harden: a page-supplied transaction nonce is honoured and shown only as a bare number #404

New Issue

2026-09-21T20:37:56+02:00

clawbot commented

2026-09-21 20:37:56 +02:00

Severity: hardening.

Where. src/shared/approvalTx.js:54-66 (REQUEST_FIELDS includes nonce,
passed to populateTransaction); src/popup/views/approval.js:228 (the nonce is
rendered as a plain number).

What is wrong. A dApp can fix the nonce of the transaction the user is asked
to sign. A nonce equal to a pending transaction's, paired with the fee the page
also supplies, can replace that transaction; a nonce above the account's next
nonce strands the transaction behind a gap. The approval screen shows the nonce
as a bare number with nothing to say the site chose it.

Why it matters. A dApp can cancel or replace the user's own pending
transactions, or strand a signed one, without the user understanding that the
nonce was site-chosen.

Reproduction. From a connected page, eth_sendTransaction with an explicit
nonce equal to a pending transfer's nonce (and a higher fee) — after approval
the user's own transfer is replaced.

Acceptable. Ignore a page-supplied nonce and populate it from the network
(as most wallets do), or mark on the approval screen that the nonce was chosen by
the site and state the consequence.

Definition of done.

Either the page-supplied nonce is dropped and populated from the network,
or the approval screen labels a site-chosen nonce and its effect.
A test asserts the chosen behaviour for a page that supplies a nonce.

Model: fable-5-1 (review); opus-4-8 (filing)

Severity: hardening. **Where.** `src/shared/approvalTx.js:54-66` (`REQUEST_FIELDS` includes `nonce`, passed to `populateTransaction`); `src/popup/views/approval.js:228` (the nonce is rendered as a plain number). **What is wrong.** A dApp can fix the nonce of the transaction the user is asked to sign. A nonce equal to a pending transaction's, paired with the fee the page also supplies, can replace that transaction; a nonce above the account's next nonce strands the transaction behind a gap. The approval screen shows the nonce as a bare number with nothing to say the site chose it. **Why it matters.** A dApp can cancel or replace the user's own pending transactions, or strand a signed one, without the user understanding that the nonce was site-chosen. **Reproduction.** From a connected page, `eth_sendTransaction` with an explicit `nonce` equal to a pending transfer's nonce (and a higher fee) — after approval the user's own transfer is replaced. **Acceptable.** Ignore a page-supplied nonce and populate it from the network (as most wallets do), or mark on the approval screen that the nonce was chosen by the site and state the consequence. **Definition of done.** - [ ] Either the page-supplied nonce is dropped and populated from the network, or the approval screen labels a site-chosen nonce and its effect. - [ ] A test asserts the chosen behaviour for a page that supplies a nonce. Model: fable-5-1 (review); opus-4-8 (filing)

clawbot referenced this issue

2026-09-21 20:39:01 +02:00

security: pre-1.0 review of key handling, DEBUG mode and RPC/dApp input validation #383

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/AutistMask#404