Authority Auditor

Who can sign / recover / export keys / change policy / pause / upgrade — alone, or only in cooperation. Read-only: no keys, no custody, no transactions.

Pick a preset, fill the guided form, or paste a provider's exported config. The per-provider parsers (Privy, Dynamic, Web3Auth, Turnkey) map it to the authority matrix. On-chain verification (viem reads) is Phase 3.

Read-only. We never ask for keys, seed phrases, or signatures.

Preset config

The config this preset feeds to the rules engine (the matrix is computed from these values only)

{
  "name": "Jayverse Wallet (self-audit)",
  "embeddedWallet": {
    "provider": "Privy",
    "custodyModel": "mpc-tss",
    "keyExportByProvider": false,
    "keyExportByUser": true,
    "recovery": "guardian",
    "evidence": "https://docs.privy.io/guide/security/"
  },
  "contract": {
    "ownerModel": "multisig",
    "multisigThreshold": "2-of-3",
    "upgradeable": true,
    "proxyAdmin": "timelock",
    "pauser": "role",
    "evidence": "https://etherscan.io/"
  },
  "sessionKeys": {
    "enabled": true,
    "usableBy": [
      "backend-owner"
    ],
    "revocableBy": [
      "user",
      "backend-owner"
    ],
    "cap": "daily spend cap, revocable"
  }
}

Jayverse Wallet (self-audit)

Generated 2026-09-13T01:54:44.374Z · 30 cells · 30 doc-only · 0 not-verified · 0 on-chain-verified (on-chain reads are Phase 3)

Top findings (worst first)

HIGH — Sign a transaction → Backend / owner key: alone — Backend can sign within the session-key scope (cap: daily spend cap, revocable).
HIGH — Pause → Backend / owner key: alone — Owner / a PAUSER role can pause alone.

Authority matrix

Action \ Actor	User	Provider	Backend / owner key	Guardians	Nobody
Sign a transaction	Alone (info) · doc-only The user authorizes their own transactions. rule: sign.user.owns-key · evidence	Cooperation (medium) · doc-only Provider holds one share; a signature needs another party. rule: sign.provider.threshold · evidence	Alone (high) · doc-only Backend can sign within the session-key scope (cap: daily spend cap, revocable). rule: sign.backend.session-key · evidence	Cannot · doc-only rule: sign.default.cannot · evidence	Cannot · doc-only rule: sign.default.cannot · evidence
Pause	Cannot · doc-only rule: pause.default.cannot · evidence	Cannot · doc-only rule: pause.default.cannot · evidence	Alone (high) · doc-only Owner / a PAUSER role can pause alone. rule: pause.backend.holds-role · evidence	Cannot · doc-only rule: pause.default.cannot · evidence	Cannot · doc-only rule: pause.default.cannot · evidence
Export the private key	Alone (medium) · doc-only User can export their own key. rule: export.user.enabled · evidence	Cannot · doc-only Provider cannot export raw key material. rule: export.provider.disabled · evidence	Cannot · doc-only rule: export.default.cannot · evidence	Cannot · doc-only rule: export.default.cannot · evidence	Cannot · doc-only rule: export.default.cannot · evidence
Recover the account	Cannot · doc-only rule: recover.default.cannot · evidence	Cannot · doc-only rule: recover.default.cannot · evidence	Cannot · doc-only rule: recover.default.cannot · evidence	Cooperation (medium) · doc-only Recovery requires a threshold of guardians. rule: recover.guardians.threshold · evidence	Cannot · doc-only rule: recover.default.cannot · evidence
Change the policy	Cannot · doc-only rule: policy.default.cannot · evidence	Cannot · doc-only rule: policy.default.cannot · evidence	Cooperation (medium) · doc-only Policy changes need a multisig quorum (2-of-3). rule: policy.owner.multisig · evidence	Cannot · doc-only rule: policy.default.cannot · evidence	Cannot · doc-only rule: policy.default.cannot · evidence
Upgrade / change code	Cannot · doc-only rule: upgrade.default.cannot · evidence	Cannot · doc-only rule: upgrade.default.cannot · evidence	Cooperation (medium) · doc-only Upgrades go through a timelock delay. rule: upgrade.admin.timelock · evidence	Cannot · doc-only rule: upgrade.default.cannot · evidence	Cannot · doc-only rule: upgrade.default.cannot · evidence

The config that produced it

{
  "name": "Jayverse Wallet (self-audit)",
  "embeddedWallet": {
    "provider": "Privy",
    "custodyModel": "mpc-tss",
    "keyExportByProvider": false,
    "keyExportByUser": true,
    "recovery": "guardian",
    "evidence": "https://docs.privy.io/guide/security/"
  },
  "contract": {
    "ownerModel": "multisig",
    "multisigThreshold": "2-of-3",
    "upgradeable": true,
    "proxyAdmin": "timelock",
    "pauser": "role",
    "evidence": "https://etherscan.io/"
  },
  "sessionKeys": {
    "enabled": true,
    "usableBy": [
      "backend-owner"
    ],
    "revocableBy": [
      "user",
      "backend-owner"
    ],
    "cap": "daily spend cap, revocable"
  }
}