sneak/AutistMask
1
0
Fork 0
Code Issues 67 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

harden: a page can open unbounded concurrent approval windows #405

New Issue
Open
opened 2026-09-21 20:37:56 +02:00 by clawbot · 0 comments
clawbot commented 2026-09-21 20:37:56 +02:00
Collaborator
Copy Link
Copy Source

Severity: hardening.

Where. src/background/index.js:462-483 (requestApproval), 520-535
(requestSignApproval) and 395-458 (openApprovalWindow). Only transaction
approvals hold a single slot (txApprovalSlot).

What is wrong. Site-connection and message/typed-data signing approvals are
not coalesced or capped, so each eth_requestAccounts or personal_sign call
opens a new approval window; a page can open many at once.

Why it matters. A wall of identical prompts is harassment / denial of
service, and pushes the user toward a reflexive approve.

Reproduction. An unconnected page calls eth_requestAccounts in a loop; each
call opens another approval window. A connected page does the same with
personal_sign.

Acceptable. Coalesce pending requests per origin and method (return the same
pending promise), cap the number of open approval windows, and refuse further
requests with EIP-1193 -32002 while one is pending.

Definition of done.

  • Repeated same-origin, same-method approval requests do not open more than
    one window.
  • A further request while one is pending is refused with -32002.
  • A test asserts a loop of requests yields at most one open approval and one
    -32002 per extra call.

Model: fable-5-1 (review); opus-4-8 (filing)

Severity: hardening. **Where.** `src/background/index.js:462-483` (`requestApproval`), `520-535` (`requestSignApproval`) and `395-458` (`openApprovalWindow`). Only transaction approvals hold a single slot (`txApprovalSlot`). **What is wrong.** Site-connection and message/typed-data signing approvals are not coalesced or capped, so each `eth_requestAccounts` or `personal_sign` call opens a new approval window; a page can open many at once. **Why it matters.** A wall of identical prompts is harassment / denial of service, and pushes the user toward a reflexive approve. **Reproduction.** An unconnected page calls `eth_requestAccounts` in a loop; each call opens another approval window. A connected page does the same with `personal_sign`. **Acceptable.** Coalesce pending requests per origin and method (return the same pending promise), cap the number of open approval windows, and refuse further requests with EIP-1193 `-32002` while one is pending. **Definition of done.** - [ ] Repeated same-origin, same-method approval requests do not open more than one window. - [ ] A further request while one is pending is refused with `-32002`. - [ ] A test asserts a loop of requests yields at most one open approval and one `-32002` per extra call. Model: fable-5-1 (review); opus-4-8 (filing)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#405