OBSIDIAN
Security advisory: the official Obsidian Wallet and how to check it's us
Obsidian Wallet is a self-custody Solana wallet. Your keys stay yours: we can't move your funds, and nobody from Obsidian will ever ask for them. This page is the reference for what genuine Obsidian looks like. If something claiming to be Obsidian doesn't match it, it isn't us.
The only official website and accounts
Website: https://obsidianwallet.co. The app, sign-in and every wallet screen are on this domain and no other.
X (Twitter): @obswallet
Email: support@obsidianwallet.co
Any other website, app, account or email address using the Obsidian name or look is not run by us, however similar it seems. Check the address bar before you sign in or approve anything.
Passkeys protect you here: an Obsidian passkey is tied to obsidianwallet.co by your device, so a lookalike website can't use it. If a passkey prompt names any other site, stop.
Obsidian will never ask you to
- tell us, or type anywhere for us, your recovery phrase, private key, passcode or 2-step codes;
- send crypto to "verify", "validate", "sync", "unlock" or "upgrade" a wallet;
- install remote-access software, or join a call to "fix" your wallet;
- move funds to a "safe" or "new" wallet that we give you;
- message you first on X, Telegram or Discord offering support.
The only time you enter a recovery phrase is inside the app at obsidianwallet.co, when you choose to restore or import a wallet. It is encrypted in your browser with your passcode before it's saved; our servers only ever hold the encrypted copy and can't read it.
Addresses and programs
Fee wallet. Obsidian's swap fee is paid into this wallet, inside the swap itself. It is the only address our fees go to:
The exact fee for each swap is shown on the review screen before you approve: 1% for most tokens, 0.65% between major tokens, 0.1% between stablecoins.
Programs an Obsidian swap calls. Before you sign, Obsidian simulates every swap and refuses to sign one that calls any program not on this list, approves someone else to spend your tokens, or hands over control of an account:
| Program | Address |
|---|---|
| Jupiter aggregator v6 | JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4 |
| Token | TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA |
| Token-2022 | TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb |
| Associated Token Account | ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL |
| System | 11111111111111111111111111111111 |
| Compute Budget | ComputeBudget111111111111111111111111111111 |
Obsidian does not use a program of its own in swaps. If something claiming to be Obsidian asks you to sign a transaction that calls an unknown "Obsidian" program, don't sign it.
Found a vulnerability or a fake Obsidian?
- Email support@obsidianwallet.co with "Security" in the subject.
- For a vulnerability: what you found, how to reproduce it, and what it could affect. Please don't test it against other people's accounts or funds, and give us reasonable time to fix it before sharing it publicly.
- For an impersonator: the website, account or message, and a screenshot if you have one.
We never ask for your recovery phrase or keys in a report, and you should never include them.