Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Security Considerations for Passkey-Based Web3 Wallets

certik.com | blog | #web3 | #best-practices | #fido2 | #webauthn | #blockchain-security | #erc-4337 | #account-abstraction | #security-analysis | #wallet-security | #clave | #passkey-wallet | #passkey

Summary

A lifecycle security analysis of Passkey Wallets: tracing one transaction through Clave's implementation, mapping WebAuthn, FIDO2, and CTAP flaws to each stage, plus checks for teams building one.
Published
Collected

original ↗

Related coverage

blog · certik.com
CertiK Joins LF Decentralized Trust to Advance Security Standards for Enterprise Blockchain
CertiK joined LF Decentralized Trust, the Linux Foundation's enterprise blockchain community, to bring security expertise into shared open-source infrastructure as global regulation tightens.
blog · certik.com
Where CIP-56 Security Actually Lives: A Guide for Institutions on Canton
CIP-56's security lives in Daml implementation details—views, choices, factories, client-side construction, and participant permissions—and the guide covers CIP-0112 (Token Standard V2) changes.
blog · certik.com
Advancing Sui: The Evolution of Sui’s Payment Pipeline
How Sui's Address Balance layer enables gasless stablecoin transfers, and why the May 2026 mainnet halts exposed risky boundaries between gas charging, settlement, and validator restarts.
blog · certik.com
Post-Quantum Signatures, Part 2: From Trees to Forests
XMSS organizes one-time signature keys into Merkle trees and hyper-trees, a practical post-quantum signature scheme with compact proofs and fast verification, at the cost of strict state management.
blog · certik.com
CertiK Expands AI-Native Security with Agent Integrations and AI Auditor
CertiK AI Auditor opens to the public after six months of internal use, hitting an 88.6% exact detection rate across 35 real-world 2026 Web3 incidents. Integrations embed it into AI coding agents.
blog · blog.trailofbits.com
Six mistakes in ERC-4337 smart accounts
Drawing on audits of dozens of ERC-4337 smart accounts, this post catalogs six recurring vulnerability patterns, including access control flaws, incomplete signature validation and ERC-1271 replay.
back