Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
tahowallet/extension
main @ a316d5a
40
Fixes
0
CVEs
HIGH
Peak severity
35.9%
Coverage
Highlights
Auth Bypass: 24 prior fixes. Scrutinize any change in this area.
background/services/provider-bridge/index.ts: most-fixed (11 issues). Treat as high-risk during review.
20 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Untrusted dApps were historically able to invoke RPC commands and leak user address metrics due to missing, shallow, or non-network-aware permission checks. Validation must enforce combined origin and address-specific compound keys, validate chainIDs, and strictly gate routeContentScriptRPCRequest.
Auth Bypass: Logical inversion bugs, incorrect null-checks for read-only accounts, and incomplete keyring-unlock checks could permit unauthorized transaction signing and broadcasting.
Denial of Service: Cascading permission prompts from untrusted dApps and unreleased pending permission states on window closure repeatedly froze the browser, necessitating active request rejection and connection-port monitors.