Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lil-org/big-wallet

              main @ 71b92f1
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

Tokenary: most-fixed (4 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Local authentication gates for sensitive actions like transaction signing and wallet login have historically been bypassed due to incomplete nil-handling when dismissing password prompts or missing Face ID/password validation gates completely.

Auth Bypass: The bridge mechanism between browser extensions and the native application (both macOS and iOS) has previously lacked verification of request state, allowing unauthorized external actors to trigger arbitrary wallet actions.

Auth Bypass: Overly permissive host configurations in universal links and transaction request allowlists (such as temporary staging/Vercel domains) can allow unauthorized external parties to request and trigger transaction flows.