Targeted review
One specific question, one component, one version. To verify a critical point without opening up the whole product.
- Targeted code review
- Directed test scenarios
- Technical note and recommendations
For teams that ship fast
03 / Wallet audit
A wallet is judged by its key paths,
not by its interface.
A wallet can be elegant, fast and perfectly audited — and then lose funds through an opaque approval, a predictable random number generator, uncontrolled radio emissions or an implant in the supply chain. We audit the complete chain, from the chip to recovery after an incident.
Scope
Where a mistake becomes permanent.
Eight surfaces of analysis, tailored to each product and each level of risk.
01 / ENTROPY
Key generation
Source of randomness, derivation, BIP-32/39 paths, account management and recovery phrases.
02 / STORAGE
Backup and encryption
Secure elements, software vaults, offline backups, secret sharing and metadata exposure.
03 / SIGNATURE
What is actually signed
Decoding, EIP-712, blind signing, simulation, look-alike addresses and the readability of amounts.
04 / PERMISSIONS
Approvals and delegations
Unlimited allowances, session keys, modular smart accounts, delegated signers and persistent permissions.
05 / SUPPLY CHAIN
Dependencies and updates
Libraries, reproducible builds, distribution channels, browser extensions and update compromise.
06 / RECOVERY
Loss, emergency, succession
Recovery procedures, social recovery, continuity plans and partial-compromise scenarios.
07 / RNG
Random number generator quality
Entropy, firmware RNG, seed generation, signing nonces and derivation. Statistical testing and reproduction.
08 / RADIO & EMISSIONS
What the device emits
LTE/eSIM, Bluetooth, electromagnetic emissions, reception of reference and time-signal stations, physical inspection and the search for supply-chain implants.
Absolute rule: we never need a private key, a recovery phrase or access to funds. Radio analysis is passive and performed on devices we own or with written authorisation: no interception of third-party communications, no jamming. Where a test requires it, it is run by your teams, in your environment, under your control.
Engagement formats
Four levels, one standard of proof.
Every engagement is covered by a letter of engagement and a quotation drawn up after scoping. Missions will open after the declaration with the préfecture.
Full audit
From threat model to final report, with review of the code, the signing flows and the user experience.
- Documented scope and threat model
- Static analysis, dynamic analysis and user-experience review
- Register of findings and remediation plan
- Restitution and verification of fixes
For a wallet before release
Architecture review
Design before you code. We test the choices made for custody, recovery and delegation.
- Threat model and trust boundaries
- Comparison of key-custody options
- Design recommendations
For new products and treasuries
RNG & RF analysis
Two surfaces that software reviews cannot see: the quality of randomness and what the device emits.
- Statistical tests of the random number generator
- RF / EM emissions mapping
- Inspection of a suspect device
- Reproduction scenarios and disclosure
For hardware wallets and their integrators
Process
From the first question to the last fix.
An audit is not a PDF. It is an adversarial, documented and tracked process.
01
Scoping
Objectives, scope, versions, constraints and expectations. We decline any scope we cannot cover.
02
Proposal
Letter of engagement, deliverables, schedule, rules of engagement and confidentiality terms.
03
Analysis
Code review, testing, dynamic analysis and interviews with the product and security teams.
04
Restitution
Report, severities, evidence, prioritised recommendations and a restitution meeting.
05
Follow-up
Verification of fixes, exchanges with the vendor and coordinated disclosure where necessary.
Deliverables
Evidence, not impressions.
Every finding is tied to a version, a reproduction scenario and a recommendation. The report distinguishes what is exploitable from what amounts to hardening.
01
Confidential report
Executive summary, scope, method and limits of the analysis.
02
Register of findings
CVSS v4.0 scoring, scenarios, evidence and exploitation conditions.
03
Reproduction
Steps and artefacts allowing your teams to verify each finding.
04
Remediation plan
Prioritised recommendations, with effort and residual risk.
What we do not do
- Hold, handle or ask for your private keys.
- Sign a transaction in your name.
- Guarantee the absence of any vulnerability.
- Carry out a financial, legal or accounting audit.
- Publish a report without prior coordination.
Scope request
Describe the wallet. We will ask the right questions.
A 30-minute conversation is often enough to clarify the scope, the priority risks and whether an engagement makes sense. No commitment at this stage.
Transparency: audit missions will open after the declaration with the préfecture. This form is a way to open the dialogue now.
Would you rather write to us directly?
contact@frblockchain.icu
Prepare a message
This form sends no data to a server: it opens your email client with a pre-filled message, which you review before sending.
Frequently asked questions
Before you entrust us with a scope.
How much does an audit cost?
The price depends on the scope, the number of components, the versions and the level of proof expected. We will provide a quotation after scoping, never before. Pricing and the business model will be specified once the association is constituted.
Do you work under a non-disclosure agreement?
Yes. The letter of engagement provides for the confidentiality of exchanges, artefacts and the report. Critical findings may be shared with the parties concerned under embargo. Any publication requires written agreement, except where legally required.
What happens if you discover a critical flaw?
We inform you immediately through a dedicated channel, before delivery of the report if necessary. We propose an emergency plan, help with remediation and coordinate disclosure. No publication takes place before users can be protected.
Can you audit a wallet without the vendor’s agreement?
Research on public software can be carried out within a strict legal and ethical framework. A formal audit — with access to the code, the teams and the test environments — requires the vendor’s authorisation. We never circumvent a protection measure.
Can individuals request an audit?
Requests are considered case by case. We give priority to exposed individuals (journalists, activists, entrepreneurs, small organisations) and to high-risk situations. We never promise to recover lost or stolen funds.
Can you analyse a Ledger or another hardware wallet?
Yes, on a device you own or with the owner’s written authorisation. We do not intercept third-party communications, jam signals or test a device without consent. Findings are reproduced, documented and disclosed in a coordinated way.
How do you test radio emissions?
The method combines passive listening in a shielded enclosure, electromagnetic probes, an SDR receiver and comparison with reference devices. A signal is only retained after reproduction and firmware analysis. We distinguish a real leak from a measurement artefact.