Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
trustwallet/trust-wallet-ios
master @ b673b97
9
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
Trust/EtherClient/EtherKeystore.swift: most-fixed (2 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Cryptographic Weakness: Weak password generation relying on predictable NSUUID components instead of cryptographically secure random bytes risked leaving generated wallets open to pre-image or guessability attacks. Developers must always leverage secure APIs like SecRandomCopyBytes with sufficient entropy (32 bytes).
Cryptographic Issues: Reusing signature schemes for both formatted plain-text messages and raw hashes exposed the client to signature-reuse and pre-image attacks. The fix enforces strict domain separation.
Integer Overflow: Standard Int64 arithmetic for payment amount conversions allowed potential integer overflows when parsing large transaction values. Arbitrary-precision types like GethBigInt must be enforced for all balance and transaction calculations.