## 3 Technical Overview of Wallet Architectures, Attack Vectors, and Related Work  
This section presents a technical overview of smart contract-based wallet architectures and outlines common attack vectors that affect decentralized applications. In addition, it includes a comparison with existing academic papers to smart contract security, to highlight the distinctive methodological choices made in this study. Although many of wallet features and attack vectors are well documented, we include this overview to establish a technical foundation for the risk-oriented analysis presented in Sections 4 and 5. Summarizing key wallet properties and known vulnerabilities enables a more structured and comparative discussion of security implications in the prototype application. The review begins with MetaMask [5], a widely used cryptocurrency wallet introduced in 2016. MetaMask is fully compatible with the Ethereum platform and is available as both a mobile application and a browser extension. Currently, the extension supports multiple modern web browsers, including Google Chrome, Mozilla Firefox, Opera, and Microsoft Edge. One of MetaMask's key advantages is its ability to create and manage multiple accounts that can be used on different Ethereum-based networks. It allows users to easily switch between networks, perform transactions using ETH or ERC-20 tokens, and track their transaction history and balances [28]. Figure 2 presents the architecture of a MetaMask-based platform and its integration with an Ethereum blockchain network. MetaMask relies on Infura [29], a service that facilitates secure connections to the blockchain. Unlike custodial services, Infura does not store private keys, which enhances security by ensuring that users retain control over their cryptographic credentials. Instead, private keys are stored locally on the user's device, reducing the risk of unauthorized access. Communication between MetaMask and Infura is carried out using the JSON-RPC protocol [30], a standard communication framework that allows interaction with blockchain nodes through remote procedure calls (RPC). When creating a MetaMask wallet, users are required to create a password that is used within the browser extension to unlock and access the contents of the wallet. Additionally, MetaMask provides users with the option to secure their accounts using a secret recovery phrase (SRP). The SRP consists of twelve randomly generated words, which serve as a backup mechanism to recover access to the wallet in the event of loss of password or device failure. Users are required to carefully store and safeguard this phrase, as anyone gaining access to it can take full control of the wallet and its assets. This phrase is not stored on MetaMask servers, it is solely the responsibility of the user to ensure its security. One of MetaMask's greatest strengths is its seamless integration with dApps. As a browser extension, it allows users to quickly access and interact with the Ethereum ecosystem. Furthermore, MetaMask is praised for its user-friendly interface, which is intuitive even for people who are new to cryptocurrency transactions. The wallet offers advanced security features, including encryption of private keys, to ensure that they remain protected on the user's device and local storage of account information, rather than relying on centralized external servers. However, as a hot wallet, MetaMask remains constantly connected to the Internet, making it susceptible to cyber threats such as phishing attacks, malware, and hacking attempts. This is a shared limitation among all hot wallets, as their constant connectivity increases the risk of unauthorized access. The next notable cryptocurrency wallet worthy of detailed discussion is Trust Wallet [6], which is owned by Binance, one of the world's largest cryptocurrency exchanges. Trust Wallet is available as both a mobile application and a browser extension, offering flexibility and convenience to users who manage their digital assets across multiple platforms.