MetaMask Connect Audit Report

Cyfrin5 Mar 2026Code version: not recorded (see the report)

Audit · firm’s term: audit report

Cyfrin reviewed MetaMask (MetaMask Connect Audit Report) on 5 Mar 2026: 11 findings, 0 critical; 9 marked fixed, 2 acknowledged.

No open critical findings

Open the report Open MetaMask’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	1	4
Low	0	1	4

HighNonce tracking lacks integrity protections as spoofed clientId enables persistent message suppressionFixed

The report gives no description here.

Mediumeciesjs major version mismatch between dApp SDK and mobile wallet creates untested cryptographic interoperability riskFixed

The report gives no description here.

MediumNo public key validation at handshake and session resumption boundariesFixed

The report gives no description here.

MediumRace conditions in sessionstore master list operationsFixed

The report gives no description here.

MediumSession object with private key, decrypted payloads logged in debug mode and deeplink url being logged unconditionally on error pathFixed

The report gives no description here.

LowInternal origin allowlist bypass via unnormalized URL matching in ConnectionRegistryFixed

The report gives no description here.

LowOTP generated using math.random is not cryptographically secure way to generate verification codeFixed

The report gives no description here.

LowTransport-Layer Nonce Poisoning Causes Permanent Session Denial of ServiceFixed

The report gives no description here.

LowWeak structural validation of connectionRequest from deeplinkFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of MetaMask’s security record

MetaMask

Audits8 audits by 2 firmsLast audit Apr 2026, by Cyfrin.

Critical findingsNo open critical findingsAcross 8 reports.

Open MetaMask’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.