I’ve been frustrated with the tradeoff between hot wallets (convenient and risky) vs hardware wallets (secure and but clunky).
Working at SEAL (https://www.securityalliance.org/) and with SEAL911 I keep seeing the same pattern: One of the most common incident is private key theft, almost always from desktop wallets. Malware goes after browser extensions because your keys sit decrypted in memory.
So I built Lodgelock. It’s a small companion app for MetaMask that keeps keys off the desktop:
- MetaMask works as usual but, when it’s time to sign, the request is proxied to your phone.
- Keys live on your phone behind biometrics.
- The signed payload is sent back to your wallet for deployment.
It adds ~30 seconds compared to a hot wallet, but the keys never touch the desktop.
Some choices I made:
- No MPC or proprietary recovery methods, just a standard seed phrase.
- Open source, GPL-3.0.
- I'm planning to get audited and apply for a MetaMask Grant before calling Lodgelock production-ready.
This isn't a hardware wallet replacement. If you already use a Ledger every time, keep doing that. Lodgelock is for people like me who _should_ use hardware wallets but default to hot wallets because convenience wins.
Can't believe metamask didn't just include 2FA in their product. Almost every day i run into a post on reddit about someone losing their private key or losing funds/NFTs etc by signing a malicious contract or downloading a malicious software.
I’ve been frustrated with the tradeoff between hot wallets (convenient and risky) vs hardware wallets (secure and but clunky).
Working at SEAL (https://www.securityalliance.org/) and with SEAL911 I keep seeing the same pattern: One of the most common incident is private key theft, almost always from desktop wallets. Malware goes after browser extensions because your keys sit decrypted in memory.
So I built Lodgelock. It’s a small companion app for MetaMask that keeps keys off the desktop: - MetaMask works as usual but, when it’s time to sign, the request is proxied to your phone. - Keys live on your phone behind biometrics. - The signed payload is sent back to your wallet for deployment.
It adds ~30 seconds compared to a hot wallet, but the keys never touch the desktop.
Some choices I made: - No MPC or proprietary recovery methods, just a standard seed phrase. - Open source, GPL-3.0. - I'm planning to get audited and apply for a MetaMask Grant before calling Lodgelock production-ready.
This isn't a hardware wallet replacement. If you already use a Ledger every time, keep doing that. Lodgelock is for people like me who _should_ use hardware wallets but default to hot wallets because convenience wins.
If you think this would help you, sign up for the email notifications on the website (https://lodgelock.org/#email-signup) or check out the repo (https://github.com/Robert-MacWha/lodgelock-snap).
Can't believe metamask didn't just include 2FA in their product. Almost every day i run into a post on reddit about someone losing their private key or losing funds/NFTs etc by signing a malicious contract or downloading a malicious software.