Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ton-connect/sdk
main @ f27d654
5
Fixes
50
CVEs
CRITICAL
Peak severity
Highlights
Input Validation: 2 prior fixes. Scrutinize any change in this area.
apps/demo-dapp-with-react-ui/src/server/services/sign-data-service.ts: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Verifying raw signatures without explicit domain isolation allows attackers to replay valid signatures captured from other domains on the target dApp.
Cryptographic Weakness: Relying on custom or platform-dependent global webcrypto lookups for entropy generation can fall back to insecure or missing sources. Using built-in, proven library primitives ensures reliable nonce entropy.
Crypto Key Management: Using TextDecoder to decode raw binary public keys corrupts binary key data and leads to weak or predictable session ID generation, whereas standard hex encoding preserves key entropy.