Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
trustee-wallet/trusteewallet
master @ 8a958e6
14
Fixes
0
CVEs
CRITICAL
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
crypto/actions/BlocksoftTransfer/BlocksoftTransfer.ts: most-fixed (2 issues). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Insecure Randomness: Weak pseudo-random number generation during WalletConnect initialization could allow attackers to predict cryptographic keys, exposing user funds to compromise. Secure random generation using node crypto is required.
Auth Bypass: Retrieving system keychain credentials without explicitly forcing biometric prompts allows unauthorized context execution to bypass authentication and expose keys.
Transaction Integrity: Discrepancies between target addresses and cached fee parameters can cause transactions to be sent to mismatched destinations, requiring rebuilding and validating transaction hexes.