ColdfrontSecurity
What happens to the API key from the moment you paste it until Coldfront locks, and what Coldfront does not protect you from.
How the API key is handled
- Stored. Encrypted with your passphrase (PBKDF2-SHA256, 600,000 rounds, AES-GCM) in the extension's own storage. Web pages cannot read it.
- Unlocked. Decrypted into the extension's session memory, with the auto-lock deadline set first.
- Handed over. Given to a Hyperliquid tab once, as the app starts. Frames and other sites get nothing.
- Removed. Taken out of page storage as soon as the app has read it. The app keeps it in memory to sign orders.
- Locked. Every Hyperliquid tab reloads and is checked; the session is wiped.
What it protects against
- Drainer sites. Your cold wallet is not connected while you trade, so there is nothing to sign away.
- A stolen laptop. The vault needs your passphrase or your fingerprint.
- A leaked API key. It cannot withdraw or transfer. Revoke it on the API page.
- Walking away. It locks after the time you set, when your computer goes idle, or when you close the last Hyperliquid tab.
What it does not protect against
- Malware on your computer while Coldfront is unlocked.
- A compromised Hyperliquid website: while unlocked, the app holds the API key in memory.
- Bad trades: the API key can trade, including trades you didn't mean. Someone who stole a valid API key couldn't withdraw, but could trade the account down to liquidation. Keep only what you trade with in the account, and revoke the API key on Hyperliquid's API page if you think it leaked.
- A harmful update: Chrome installs extension updates automatically. Whoever controls Coldfront's Chrome Web Store publisher account could ship an update that misuses the API key the next time you unlock.
- A fake copy of Coldfront. Install only from the link on this site and check the extension ID:
ijhlfmhnpbgknhabconhepgdaabaeogg.
Permissions
| Permission | Why |
|---|---|
| storage | The encrypted vault, your settings, and the session while unlocked. |
| alarms | Auto-lock at the time you choose. |
| idle | Lock when the computer is idle or the screen locks. |
| app.hyperliquid.xyz | Hand the API key to the Hyperliquid app, remove it after start-up, reload tabs on lock. No other site. |
Internal review rounds
These were our own reviews, not an independent audit. No outside security firm has reviewed Coldfront yet.
| Round | What changed |
|---|---|
| 1 | Checked which pages can talk to the extension, and when the API key is released |
| 2 | An AI-assisted review found 17 issues; all fixed |
| 3 | Locking always reloads the tab, and the API key leaves page storage after start-up |
| 4 | Every Hyperliquid tab reloads on lock, and embedded frames never get the API key |
| 5 | Locking works on slow connections too |
| Referral check | Added, with 9 new tests |
| 6 | Every shipped file reviewed before launch; consent check added; 157 checks in total |
| 7 | Version 1.0.1: the Apply code step reviewed. It can sign only the one referral request, and 1,580 test signatures matched a second implementation; 168 checks in total |
The code that encrypts and unlocks the API key is published on GitHub, with tests you can run.
Found a problem? See the security policy.