Hacken Security Audit9.5/10
Wallet Architecture
- Date
- 20 February 2026
- Findings
- 0 critical, 0 high, 1 medium, 1 low
DIONE Wallet Security — Specifics, Not Adjectives
The DIONE Wallet has undergone a rigorous security assessment by Hacken, achieving an overall score of 9.5/10. This technical document outlines the specific architectural decisions and cryptographic implementations that safeguard user assets.
Hacken Security Audit9.5/10
Chain & Protocol
- Date
- December 2023
- Findings
- 0 critical, 0 high, 1 medium, 1 low
Code-Signing & Integrity
All binaries distributed via official channels (dionewallet.com, GitHub Releases) are cryptographically signed. This ensures the application has not been tampered with post-compilation. We utilize deterministic build processes where feasible to enable independent verification of the compiled artifacts against the audited source code hash.
SHA256: 8fe5436666fd6b96f95d8fa951c5176b1aaed8396d1de5c1ec88b59b2dc527aeSelf-Custody Architecture
Keys are generated entirely client-side using standard BIP-39 mnemonic derivation. The private key material never leaves the secure enclave of your device. We employ AES-256-GCM encryption for local storage of keys, utilizing a derivation function (Argon2id) on your user-defined password to decrypt the payload only at the moment of signing.
Hardware Wallet Integration
DIONE Wallet integrates with industry-standard hardware signing devices. Keys stay offline on the device; the wallet handles transaction construction and broadcast.
- Ledger Nano X/S Plus
- Trezor Model T
- Tangem Cards
Source Availability
While the core DIONE protocol smart contracts are fully open-source and verifiable on-chain, the proprietary routing algorithms and UI components of the DIONE Wallet application are currently closed-source to protect intellectual property and mitigate immediate cloning risks. We rely on extensive third-party auditing (Hacken) to verify the integrity of the closed-source components. If open-source code review is a hard requirement for you, MetaMask, Rabby, and Frame are open-source EVM alternatives that work with Odyssey Chain via custom RPC.
Chain audit completed December 2023 · Documentation 10/10 · Code 9/10
Reporting
Found a vulnerability? Use our support channels for responsible disclosure for both Odyssey Chain and DIONE Wallet.
Next, see how EVM chain support and native DIONE staking work, or follow our wallet recovery walkthrough. Ready to install? Download DIONE Wallet for Windows, macOS or Linux.
Security FAQ
Where are my private keys stored?
Your private keys are encrypted and stored locally in the secure enclave (Keychain on macOS, DPAPI on Windows, libsecret on Linux) of your device. They are never transmitted to our servers.
What happens if I lose my device?
You can restore your wallet on a new device using the 12 or 24-word Secret Recovery Phrase generated during setup. DIONE cannot recover this phrase for you.
Is there a web version of DIONE Wallet?
No. To minimize phishing vectors and browser-based vulnerabilities, DIONE Wallet is exclusively distributed as a native desktop application.
How does the biometric authentication work?
Biometrics (Touch ID on macOS, Windows Hello on Windows) are used to unlock the locally encrypted keystore. The biometric data itself is managed by the OS and never accessed by the app directly.
Does DIONE track my transactions?
DIONE Wallet connects directly to Odyssey Chain RPC nodes to broadcast transactions. We do not maintain a central database mapping IP addresses to wallet addresses.
What is the bug bounty program?
Report critical vulnerabilities in the wallet infrastructure through our support channels at /support — public, tracked, no DM intermediary.
How are software updates delivered?
Updates are pushed exclusively through the official channels at dionewallet.com and our GitHub Releases mirror, with cryptographic signature verification on each binary. Do not download installers from third-party sites.
Can DIONE freeze my assets?
No. The smart contracts do not contain administrative backdoors or blocklist functions that would allow the core team to seize or freeze user assets.
How do you prevent malicious dApp interactions?
The WalletConnect integration includes an integrated blocklist of known malicious contracts and domains, updated dynamically via community security feeds.
Is multi-sig supported?
Native multi-signature functionality is planned for v2. Currently, users requiring multi-sig should utilize Safe (formerly Gnosis Safe) via the WalletConnect bridge.