SWOP security model

Where keys live while SWOP is open, what is erased when it closes, what leaves your computer, and what the design does not protect against.

SWOP handles private keys, so the useful question is not whether it is secure but what specifically it does, what it sends, and what it cannot help with. This page answers all three.

Where keys live

In memory, while the app is open. Nowhere else.

There is no database, no key file, no profile, no configuration holding anything sensitive. Local storage and session data are wiped when SWOP starts and again when it exits, so a session does not inherit anything from the last one or leave anything for the next.

Close SWOP and the key is gone from the machine. The only copy is the one you saved yourself.

This is also why SWOP cannot recover anything. There is no account behind it and nobody holding a copy — that is the same property, described from the other side.

The clipboard

Copying a key or a recovery phrase puts it on the system clipboard, which is shared with every program running.

SWOP clears copied secrets from the clipboard after 30 seconds, and again on exit. The interface tells you it will.

What the application window can do

SWOP's window is sealed off from the rest of your computer: what it displays cannot reach your files or your system.

The window cannot navigate anywhere else. Attempts to change the page are blocked, webviews cannot be attached, and links open in your normal browser instead of inside the app — so nothing can replace SWOP's interface with something that looks like it.

SWOP denies every system permission request: camera, microphone, location. It does not need them, so it cannot be persuaded to use them.

It does not run as administrator.

What leaves your computer

Public addresses, and nothing else.

To show balances, detect tokens and assess token risk, SWOP queries public endpoints: the RPC nodes of each network, Etherscan, Ethplorer, honeypot.is and mempool.space. These requests contain addresses you are looking at. Addresses are public information by construction — that is what a blockchain is — but a query still tells the endpoint that someone is interested in that address.

Private keys and recovery phrases are never included in any request, to any endpoint, under any circumstance.

Sending a transaction transmits the signed transaction, which is the finished result. The signing happens locally and the key is not part of what goes out.

Generating a wallet needs no network at all. That is why the Vault recommends disconnecting first, and why Whales OS exists.

Siade Guard

SWOP checks the published version when it starts. If a newer one exists, the running copy stops and shows where to download it.

Two reasons. A build that handles keys should not keep running once a fixed version is out, and the check makes it harder to sit on a tampered old copy indefinitely.

Only the current release is supported. Fixes ship as a new version rather than as a patch to an old one.

Verifying what you run

Every published build has a SHA-256 checksum, listed both on the download page and in the public repository. Check it before you run the file. Installing SWOP has the command.

The source is published under a licence permitting reading, building and testing. It is public for one reason: a program you hand a private key to should be one you can read.

What this does not protect you from

Stating this plainly is more useful than a list of features.

A compromised computer. If malware is running with your privileges, it can read your screen, log your keystrokes and read memory. Nothing an application does defeats that from inside. This is the argument for generating wallets offline, and for Whales OS.

Approving something you did not read. SWOP decodes requests and flags dangerous ones, which is as far as software can go. A signed approval is valid because you signed it, and it cannot be recalled.

A dishonest contract. SWOP can tell you a transaction grants spending permission to an address. It cannot tell you whether that address belongs to someone who will behave.

A fake download. The checksum exists for this. Anyone can host a file named SWOP-portable.exe.

Losing your backup. There is no recovery. A paper wallet that burns is gone.

Sending to the wrong address. Transactions are final. Check the whole address, not the ends.

Reporting a vulnerability

Privately, not as a public issue. Open the Security tab of the repository and choose Report a vulnerability; only the maintainers see it.

Include the SWOP version and your Windows version, what an attacker could do and under what conditions, and steps to reproduce it.

Testing on your own computer and your own wallets is welcome. Accessing other people's data or funds, and load-testing siadewhales.com, are not.