Security
Security at Tonkey
Your funds sit in a multisig contract on TON, not with us. Here is what that contract is, what Tonkey does around it, and what to watch out for.
Tonkey will never ask you for your seed phrase.
Not in the app, not in Telegram, not by email. Anyone who asks for it is trying to steal your funds.
The contract
Tonkey uses only multisig-contract-v2 (multisig v2 and its order contract), written by the TON core team and published as open source on GitHub.
Its logic cannot be changed after deploy. Nobody except signers and proposers can create orders, and nobody except signers can approve them.
Audits
The contract has been audited by two security firms. The reports are published in the contract repository.
These audits cover the smart contract. They are not an audit of the Tonkey app.
Code hashes
Every multisig and order that Tonkey deploys uses exactly this code. Compare the code hash of your multisig on TonScan with the value below.
d3d14da9a627f0ec3533341829762af92b9540b21bf03665fac09c2b46eabbac6305a8061c856c2ccf05dcb0df5815c71475870567cab5f049e340bcf59251f3What Tonkey does
- Builds messages for the official multisig contract and hands them to your wallet to sign.
- Reads public blockchain data from TON Center.
- Decodes orders and simulates them so you can see what you are approving.
- Keeps your address book and signer names in your own browser.
What Tonkey does not do
- Hold your keys, your seed phrase or your funds.
- Run a backend or keep accounts.
- Move funds without the approvals your multisig requires.
- Reverse a transaction or recover a lost key.
Threat model
What a multisig protects you from, and what it cannot.
A signer loses a key or has it stolen
One key cannot move funds on its own. As long as enough honest signers remain to reach the threshold, they can keep operating and remove the compromised signer with a settings order.
A malicious or mistaken order
An order can contain any action, including ones that change the signers. Read every action, run the simulation, and never approve something you do not understand. Approvals cannot be revoked.
Phishing sites and fake apps
Only use app.tonkey.site, and check the address bar before you connect a wallet. Tonkey will never ask for your seed phrase.
Settings change while orders are pending
An order is valid only while the multisig signers match the ones it was created with. After a settings change, older pending orders cannot execute.
Tonkey or TON Center is unavailable
Your multisig is a standard contract on TON. The funds do not depend on Tonkey being online, and any tool that supports multisig-contract-v2 can create and approve orders.