If your Snap uses any of the following permissions related to key management, you will need to get a third party audit before submitting your Snap to the allowlist:
snap_getBip32Entropysnap_getBip32PublicKeysnap_getBip44Entropysnap_getEntropysnap_manageAccountsIf your Snap does not use any of these permissions, you can skip this step and proceed to Process for publishing the Snap.
You may work with any auditor on this list. Feel free to contact multiple auditors and request quotes.
| Company Name | Primary Contact Name | Primary Contact Email |
|---|---|---|
| Consensys Diligence | Chingiz Mardanov | [email protected] |
| Cure53 | Dr. Mario Heiderich | [email protected] |
| Hacken | Kostiantyn Harniuk | [email protected] |
| Kudelski Security | Alex Kopferschmitt | [email protected] |
| Ottersec | Alex Donn | [email protected] |
| Sayfer | Nir Duan | [email protected] |
| Slowmist | Jeff Liu | [email protected] |
| Veridise | Amber Huang | [email protected] |
For most Snaps, the scope is limited to the Snap code base. For example, if your Snap has a companion dapp, the dapp code is not required to be audited. However, in some cases where the Snap relies on modules that are critical to the Snap functionality, such as an MPC wallet Snap, then the audit scope should also include the MPC algorithm.
After the audit is complete, you should mitigate any issues of “medium” risk or greater. Please make sure that the audit report contains the commit or version hash of the code that was audited, the commit or version hash of the updated code with any fixes as applicable, and a complete list of all vulnerabilities identified with corresponding fixes or responses from your team.
Audit costs need to be paid by Snap developers. You may apply for a grant to cover the audit cost but we cannot make any commitments as the grant applications go through a voting process. When applying, please indicate that you are applying to cover the audit cost of your Snap and include the quote you received from your auditor.
Once you complete the allowlisting process, we trust that you can continue to follow secure coding practices. Thus, we do not require you to get additional audits. The allowlist uses strict versioning, so you will need to inform the MetaMask Snaps team when you have a new version of your Snap on npm. The MetaMask Snaps team will review the update and add it to the allowlist after the review process is complete.
To request an update to be allowlisted, use the update request form.