Designing What-You-See-Is-What-You-Sign (WYSIWYS) hardware architectures to defeat address poisoning and clipboard hijackers.
Sophisticated adversaries compromise application servers to swap destination wallet addresses immediately prior to signature generation. If an HSM performs 'blind signing' without decoding transaction payloads, it signs fraudulent transactions with legitimate authority.
AssetHSM includes specialized hardware parsers capable of decoding EVM ABI payloads, Bitcoin SegWit/Taproot scripts, and Solana transaction instructions. The enclave parses human-readable transfer amounts, recipient addresses, and contract calls, displaying them on dedicated secure hardware screens before signing.
Recipient addresses are verified against an internal hardware whitelist signed during multi-party governance ceremonies. If a destination address is not explicitly whitelisted, the transaction is rejected at the silicon boundary.