Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
alphawallet/alpha-wallet-android
master @ c873a4a
39
Fixes
0
CVEs
HIGH
Peak severity
46.2%
Coverage
Highlights
Auth Bypass: 15 prior fixes. Scrutinize any change in this area.
app/src/main/java/com/alphawallet/app/service/KeyService.java: most-fixed (2 issues). Treat as high-risk during review.
22 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Gating authorization callbacks and ensuring actual phone security verification during transaction signing is critical. Historical bugs allowed signing dialog bypasses if biometrics were absent or if the authentication callback was detached.
Auth Bypass: Read-only or watch-only wallets must never trigger transaction or message signing capabilities. Bypassing this restriction allows unauthorized visual presentation or execution of wallet activities.
Insecure WebView Configuration: Allowing file access from file/universal URLs within WebViews permits malicious loaded pages to extract sensitive local files, which is particularly hazardous in Web3 contexts.