Calderon Wallet
Smart-account wallet with recovery guardians.
A smart-account wallet on Aptos using resource accounts. Guardians can rotate the authentication key after a delay; spending limits apply per session key.
- Ecosystem
- Aptos
- Category
- Wallet Infrastructure
- Languages
- Move (Aptos), TypeScript
- Launched
- Sept 2025
Grade BBB · Moderate risk
Adequate posture with notable weaknesses in one or more areas.
+0.4 since Nov 2025 · ±0.0 since Jul 2026
Quantix Protocol Research · as of 24 Oct 2026 · About this data
Risk Index
How the score is built
| Component | Weight | Value | Points | Gap |
|---|---|---|---|---|
| Code Security | 30% | 80 | 24.0 | −6.0 |
| Operational Security | 20% | 76 | 15.2 | −4.8 |
| Governance Risk | 15% | 80 | 12.0 | −3.0 |
| Economic Security | 15% | 82 | 12.3 | −2.7 |
| Infrastructure Resilience | 10% | 74 | 7.4 | −2.6 |
| Transparency | 10% | 76 | 7.6 | −2.4 |
| Quantix Risk Index | 100% | 78.5 | −21.5 |
| Component | Calderon Wallet |
|---|---|
| Code | 80 |
| Operational | 76 |
| Governance | 80 |
| Economic | 82 |
| Infrastructure | 74 |
| Transparency | 76 |
Grade scale
- AAA90–100
- AA85–89.9
- A80–84.9
- BBB75–79.9
- BB70–74.9
- B65–69.9
- CCC60–64.9
- CC55–59.9
- C50–54.9
- D0–49.9
Score history
12 monthly snapshots
| Period | Quantix Risk Index |
|---|---|
| Nov ’25 | 78.1 |
| Dec ’25 | 78.1 |
| Jan ’26 | 78.1 |
| Feb ’26 | 78.1 |
| Mar ’26 | 78.1 |
| Apr ’26 | 78.1 |
| May ’26 | 78.5 |
| Jun ’26 | 78.5 |
| Jul ’26 | 78.5 |
| Aug ’26 | 78.5 |
| Sep ’26 | 78.5 |
| Oct ’26 | 78.5 |
4 May 2026
Upgrade
Guardian recovery delay
Recovery rotation now waits 48 hours.
- Governance Risk+3
Risk factors
MediumCode SecurityProfile analysis
Broad session keys
A leaked session key can call any module up to its spending limit.
MediumOperational SecurityProfile analysis
App supply chain
A compromised wallet release could request malicious signatures.
Recommendations
Code Security: 80 → 86
Target-scoped session keys
Bind session keys to specific modules and functions.
+1.8
→ 80.3
Operational Security: 76 → 82
Reproducible app builds
Publish build provenance for each release.
+1.2
→ 79.7
Analysis
Contract, governance and operations
Contract analysis
- Source
- Verified
- Upgradeability
- Module upgrade policy (compatible)
- Administrative control
- Account owner; guardians for recovery
- Enforced delay
- 48 hours
- External dependencies
- Guardian set; Wallet application releases
- PassSource published. Account and recovery modules published.
- PassRecovery delay. Key rotation by guardians waits 48 hours.
- CautionSession-key scope. Session keys limited by amount but not by target module.
Governance exposure
Low
Users control their own accounts; guardians act only through delayed recovery.
Operational resilience
Adequate
Wallet app release pipeline is a key dependency.
Monitoring
Monitoring history
- 3 Feb 2026InformationalRecovery requests at 1.9× the usual rateContract Activity · recovery moduleResolved
Research assessment
No Quantix assessment of Calderon Wallet has been published. Its security findings are represented by the contract-analysis signals above: 0 failed and 1 cautionary.
Research
Relevant research
Architecture
System components
- account module
- Authentication keys and session keys
- recovery module
- Guardian approvals and delayed rotation
- Wallet app (TypeScript)
- Transaction building and signing
Turn risk factors into a remediation plan.
A research assessment traces each weakness to code, configuration or process, and verifies the fix before the score moves.