Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

input-output-hk/nami

              main @ e52e0bd
            

Fixes

CVEs

HIGH

Peak severity

80.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

src/ui/app/pages/signTx.jsx: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Bypassing transaction validation before showing authorization prompts allowed unsafe transactions to reach the user. Developers must ensure background validation occurs prior to creating UI prompts.

Information Disclosure: Failing to compute and display the actual spent value of transactions could lead users to sign deceptive or malicious payloads. Transaction screens must faithfully reconstruct and display spent values from inputs and outputs.

Auth Bypass: Missing checks on the collateral return destination address could result in collateral loss to mismatched destination addresses during transaction execution.