Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

airgap-it/airgap-wallet

              master @ 9ccebc2
            

Fixes

CVEs

MEDIUM

Peak severity

50.0%

Coverage

Highlights

Cryptographic Issues: 1 prior fix. Scrutinize any change in this area.

ios/App/App/Helpers/JS.swift: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cryptographic Issues: Truncating cryptographic signatures by extracting an incorrect byte range (63 bytes instead of 64) from Ledger responses can result in invalid signature generation, failed transactions, or downstream verification bypasses. Developers must ensure protocol-level offsets and payload sizes strictly adhere to the target Ledger app specifications.

Denial of Service: Leaking Swift Task continuations within awaitResultWithID by failing to resume them on both synchronous and asynchronous result execution paths can lead to thread exhaustion and application lockups on iOS. Ensure that all execution paths in native-to-JS bridge helpers explicitly resume pending continuations exactly once.

Input Validation: Returning boolean values instead of validation error objects inside Angular validators can bypass UI/UX-level security checks, potentially allowing malformed addresses or invalid quantities to propagate. Form validators must strictly return Expected validation structures to prevent silent bypasses.