Larkspur Wallet SDK
Signing SDK and pairing relay for Cosmos dApps.
A TypeScript SDK that lets dApps request signatures from mobile and browser wallets, with a Go relay that pairs sessions and forwards encrypted messages. Chain metadata is loaded from a registry service.
- Ecosystem
- Cosmos
- Category
- Wallet Infrastructure
- Languages
- TypeScript, Go
- Launched
- May 2025
Grade A · Moderate risk
Sound posture; some improvements recommended.
+2.2 since Nov 2025 · +2.2 since Jul 2026
Quantix Protocol Research · as of 24 Oct 2026 · About this data
Risk Index
How the score is built
| Component | Weight | Value | Points | Gap |
|---|---|---|---|---|
| Code Security | 30% | 80 | 24.0 | −6.0 |
| Operational Security | 20% | 78 | 15.6 | −4.4 |
| Governance Risk | 15% | 85 | 12.8 | −2.3 |
| Economic Security | 15% | 88 | 13.2 | −1.8 |
| Infrastructure Resilience | 10% | 74 | 7.4 | −2.6 |
| Transparency | 10% | 84 | 8.4 | −1.6 |
| Quantix Risk Index | 100% | 81.4 | −18.6 |
| Component | Larkspur Wallet SDK |
|---|---|
| Code | 80 |
| Operational | 78 |
| Governance | 85 |
| Economic | 88 |
| Infrastructure | 74 |
| Transparency | 84 |
Grade scale
- AAA90–100
- AA85–89.9
- A80–84.9
- BBB75–79.9
- BB70–74.9
- B65–69.9
- CCC60–64.9
- CC55–59.9
- C50–54.9
- D0–49.9
Score history
12 monthly snapshots
| Period | Quantix Risk Index |
|---|---|
| Nov ’25 | 79.2 |
| Dec ’25 | 79.2 |
| Jan ’26 | 79.2 |
| Feb ’26 | 79.2 |
| Mar ’26 | 79.2 |
| Apr ’26 | 79.2 |
| May ’26 | 78.2 |
| Jun ’26 | 79.2 |
| Jul ’26 | 79.2 |
| Aug ’26 | 81.4 |
| Sep ’26 | 81.4 |
| Oct ’26 | 81.4 |
28 Aug 2026
Research assessment
Research assessment completed: Penetration Test
7 findings (2 high, 2 medium, 2 low, 1 informational). All critical and high findings addressed.
Read the research assessment- Code Security+6
- Transparency+4
24 Jun 2026
Upgrade
Blind-signing warnings released
SDK flags permit-style and arbitrary-message requests.
- Operational Security+4
- Transparency+2
18 May 2026
Incident analysis
Look-alike dApp collects unlimited authz grants
Thirty-seven users granted a single grantee open-ended send authority through a cloned front end; 22 balances were moved within the hour.
Incident analysis in Threat Analysis- Operational Security−5
Risk factors
HighInfrastructure ResilienceProfile analysis
Chain registry is a trusted input
A tampered registry entry could point wallets to a malicious RPC endpoint or fee denomination. Responses are not signed.
MediumOperational SecurityProfile analysis
Signature-request phishing
Malicious dApps can request permit-style signatures through the SDK; users rely on the warning UI to notice.
LowInfrastructure ResilienceProfile analysis
Single-region relay
An outage of the relay region breaks pairing for all integrators.
Recommendations
Operational Security: 78 → 84
Structured-data review for permits
Decode EIP-712 and Cosmos sign-doc payloads into human-readable summaries by default.
+1.2
→ 82.6
Infrastructure Resilience: 74 → 84
Sign and pin chain-registry data
Ship registry signing keys in the SDK and reject unsigned or stale metadata.
+1.0
→ 82.4
Analysis
Contract, governance and operations
Contract analysis
- Source
- Verified
- Upgradeability
- Versioned SDK releases (off-chain)
- Administrative control
- Release signing keys held by two maintainers
- Enforced delay
- None identified
- External dependencies
- Chain registry service; Pairing relay; npm and Go module registries
- PassSigned releases. Packages are published with provenance attestations.
- PassRelay encryption. Session messages are end-to-end encrypted.
- CautionRegistry integrity. Chain metadata is fetched over TLS but not signature-pinned.
- PassBlind-signing warnings. Since June 2026 the SDK flags permit-style and arbitrary-message requests.
Governance exposure
Low
No on-chain admin. Release process requires review by two maintainers.
Operational resilience
Adequate
Relay runs in one region; registry compromise would redirect RPC endpoints for integrators.
Monitoring
Monitoring history
- 20 May 2026LowGrant revocations at 2.1× the usual rateContract Activity · Signing SDKResolved
- 19 May 2026LowSDK 2.4 released with decoded grant reviewConfiguration Change · Signing SDKResolved
- 18 May 2026MediumRegistry flags grantee; SDK warns on authz grantsConfiguration Change · Chain registryResolved
- 18 May 2026HighPairing requests with cloned dApp metadataSecurity Alert · Pairing relayResolved
- 18 May 2026HighGrantee executed 22 transfers under authz in 40 minutesSuspicious Transaction Pattern · Signing SDKResolved
- 18 May 2026High37 send authorisations granted to one grantee in one hourSuspicious Transaction Pattern · Signing SDKResolved
Research assessment
QX-TSA-2026-004Penetration TestPublished
Signing SDK, wallet connector, pairing relay API and the staging environment that hosts it.
Review 17 Aug 2026 – 28 Aug 2026 · published 9 Sept 2026
- 6 resolved
- 0 partially resolved
- 1 acknowledged
- 0 open
Continue with
- Monitoring timelineRecorded security events for Larkspur Wallet SDK
- Authorisation phishing through a signing SDKCase study
- Look-alike dApp collects unlimited authz grantsIncident analysis · 18 May 2026
- Risk Index methodologyWeights, grade bands and calculator
Comparable protocols
Compare side by sideResearch
Relevant research
Architecture
System components
- Signing SDK
- Builds sign requests (Amino and Direct) and verifies responses
- Pairing relay
- Session pairing and encrypted message forwarding
- Chain registry
- Serves chain IDs, RPC endpoints and fee denominations
- Staging cloud
- Build pipeline and relay hosting
Turn risk factors into a remediation plan.
A research assessment traces each weakness to code, configuration or process, and verifies the fix before the score moves.