Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tonkeeper/tonkeeper-web

              main @ 56586ec
            

Fixes

CVEs

HIGH

Peak severity

45.0%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

packages/core/src/service/proService.ts: most-fixed (2 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Bypasses in dApp origin validation allow untrusted dApps to spoof trusted origins and authorize unauthorized transaction signing actions. Strict domain and origin comparisons must be strictly enforced without exceptions.

Cross-Origin Resource Sharing (CORS) / Message Bypass: Inadequate postMessage origin and source validation in the browser extension allowing malicious websites to inject forged API responses. Implement strict origin validation on all window event listeners.

Cross-Origin Information Leak: Using wildcard target origins during postMessage events can leak sensitive Telegram OAuth credentials to untrusted origins. Target origins must be limited to local window origins.