Slush — A Sui Wallet
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Invests in your future self with Slush, a comprehensive wallet for buying and selling tokens that also enables swapping, staking, and DeFi use cases directly within the app. With its enterprise-grade security, users can log in via social login or seed phrase, making it accessible to everyone. Suitable for individuals looking to manage their digital assets across the Sui ecosystem.
Overview
Invest in your future self with Slush (formerly known as Sui Wallet). Buy and sell tokens, then swap, stake, or use them in DeFi—all directly in the app.
Other exciting Slush features:
- Enterprise-grade security
- Log in how you like. You can use a social login or seed phrase
- Send bundles of tokens and NFTs in a link or QR code
- Explore apps across the Sui ecosystem
Tags
Privacy Practices
Security Analysis — Slush — A Sui Wallet
Permissions
Code Patterns Detected
External Connections
Package Contents 83 files · 32.3MB
What This Extension Does
Slush (formerly Sui Wallet) is a browser extension that allows users to manage their Sui tokens, including buying, selling, swapping, staking, and using them in DeFi. It's designed for productivity and developer use cases, with features like enterprise-grade security and social login options.
Permissions Explained
- storageexpected: This permission allows the extension to store data locally on your device.
Technical: The extension has access to Chrome's storage API, which enables it to save and retrieve user data. This includes sensitive information like token balances and private keys. - tabsexpected: This permission allows the extension to access and interact with your browser tabs.
Technical: The extension has access to Chrome's tab management API, which enables it to switch between tabs, read tab content, and inject scripts into pages. - alarmsexpected: This permission allows the extension to schedule notifications and reminders.
Technical: The extension has access to Chrome's alarm API, which enables it to send notifications and reminders to users. This could potentially be used for phishing or other malicious purposes if compromised. - unlimitedStoragecheck this: This permission allows the extension to store an unlimited amount of data locally on your device.
Technical: The extension has access to Chrome's storage API with elevated permissions, which enables it to store large amounts of user data. This could potentially be used for malicious purposes if compromised. ⚠ 1 - identitycheck this: This permission allows the extension to access your Google account information and login credentials.
Technical: The extension has access to Chrome's identity API, which enables it to authenticate users using their Google accounts. This could potentially be used for phishing or other malicious purposes if compromised. ⚠ 1 - offscreencheck this: This permission allows the extension to run in the background even when you're not actively using it.
Technical: The extension has access to Chrome's offscreen API, which enables it to continue running in the background and accessing user data. This could potentially be used for malicious purposes if compromised. ⚠ 1
Your Data
The extension accesses your browser storage, tabs, and identity information, and sends data to various domains including www.w3.org, react.dev, and github.com. It also uses the Sentry error tracking service.
Technical Details
Code Findings
The extension uses dynamic JavaScript imports to load code at runtime, which can make it harder to analyze and debug.
Technical: The extension uses the import() function to dynamically import JavaScript modules. This is a common pattern in modern web development but can also be used for malicious purposes if not properly secured.
💡 Dynamic imports are commonly used in legitimate extensions to load code conditionally or lazily.
The extension uses string manipulation techniques to obfuscate its code, making it harder to analyze and debug.
Technical: The extension uses the String.fromCharCode() function to encode strings in a way that makes them harder to read. This is often used for malicious purposes but can also be used for legitimate reasons like protecting sensitive information.
💡 String manipulation techniques are commonly used in legitimate extensions to protect sensitive information or implement encryption.
The extension uses character code manipulation techniques to obfuscate its code, making it harder to analyze and debug.
Technical: The extension uses the String.charCodeAt() function to manipulate character codes in a way that makes them harder to read. This is often used for malicious purposes but can also be used for legitimate reasons like protecting sensitive information.
💡 Character code manipulation techniques are commonly used in legitimate extensions to protect sensitive information or implement encryption.
Overall, the Slush extension has a moderate risk profile due to its access to sensitive user data and use of dynamic imports and obfuscation techniques. While it appears to be designed for legitimate purposes, users should exercise caution when installing and using this extension.
