ColdfrontSecurity
What happens to the API key from the moment you paste it until Coldfront locks, and what Coldfront does not protect you from.
How the API key is handled
- Stored. Encrypted with your passphrase (PBKDF2-SHA256, 600,000 rounds, AES-GCM) in the extension's own storage. Web pages cannot read it.
- Unlocked. Decrypted into the extension's session memory, with the auto-lock deadline set first.
- Handed over. Given to a Hyperliquid tab once, as the app starts. Frames and other sites get nothing.
- Removed. Taken out of page storage as soon as the app has read it. The app keeps it in memory to sign orders.
- Locked. Every Hyperliquid tab reloads and is checked; the session is wiped.
What it protects against
- Drainer sites. Your cold wallet is not connected while you trade, so there is nothing to sign away.
- A stolen laptop. The vault needs your passphrase or your fingerprint.
- A leaked API key. It cannot withdraw or transfer. Revoke it on the API page.
- Walking away. Auto-lock, idle lock and last-tab lock.
What it does not protect against
- Malware on your computer while Coldfront is unlocked.
- A compromised Hyperliquid website: while unlocked, the app holds the API key in memory.
- Bad trades: the API key can trade, including trades you didn't mean.
- A fake copy of Coldfront. Install only from the link on this site and check the extension ID:
kihcdlneekddhjopligjhoflnkkeadgg.
Permissions
| Permission | Why |
|---|---|
| storage | The encrypted vault, your settings, and the session while unlocked. |
| alarms | Auto-lock at the time you choose. |
| idle | Lock when the computer is idle or the screen locks. |
| app.hyperliquid.xyz | Hand the API key to the Hyperliquid app, remove it after start-up, reload tabs on lock. No other site. |
Review rounds
| Round | What changed |
|---|---|
| 1 | Message hardening and key release rules |
| 2 | 17 findings from an external AI-assisted review, all fixed |
| 3 | Lock always reloads; key removed from page storage after start-up |
| 4 | Every Hyperliquid tab reloads on lock; frames get nothing |
| 5 | Slow connections handled on lock |
| Referral check | Added with 9 new tests |
| 6 | Pre-launch review of every shipped file: consent check added, wording fixed; 154 checks in total |
Found a problem? See the security policy.