Skip to content

Back to the catalog

TRONSEC
github.comrepo

TRONSEC

TRONSEC is an open-source, browser-based security workbench for the TRON blockchain (TRX mainnet) that lets users inspect wallet addresses, TRC-20 token approvals, smart contracts, transaction calldata, and URLs for risk without connecting a wallet or holding custody. It bundles a wallet risk scanner, AML/sanctions-exposure heuristics, an unlimited-approval monitor, a contract-privilege/proxy checker, a transaction decoder that flags drain patterns, a phishing/typosquat URL checker, and a local in-browser vanity address generator. Production API keys for TronGrid, TronScan, and VirusTotal are kept server-side via a Cloudflare Worker proxy rather than shipped in client JS.

TL;DR Open-source, wallet-connection-free security terminal for auditing TRON addresses, TRC-20 approvals, contracts, transactions, and phishing URLs.
Open original ↗
Document

What it is

TRONSEC v1.3.0 (MIT license) as a runnable, self-hostable app rather than just a hosted tool. The GitHub repo is the readable JavaScript export of the modules behind tronsec.io/app — vanilla JS, Tailwind, Lucide, D3.js, Web Workers, no React/Vue build step. Ships eight UI locales (EN, RU, ZH, ES, PT-BR, VI, TR, ID) in assets/js/i18n-locales.js.

What to do

Run it locally with no keys — the default config points at TRONSEC's public Cloudflare Worker:

git clone https://github.com/jamejohns/tronsec.git
cd tronsec
python -m http.server 8080
# open http://localhost:8080/app/

The default (public, non-secret) worker base is set in app/js/proxy-config.js:

window.TRONSEC_PROXY = { base: 'https://api-proxy.tronsec-io.workers.dev' };

Two paths beyond the default, worth knowing before you rely on it:

  • Self-host properly: deploy your own worker (tronsec-worker-starter), store TronGrid/TronScan/VirusTotal keys as Wrangler secrets, repoint proxy-config.js, and restrict CORS. This is the recommended way to control credentials.
  • Direct dev keys (advanced only): copy app/js/secrets.local.example.js → secrets.local.js to use TronGrid/TronScan keys directly on your machine. The page explicitly flags this is not how tronsec.io works — it puts keys in the browser context, defeating the server-side-secret design.

If you fork, the license terms require keeping attribution in app/js/brand.js and linking to tronsec.io.

Caveats

The page is explicit about scope limits the summary doesn't state:

  • Not a compliance tool. AML output is "heuristic on-chain signals for research and user protection… not a substitute for formal KYC/AML procedures or legal advice." Don't wire it into a compliance decision.
  • Read-only only. No transaction execution, no custody, no seed-phrase or signing requests. Vanity search runs in local Web Workers and generated keys never leave the browser.
  • Mainnet only. TRON TRX / TRC-20 / TRON smart contracts — no testnet or other chains.
  • The OSS export is deliberately partial: "production-only operational code" is withheld, so auditing this repo does not fully audit what runs on tronsec.io.

Technologies named here

Techniques named here

  • AML / sanctions exposure screening
  • TRC-20 allowance/approval monitoring
  • Account permission auditing
  • Smart contract risk heuristics
  • Transaction calldata decoding
  • URL phishing / typosquat detection
  • Local vanity address generation

Related in Blockchain