Security context

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

src/wallet-crypto.js: most-fixed (6 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Failures in validating the output of symmetric decryption routines previously allowed silent failures to return empty strings instead of throwing exceptions. This resulted in downstream components assuming successful authentication under an invalid key state. Developers must ensure that all decryption pathways explicitly assert structural and mathematical correctness before proceeding.

Cryptographic Issues: Miscalculations in cryptographic block sizes (passing key bit sizes instead of block bit sizes, or passing bits instead of bytes) corrupt padding implementations, leading to interoperability failures or padding oracle exposure. Precise unit validation is required for parameters passed to padding layers.

Cryptographic Issues: Sensitive cryptographic elements like transaction private keys can accidentally bypass encryption during state preservation or serialization tasks (such as backups). Correct conditional checks must guarantee encryption of raw assets if a second password is configured.