Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
cake-tech/cake_wallet
dev @ cda9d09
18
Fixes
0
CVEs
HIGH
Peak severity
22.2%
Coverage
Highlights
Auth Bypass: 8 prior fixes. Scrutinize any change in this area.
cw_evm: most-fixed (3 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Critical wallet routes, such as private key display or backup navigation, have repeatedly bypassed PIN and 2FA authentication due to incomplete state validation, route transition bypasses, and state-restoration gaps. Developers must enforce unconditional PIN checks for critical paths irrespective of the global timeout.
Spoofing: EVM token imports and dashboards were vulnerable to homoglyph and asset-spoofing attacks, allowing scam tokens to impersonate legitimate native assets or default symbols without prior validation or normalization.
Insecure Storage: Sensitive configuration settings and biometric metadata were written in plain-text to SharedPreferences, exposing auth state configurations to local extraction vectors on-device.