain and related balance, NFT, pricing and portfolio services; those transfers are necessary for a multi-chain wallet. Phishing protection can send the requesting dapp origin to Blockaid.
Posts wallet addresses to asset/balance services, submits approved chain RPC/transactions, sends dapp origins for phishing checks and builds analytics events with dapp and portfolio summaries. — background.js:4, 60
Defines remote service configuration and the default PostHog batch endpoint. — chunks/isJsonPayload-a042cd6c.js:1
Defines useAnalyticsTracking as user-controlled; the analytics sender refuses to transmit unless it is true. — chunks/_virtual_wxt-plugins-7b4a0aa0.js:19
Does it download or run code, settings, or instructions supplied by a remote server?
It refreshes remote feature flags and service configuration from wrc.talisman.xyz, downloads chain/RPC/token metadata and uses server responses for balances, phishing classification and transaction-risk information. These values influence packaged wallet behavior and destinations, but no response was found being loaded as a script or converted into executable JavaScript.
Fetches /config from the packaged Talisman remote-config base and stores validated feature flags, URLs and service settings, refreshing every 30 minutes. — chunks/isJsonPayload-a042cd6c.js:1
Consumes remote chain data, RPC lists, phishing results and feature flags through fixed packaged handlers. — background.js:4, 60
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically refreshes remote configuration, balances and phishing lists, and it can redirect a tab after a wallet request identifies the origin as phishing. These are normal protective/portfolio tasks.
Schedules data refreshes and phishing checks, while authorization and every sign/send path creates a request in a dedicated extension popup. — background.js:4, 60
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declared permissions omit proxy, search, management and browser-setting APIs. — manifest.json:2
Tab creation/update helpers open Talisman pages and redirect confirmed phishing origins to a packaged warning screen. — background.js:60
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The roughly 22 MB unpacked application is heavily bundled and minified and includes large blockchain, cryptography, UI and charting dependencies. Important authorization, signing, storage and network paths remained traceable.
Records a large bundled package with multi-megabyte transaction-history, provider, background and UI chunks. — inventory.json:1
Contains minified third-party blockchain/cryptography code alongside identifiable application handlers and request boundaries. — background.js:1-60
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Lottie's generic expression engine constructs an expression_function with eval, while the actual transaction-state animations are bundled inline expression-free data. — chunks/provideContext-d6c292c3.js:15-16
Extension-page CSP is script-src 'self' 'wasm-unsafe-eval'; it does not include the JavaScript 'unsafe-eval' source. — manifest.json:2
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Creates no network request or general navigation log; it opens a background port only when a tagged wallet message arrives. — content-scripts/content.js:1
Passes a requesting origin to the phishing scanner for sensitive wallet calls and includes dapp/hostname in optional analytics events. — background.js:4, 60
Does it create a persistent ID or browser fingerprint to recognize you?
It generates a persistent random PostHog distinct ID when analytics is used. A Talisman Gandalf service also registers an installation-specific Ed25519 key and install ID for authenticated services access.
Creates and persists a random analytics distinct_id and separately registers a locally generated public key with gandalf.talisman.xyz to obtain an installId. — background.js:4
Stores the user-controlled useAnalyticsTracking setting used to gate PostHog transmission. — chunks/_virtual_wxt-plugins-7b4a0aa0.js:19
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Does not request cookie access, and the page-facing script contains no page-content collector. — manifest.json:2
Network paths use public addresses, chain requests, approved transactions and summarized analytics; keyring secrets remain local and password-gated. — background.js:4, 60
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
The only page listener handles tagged wallet postMessage traffic; it does not register input, key, clipboard or media listeners. — content-scripts/content.js:1
Requests no capture, clipboard or media permission. — manifest.json:2
Can a website or remote server send commands that make the extension take actions?
Talisman's server can change feature flags, service services and recommended network/token settings, and chain servers provide metadata used to display and submit transactions. Packaged code constrains how those values are used.
Defines the remotely refreshed configuration fields consumed by packaged features. — chunks/isJsonPayload-a042cd6c.js:1
Warns that dapp-provided metadata is ignored because approval decoding must use metadata the wallet fetches from the chain. — page.js:3
Routes remote values through fixed feature, network, RPC and risk-analysis handlers rather than an arbitrary command interpreter. — background.js:60
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Contains swap/buy provider APIs and transaction tracking within wallet flows, not general webpage link or shopping manipulation. — background.js:4, 60
Does not inspect or rewrite page links, ads, carts or search results. — content-scripts/content.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Does not request proxy, webRequest, declarativeNetRequest or downloads permission. — manifest.json:2
RPC and transaction submission handlers are wallet-specific and are separated from the page by authorization and approval checks. — background.js:60
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares neither nativeMessaging nor a localhost-specific content script or host permission. — manifest.json:2
Limits the privileged talismanSub page API to app.talisman.xyz; localhost/dev suffixes are accepted only when the packaged DEBUG flag is true, which it is not here. — page.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Contains generic packaged Lottie expression support, but the animations used in this build are bundled data and no remote expression source was identified. — chunks/provideContext-d6c292c3.js:15-16
CSP restricts scripts to packaged self resources and does not allow JavaScript unsafe-eval. — manifest.json:2
Can ordinary websites access privileged extension features through messaging or exposed files?
Every page can send tagged requests through the intended wallet bridge and page.js is web-accessible.
Accepts same-window talisman-page messages and relays them over the named talisman-content runtime port. — content-scripts/content.js:1
Distinguishes the internal extension port from the content port, uses sender.url for public calls, enforces site/account authorization and rejects unsupported public methods. — background.js:60
Exposes only packaged page.js and defines no externally_connectable entry. — manifest.json:2
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses a uniform all-frames match rather than a hidden selective site list. — manifest.json:2
Conditional behavior is tied to documented wallet features, site authorization and phishing protection. — background.js:60
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Solves a server-provided leading-zero SHA-256 challenge only during Gandalf installation registration, then uses the installation key for service tokens. — background.js:4
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Only injects page.js and relays tagged messages; it contains no form lookup, value assignment, action rewrite or submit interception. — content-scripts/content.js:1
Defines wallet-provider globals and events without accessing page forms or input elements. — page.js:1-3