Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
chainapsis/keplr-wallet
develop @ a4f0a79
72
Fixes
0
CVEs
CRITICAL
Peak severity
39.5%
Coverage
Highlights
Auth Bypass: 41 prior fixes. Scrutinize any change in this area.
packages/background/src/permission/service.ts: most-fixed (4 issues). Treat as high-risk during review.
38 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Incomplete permission checks in interactive account switching and keyring unlocking operations allowed unauthorized callers to manipulate active keys. Strict validation of message origins and global permission verification are required to gate sensitive handlers.
Auth Bypass: Absence of direct chain ID and origin verification checks in Ethereum transaction routing handlers enabled unauthorized origins to execute EVM operations. Handlers must normalize signer addresses and strictly validate origins beforehand.
Auth Bypass: Permission mappings and chain identification boundaries were bypassed when validation flows prematurely registered authorizations before actual interactive user approval, or incorrectly indexed permission lookup properties.