Security model
Where your keys live, what leaves your device, and what RobinCash can and cannot see.
The short version
Key storage and encryption
- The mnemonic is encrypted with AES-GCM, with the key derived from your password via PBKDF2. The ciphertext lives in
chrome.storage.local, sandboxed to the extension by Chrome. - Decrypted key material exists only in the extension's session memory while the wallet is unlocked. Locking the wallet or closing the browser clears it.
- One mnemonic derives all accounts: EVM accounts on the standard derivation path and Solana accounts on
m/44'/501'. Importing that phrase into any standard wallet recovers your funds independently of RobinCash.
What leaves your device
Three kinds of traffic, none of which include key material:
| Traffic | Contains |
|---|---|
| Quote and route requests | Token address, amounts, and your public wallet address |
| Balance and price lookups | Public addresses being queried |
| Signed transactions | The final transaction, signed locally, broadcast to the network |
Signing always happens on your device. Remote services only ever see what the public blockchain would see anyway.
The router proxy
Provider API keys (Uniswap, 0x, Jupiter, Alchemy) are kept in a separate proxy service rather than embedded in the extension, where anyone could extract them from the bundle. The proxy forwards requests and holds keys in its environment. If you run it yourself, run it on a machine you trust and do not expose it to the public internet without access controls.
Token safety checks
Before you trade, the terminal surfaces contract-level intel: honeypot indicators, liquidity depth, holder concentration, and deployer history. These checks reduce risk but cannot eliminate it. A clean scan is not a guarantee.
Your responsibilities
- Back up your recovery phrase offline. Without it, funds are unrecoverable.
- Verify token contracts and chains before confirming any trade.
- Use a strong, unique password for the vault.
RobinCash's detection and routing are execution tools, not investment advice. Digital assets are volatile.